Something went wrong. Try again.
Monorepo for Aesthetic.Computer aesthetic.computer
Something went wrong. Try again.
JavaScript
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798// claude-token, 2026.03.16// Store/retrieve device tokens (Claude OAuth + GitHub PAT) per handle.// GET → returns tokens for the authenticated user's own handle// GET ?handle=X → admin-only: returns tokens for handle X (used by// ac-inscribe --for-handle when an admin flashes a// USB on behalf of another user). Returns sub so the// inscription's usbConfig can be built without an// access_token (admins cannot sign for other users).// POST {token, githubPat} → stores tokens for authenticated user's handle
import { authorize, hasAdmin } from "../../backend/authorization.mjs";import { connect } from "../../backend/database.mjs";import { respond } from "../../backend/http.mjs";import { getDeviceCreds, setDeviceCreds } from "../../backend/device-creds.mjs";
export async function handler(event) { // GET: Retrieve tokens for the authenticated user — or, when an admin // passes ?handle=X, for that other handle so the admin can flash a USB // pre-baked with that user's claude/github creds. if (event.httpMethod === "GET") { const user = await authorize(event.headers); if (!user) return respond(401, { message: "unauthorized" });
const targetHandle = event.queryStringParameters?.handle; const database = await connect(); try { // Resolve which handle/sub we're fetching creds for (self, or another // handle when an admin is flashing on their behalf). let existing; if (targetHandle) { const isAdmin = await hasAdmin(user, "aesthetic"); if (!isAdmin) return respond(403, { message: "admin only" }); existing = await database.db .collection("@handles") .findOne({ handle: targetHandle }, { projection: { handle: 1 } }); } else { existing = await database.db .collection("@handles") .findOne({ _id: user.sub }, { projection: { handle: 1 } }); } if (!existing) return respond(404, { message: "Handle not found" });
// Creds live in the dedicated device-creds store, keyed by sub. const creds = await getDeviceCreds(database.db, existing._id); return respond(200, { handle: existing.handle, sub: existing._id, token: creds?.claudeToken || null, githubPat: creds?.githubPat || null, }); } finally { await database.disconnect(); } }
// POST: Save tokens for authenticated user if (event.httpMethod === "POST") { const user = await authorize(event.headers); if (!user) return respond(401, { message: "unauthorized" });
let body; try { body = JSON.parse(event.body); } catch { return respond(400, { message: "Invalid JSON" }); }
const database = await connect(); try { const handles = database.db.collection("@handles"); const existing = await handles.findOne( { _id: user.sub }, { projection: { handle: 1 } }, ); if (!existing) return respond(404, { message: "Handle not found" });
// Write into the dedicated device-creds store (never onto @handles). const { saved } = await setDeviceCreds(database.db, user.sub, { claudeToken: body.token, githubPat: body.githubPat, }); if (saved.length === 0) { return respond(400, { message: "No valid tokens provided" }); }
return respond(200, { message: `Tokens saved for @${existing.handle}`, handle: existing.handle, saved, }); } finally { await database.disconnect(); } }
return respond(405, { message: "Method Not Allowed" });}