@bash-app/bash-common 30.225.0 → 30.226.0

package/src/utils/__tests__/qrCodeUtils.test.ts

@@ -0,0 +1,143 @@
+/**
+ * qrCodeUtils — URL builders for the *navigable* `/ticket-details` deep
+ * links that get encoded into ticket QR codes (and createQrCodeImage that
+ * renders them as PNG data URLs).
+ *
+ * The contract these tests pin (consumed by the door-scan flow, ticket
+ * emails, and tier-share QR codes):
+ *
+ *   bashEventPrismaCheckoutQrCodeUrl(eventId, checkoutId)
+ *     → "/ticket-details/{eventId}/{checkoutId}"
+ *
+ *   bashEventQrCodeUrl(eventId)                                     → "/ticket-details/{eventId}"
+ *   bashEventQrCodeUrl(eventId, tierId)                             → "/ticket-details/{eventId}/ticket-tier/{tierId}"
+ *   bashEventQrCodeUrl(eventId, tierId, ticketId)                   → "/ticket-details/{eventId}/ticket/{ticketId}"   (ticketId WINS over tierId)
+ *   bashEventQrCodeUrl(eventId, _, _, slug)                         → "/ticket-details/{eventId}-{slug}"               (slug version of the deep link)
+ *
+ *   createQrCodeImage(data) → Promise<"data:image/png;base64,...">
+ *
+ * Bugs in any of these route door-scanners to the wrong page (= entry chaos).
+ */
+import {
+  bashEventPrismaCheckoutQrCodeUrl,
+  bashEventQrCodeUrl,
+  createQrCodeImage,
+} from "../qrCodeUtils.js";
+
+// ============================================================================
+// bashEventPrismaCheckoutQrCodeUrl — checkout-id deep link
+// ============================================================================
+
+describe("bashEventPrismaCheckoutQrCodeUrl", () => {
+  it("composes /ticket-details/{eventId}/{checkoutId}", () => {
+    expect(bashEventPrismaCheckoutQrCodeUrl("evt_123", "co_456")).toBe(
+      "/ticket-details/evt_123/co_456"
+    );
+  });
+
+  it("does NOT throw on null/undefined inputs (downstream link is broken-but-safe)", () => {
+    // The current contract just stringifies via template literal, so we pin
+    // the literal output rather than asserting an exception.
+    expect(bashEventPrismaCheckoutQrCodeUrl(null, null)).toBe(
+      "/ticket-details/null/null"
+    );
+    expect(
+      bashEventPrismaCheckoutQrCodeUrl(undefined, undefined)
+    ).toBe("/ticket-details/undefined/undefined");
+  });
+});
+
+// ============================================================================
+// bashEventQrCodeUrl — base / tier / ticket / slug variants
+// ============================================================================
+
+describe("bashEventQrCodeUrl", () => {
+  describe("base url (no tier, no ticket, no slug)", () => {
+    it("returns /ticket-details/{eventId}", () => {
+      expect(bashEventQrCodeUrl("evt_1")).toBe("/ticket-details/evt_1");
+    });
+  });
+
+  describe("with ticketTierId", () => {
+    it("appends /ticket-tier/{tierId}", () => {
+      expect(bashEventQrCodeUrl("evt_1", "tier_a")).toBe(
+        "/ticket-details/evt_1/ticket-tier/tier_a"
+      );
+    });
+
+    it("ignores null ticketId in favor of tier", () => {
+      expect(bashEventQrCodeUrl("evt_1", "tier_a", null)).toBe(
+        "/ticket-details/evt_1/ticket-tier/tier_a"
+      );
+    });
+  });
+
+  describe("with ticketId (the door-scan link)", () => {
+    it("appends /ticket/{ticketId}", () => {
+      expect(
+        bashEventQrCodeUrl("evt_1", undefined, "ticket_xyz")
+      ).toBe("/ticket-details/evt_1/ticket/ticket_xyz");
+    });
+
+    it("PREFERS ticketId over ticketTierId when both are provided", () => {
+      // Tickets are more specific than tiers; the deep link must resolve to the
+      // individual ticket (otherwise the door scanner can't validate redemption).
+      expect(
+        bashEventQrCodeUrl("evt_1", "tier_a", "ticket_xyz")
+      ).toBe("/ticket-details/evt_1/ticket/ticket_xyz");
+    });
+  });
+
+  describe("with slug", () => {
+    it("uses the slugged base (`/ticket-details/{eventId}-{slug}`)", () => {
+      expect(
+        bashEventQrCodeUrl("evt_1", undefined, undefined, "summer-rave")
+      ).toBe("/ticket-details/evt_1-summer-rave");
+    });
+
+    it("appends ticketId on the slugged base", () => {
+      expect(
+        bashEventQrCodeUrl("evt_1", undefined, "ticket_xyz", "summer-rave")
+      ).toBe("/ticket-details/evt_1-summer-rave/ticket/ticket_xyz");
+    });
+
+    it("appends ticket-tier on the slugged base when no ticketId", () => {
+      expect(
+        bashEventQrCodeUrl("evt_1", "tier_a", undefined, "summer-rave")
+      ).toBe("/ticket-details/evt_1-summer-rave/ticket-tier/tier_a");
+    });
+
+    it("falls back to non-slug base when slug is null", () => {
+      expect(bashEventQrCodeUrl("evt_1", null, null, null)).toBe(
+        "/ticket-details/evt_1"
+      );
+    });
+  });
+});
+
+// ============================================================================
+// createQrCodeImage — PNG data URL
+// ============================================================================
+
+describe("createQrCodeImage", () => {
+  it("returns a base64-encoded PNG data URL", async () => {
+    const dataUrl = await createQrCodeImage(
+      "https://bash.app/ticket-details/evt_1/ticket/abc"
+    );
+    expect(dataUrl).toMatch(/^data:image\/png;base64,/);
+    // Sanity: a real QR image will have *meaningful* base64 length, not a few bytes.
+    expect(dataUrl.length).toBeGreaterThan(200);
+  });
+
+  it("produces a deterministic PNG for the same input (no nonce / timestamp leakage)", async () => {
+    const a = await createQrCodeImage("ticket://abc");
+    const b = await createQrCodeImage("ticket://abc");
+    expect(a).toBe(b);
+  });
+
+  it("produces DIFFERENT output for different payloads", async () => {
+    const a = await createQrCodeImage("ticket://abc");
+    const b = await createQrCodeImage("ticket://xyz");
+    expect(a).not.toBe(b);
+  });
+});

package/src/utils/__tests__/stripeAccountUtils.test.ts

@@ -0,0 +1,93 @@
+/**
+ * stripeAccountUtils — the gate that decides whether a host can accept money.
+ *
+ * `stripeAccountFullyLinked` returns `true` ONLY when ALL FOUR of these are true:
+ *   - linkingStatus is non-null
+ *   - hasOutstandingRequirements === false
+ *   - isOnboarded === true
+ *   - paymentsEnabled === true
+ *   - taxMonitoringEnabled === true
+ *
+ * This is the single check used everywhere we decide "can this host get paid?"
+ * Returning `true` when any one is false leads to checkouts that can't actually
+ * disburse money. We pin all 5 axes individually so a future refactor that
+ * accidentally drops one will fail loudly.
+ */
+import { stripeAccountFullyLinked } from "../stripeAccountUtils.js";
+import type { StripeLinkingStatus } from "../../definitions.js";
+
+const fullyLinked: StripeLinkingStatus = {
+  isOnboarded: true,
+  hasOutstandingRequirements: false,
+  paymentsEnabled: true,
+  taxMonitoringEnabled: true,
+};
+
+describe("stripeAccountFullyLinked", () => {
+  describe("nullish guard", () => {
+    it("returns false for null", () => {
+      expect(stripeAccountFullyLinked(null)).toBe(false);
+    });
+    it("returns false for undefined", () => {
+      expect(stripeAccountFullyLinked(undefined)).toBe(false);
+    });
+  });
+
+  describe("happy path", () => {
+    it("returns true when ALL four flags are correct", () => {
+      expect(stripeAccountFullyLinked(fullyLinked)).toBe(true);
+    });
+  });
+
+  describe("each individual gate must be satisfied", () => {
+    it("returns false when isOnboarded is false", () => {
+      expect(
+        stripeAccountFullyLinked({ ...fullyLinked, isOnboarded: false })
+      ).toBe(false);
+    });
+    it("returns false when hasOutstandingRequirements is true", () => {
+      expect(
+        stripeAccountFullyLinked({
+          ...fullyLinked,
+          hasOutstandingRequirements: true,
+        })
+      ).toBe(false);
+    });
+    it("returns false when paymentsEnabled is false", () => {
+      expect(
+        stripeAccountFullyLinked({ ...fullyLinked, paymentsEnabled: false })
+      ).toBe(false);
+    });
+    it("returns false when taxMonitoringEnabled is false", () => {
+      expect(
+        stripeAccountFullyLinked({
+          ...fullyLinked,
+          taxMonitoringEnabled: false,
+        })
+      ).toBe(false);
+    });
+  });
+
+  describe("multi-flag failures (any combination = false)", () => {
+    it("returns false when payments AND tax monitoring are both disabled", () => {
+      expect(
+        stripeAccountFullyLinked({
+          ...fullyLinked,
+          paymentsEnabled: false,
+          taxMonitoringEnabled: false,
+        })
+      ).toBe(false);
+    });
+
+    it("returns false when EVERY flag is in the wrong state", () => {
+      expect(
+        stripeAccountFullyLinked({
+          isOnboarded: false,
+          hasOutstandingRequirements: true,
+          paymentsEnabled: false,
+          taxMonitoringEnabled: false,
+        })
+      ).toBe(false);
+    });
+  });
+});

package/src/utils/blog/__tests__/getRelatedBlogPosts.test.ts

@@ -0,0 +1,271 @@
+// Tests for getRelatedBlogPosts -- the tag-overlap-first scoring algorithm
+// that powers the "Related reading" rail under every blog detail page. The
+// scoring function is the SEO-critical surface (controls the internal-link
+// graph) so we exercise every branch of the priority sort:
+//   1. tag overlap count (descending)
+//   2. shared category (1/0)
+//   3. recency (most recent first)
+//
+// Plus the edge cases:
+//   - source post does not exist -> []
+//   - source has no tags + no category -> still returns recent published posts
+//   - limit cap
+//   - publishedAt null on a candidate is treated as oldest
+
+import { BlogStatus } from "@prisma/client";
+import { getRelatedBlogPosts } from "../blogDbUtils.js";
+
+interface SourceShape {
+  id: string;
+  categoryId: string | null;
+  tags: { id: string }[];
+}
+
+interface CandidateShape {
+  id: string;
+  slug: string | null;
+  title: string;
+  excerpt: string | null;
+  coverImage: string | null;
+  readTime: number | null;
+  publishedAt: Date | null;
+  categoryId: string | null;
+  tags: { id: string }[];
+}
+
+function makePrismaMock(opts: {
+  source: SourceShape | null;
+  candidates: CandidateShape[];
+}) {
+  const findUnique = jest.fn().mockResolvedValue(opts.source);
+  const findMany = jest.fn().mockResolvedValue(opts.candidates);
+  return {
+    blogPost: { findUnique, findMany },
+    __findUnique: findUnique,
+    __findMany: findMany,
+  };
+}
+
+function candidate(overrides: Partial<CandidateShape> = {}): CandidateShape {
+  return {
+    id: "c-default",
+    slug: "c-default",
+    title: "Default Candidate",
+    excerpt: "default",
+    coverImage: null,
+    readTime: 5,
+    publishedAt: new Date("2026-01-01T00:00:00Z"),
+    categoryId: null,
+    tags: [],
+    ...overrides,
+  };
+}
+
+describe("getRelatedBlogPosts", () => {
+  it("returns [] when the source post does not exist", async () => {
+    const prisma = makePrismaMock({ source: null, candidates: [] });
+    const out = await getRelatedBlogPosts(prisma as any, "missing-id");
+    expect(out).toEqual([]);
+    expect(prisma.__findMany).not.toHaveBeenCalled();
+  });
+
+  it("ranks candidates by shared tag count (descending)", async () => {
+    const source: SourceShape = {
+      id: "src",
+      categoryId: null,
+      tags: [{ id: "t1" }, { id: "t2" }, { id: "t3" }],
+    };
+    const candidates: CandidateShape[] = [
+      candidate({
+        id: "low",
+        title: "One tag in common",
+        tags: [{ id: "t1" }],
+        publishedAt: new Date("2026-03-01"),
+      }),
+      candidate({
+        id: "high",
+        title: "Three tags in common",
+        tags: [{ id: "t1" }, { id: "t2" }, { id: "t3" }],
+        publishedAt: new Date("2026-01-01"),
+      }),
+      candidate({
+        id: "mid",
+        title: "Two tags in common",
+        tags: [{ id: "t1" }, { id: "t2" }],
+        publishedAt: new Date("2026-02-01"),
+      }),
+    ];
+    const prisma = makePrismaMock({ source, candidates });
+    const out = await getRelatedBlogPosts(prisma as any, "src", 4);
+    expect(out.map((p) => p.id)).toEqual(["high", "mid", "low"]);
+  });
+
+  it("uses shared category as the tiebreaker when tag counts tie", async () => {
+    const source: SourceShape = {
+      id: "src",
+      categoryId: "cat-1",
+      tags: [{ id: "t1" }],
+    };
+    const candidates: CandidateShape[] = [
+      candidate({
+        id: "without-category",
+        tags: [{ id: "t1" }],
+        categoryId: "cat-other",
+        publishedAt: new Date("2026-03-01"),
+      }),
+      candidate({
+        id: "with-category",
+        tags: [{ id: "t1" }],
+        categoryId: "cat-1",
+        publishedAt: new Date("2026-01-01"),
+      }),
+    ];
+    const prisma = makePrismaMock({ source, candidates });
+    const out = await getRelatedBlogPosts(prisma as any, "src", 4);
+    expect(out.map((p) => p.id)).toEqual(["with-category", "without-category"]);
+  });
+
+  it("falls back to recency when both tag count and category tie", async () => {
+    const source: SourceShape = {
+      id: "src",
+      categoryId: "cat-1",
+      tags: [{ id: "t1" }],
+    };
+    const candidates: CandidateShape[] = [
+      candidate({
+        id: "older",
+        tags: [{ id: "t1" }],
+        categoryId: "cat-1",
+        publishedAt: new Date("2026-01-01"),
+      }),
+      candidate({
+        id: "newer",
+        tags: [{ id: "t1" }],
+        categoryId: "cat-1",
+        publishedAt: new Date("2026-04-01"),
+      }),
+    ];
+    const prisma = makePrismaMock({ source, candidates });
+    const out = await getRelatedBlogPosts(prisma as any, "src", 4);
+    expect(out.map((p) => p.id)).toEqual(["newer", "older"]);
+  });
+
+  it("treats null publishedAt as the oldest possible candidate", async () => {
+    const source: SourceShape = {
+      id: "src",
+      categoryId: null,
+      tags: [{ id: "t1" }],
+    };
+    const candidates: CandidateShape[] = [
+      candidate({
+        id: "no-date",
+        tags: [{ id: "t1" }],
+        publishedAt: null,
+      }),
+      candidate({
+        id: "dated",
+        tags: [{ id: "t1" }],
+        publishedAt: new Date("2026-01-01"),
+      }),
+    ];
+    const prisma = makePrismaMock({ source, candidates });
+    const out = await getRelatedBlogPosts(prisma as any, "src", 4);
+    expect(out.map((p) => p.id)).toEqual(["dated", "no-date"]);
+  });
+
+  it("respects the limit parameter", async () => {
+    const source: SourceShape = {
+      id: "src",
+      categoryId: null,
+      tags: [{ id: "t1" }],
+    };
+    const candidates: CandidateShape[] = Array.from({ length: 8 }, (_, i) =>
+      candidate({
+        id: `c${i}`,
+        title: `Candidate ${i}`,
+        tags: [{ id: "t1" }],
+        publishedAt: new Date(2026, 0, i + 1),
+      })
+    );
+    const prisma = makePrismaMock({ source, candidates });
+    const out = await getRelatedBlogPosts(prisma as any, "src", 3);
+    expect(out).toHaveLength(3);
+  });
+
+  it("defaults the limit to 4 when not provided", async () => {
+    const source: SourceShape = {
+      id: "src",
+      categoryId: null,
+      tags: [{ id: "t1" }],
+    };
+    const candidates: CandidateShape[] = Array.from({ length: 10 }, (_, i) =>
+      candidate({ id: `c${i}`, tags: [{ id: "t1" }] })
+    );
+    const prisma = makePrismaMock({ source, candidates });
+    const out = await getRelatedBlogPosts(prisma as any, "src");
+    expect(out).toHaveLength(4);
+  });
+
+  it("queries by tag-overlap OR shared category, excluding the source", async () => {
+    const source: SourceShape = {
+      id: "src",
+      categoryId: "cat-1",
+      tags: [{ id: "t1" }, { id: "t2" }],
+    };
+    const prisma = makePrismaMock({ source, candidates: [] });
+    await getRelatedBlogPosts(prisma as any, "src", 5);
+
+    const where = prisma.__findMany.mock.calls[0][0].where;
+    expect(where.id).toEqual({ not: "src" });
+    expect(where.status).toBe(BlogStatus.Published);
+    expect(where.publishedAt).toEqual({ not: null });
+    expect(where.OR).toEqual([
+      { tags: { some: { id: { in: ["t1", "t2"] } } } },
+      { categoryId: "cat-1" },
+    ]);
+    // candidate pool size is limit * 4 to give the scorer headroom
+    expect(prisma.__findMany.mock.calls[0][0].take).toBe(20);
+  });
+
+  it("omits the OR clause entirely when source has no tags and no category", async () => {
+    const source: SourceShape = { id: "src", categoryId: null, tags: [] };
+    const prisma = makePrismaMock({ source, candidates: [] });
+    await getRelatedBlogPosts(prisma as any, "src");
+    const where = prisma.__findMany.mock.calls[0][0].where;
+    expect(where.OR).toBeUndefined();
+  });
+
+  it("returns the trimmed RelatedBlogPost shape (no internal scoring fields)", async () => {
+    const source: SourceShape = {
+      id: "src",
+      categoryId: null,
+      tags: [{ id: "t1" }],
+    };
+    const candidates: CandidateShape[] = [
+      candidate({
+        id: "c1",
+        slug: "c1-slug",
+        title: "C1",
+        excerpt: "ex",
+        coverImage: "img.png",
+        readTime: 7,
+        publishedAt: new Date("2026-01-01"),
+        tags: [{ id: "t1" }],
+        categoryId: "cat-1",
+      }),
+    ];
+    const prisma = makePrismaMock({ source, candidates });
+    const out = await getRelatedBlogPosts(prisma as any, "src", 4);
+    expect(out[0]).toEqual({
+      id: "c1",
+      slug: "c1-slug",
+      title: "C1",
+      excerpt: "ex",
+      coverImage: "img.png",
+      readTime: 7,
+      publishedAt: new Date("2026-01-01"),
+    });
+    expect(Object.keys(out[0])).not.toContain("categoryId");
+    expect(Object.keys(out[0])).not.toContain("tags");
+  });
+});

package/src/utils/blog/blogCommentDbUtils.ts

@@ -0,0 +1,161 @@
+import { PrismaClient, BlogComment, CommentStatus, Prisma } from '@prisma/client';
+import { FRONT_END_USER_DATA_TO_SELECT, PublicUser } from '../../extendedSchemas.js';
+
+// Shape returned by every helper below. Mirrors INVITATION_DATA_TO_INCLUDE
+// pattern so consumers never have to `as`-cast.
+export const BLOG_COMMENT_INCLUDE = {
+  author: {
+    select: FRONT_END_USER_DATA_TO_SELECT,
+  },
+  replies: {
+    where: { status: CommentStatus.Published },
+    orderBy: { createdAt: 'asc' },
+    include: {
+      author: {
+        select: FRONT_END_USER_DATA_TO_SELECT,
+      },
+    },
+  },
+} satisfies Prisma.BlogCommentInclude;
+
+export interface BlogCommentWithAuthor extends BlogComment {
+  author: PublicUser;
+  replies?: (BlogComment & { author: PublicUser })[];
+}
+
+const MAX_COMMENT_LENGTH = 4000;
+const MIN_COMMENT_LENGTH = 1;
+
+export function validateCommentContent(content: string): { ok: true } | { ok: false; reason: string } {
+  const trimmed = content.trim();
+  if (trimmed.length < MIN_COMMENT_LENGTH) {
+    return { ok: false, reason: 'Comment cannot be empty.' };
+  }
+  if (trimmed.length > MAX_COMMENT_LENGTH) {
+    return { ok: false, reason: `Comment is too long (max ${MAX_COMMENT_LENGTH} characters).` };
+  }
+  return { ok: true };
+}
+
+// Public list: only Published comments + their Published replies.
+export async function getBlogCommentsForPost(
+  prisma: PrismaClient,
+  postId: string
+): Promise<BlogCommentWithAuthor[]> {
+  const comments = await prisma.blogComment.findMany({
+    where: {
+      postId,
+      parentId: null,
+      status: CommentStatus.Published,
+    },
+    include: BLOG_COMMENT_INCLUDE,
+    orderBy: { createdAt: 'desc' },
+  });
+  return comments;
+}
+
+// Admin list: any status, used by the moderation queue.
+export async function getBlogCommentsByStatus(
+  prisma: PrismaClient,
+  status: CommentStatus | CommentStatus[],
+  options: { limit?: number; offset?: number } = {}
+): Promise<BlogCommentWithAuthor[]> {
+  const { limit = 50, offset = 0 } = options;
+  const statusFilter = Array.isArray(status) ? { in: status } : status;
+  const comments = await prisma.blogComment.findMany({
+    where: { status: statusFilter },
+    include: BLOG_COMMENT_INCLUDE,
+    orderBy: { createdAt: 'desc' },
+    skip: offset,
+    take: limit,
+  });
+  return comments;
+}
+
+export async function getBlogCommentById(
+  prisma: PrismaClient,
+  id: string
+): Promise<BlogCommentWithAuthor | null> {
+  return prisma.blogComment.findUnique({
+    where: { id },
+    include: BLOG_COMMENT_INCLUDE,
+  });
+}
+
+// Caller (the API endpoint) is responsible for running AI moderation BEFORE
+// calling this and choosing the resulting `status` (Published vs Pending).
+// Keeping moderation in the API layer avoids dragging the OpenAI dependency
+// into bash-common.
+export async function createBlogComment(
+  prisma: PrismaClient,
+  data: {
+    postId: string;
+    authorId: string;
+    parentId?: string | null;
+    content: string;
+    status: CommentStatus;
+  }
+): Promise<BlogCommentWithAuthor> {
+  return prisma.blogComment.create({
+    data: {
+      postId: data.postId,
+      authorId: data.authorId,
+      parentId: data.parentId ?? null,
+      content: data.content.trim(),
+      status: data.status,
+    },
+    include: BLOG_COMMENT_INCLUDE,
+  });
+}
+
+export async function updateBlogCommentContent(
+  prisma: PrismaClient,
+  id: string,
+  data: { content: string; status?: CommentStatus }
+): Promise<BlogCommentWithAuthor> {
+  return prisma.blogComment.update({
+    where: { id },
+    data: {
+      content: data.content.trim(),
+      ...(data.status ? { status: data.status } : {}),
+    },
+    include: BLOG_COMMENT_INCLUDE,
+  });
+}
+
+export async function setBlogCommentStatus(
+  prisma: PrismaClient,
+  id: string,
+  status: CommentStatus
+): Promise<BlogCommentWithAuthor> {
+  return prisma.blogComment.update({
+    where: { id },
+    data: { status },
+    include: BLOG_COMMENT_INCLUDE,
+  });
+}
+
+// Soft delete: preserves the row (and any child replies) so threading stays
+// intact, but hides it from public reads. Use `setBlogCommentStatus` with
+// `Trash` rather than a hard delete unless an admin explicitly removes it.
+export async function softDeleteBlogComment(
+  prisma: PrismaClient,
+  id: string
+): Promise<BlogCommentWithAuthor> {
+  return setBlogCommentStatus(prisma, id, CommentStatus.Trash);
+}
+
+export async function countRecentCommentsByAuthor(
+  prisma: PrismaClient,
+  authorId: string,
+  windowMs: number
+): Promise<number> {
+  const since = new Date(Date.now() - windowMs);
+  return prisma.blogComment.count({
+    where: {
+      authorId,
+      createdAt: { gte: since },
+    },
+  });
+}
+