@bash-app/bash-common 30.230.0 → 30.232.0

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@bash-app/bash-common",
-  "version": "30.230.0",
+  "version": "30.232.0",
   "description": "Common data and scripts to use on the frontend and backend",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {
     "test": "jest --config jest.config.cjs",
+    "knip": "knip --config knip.config.ts",
     "build": "npm run generate && npm run tsc",
     "generate": "prisma generate",
     "db": "prisma generate && prisma db push",
@@ -48,6 +49,7 @@
     "@types/react": "^18.3.2",
     "@types/shelljs": "^0.10.0",
     "jest": "^29.7.0",
+    "knip": "^6.11.0",
     "npm": "^11.11.0",
     "shelljs": "^0.10.0",
     "stripe": "^20.1.2",

package/prisma/schema.prisma

@@ -2539,6 +2539,7 @@ model User {
   reportsReceived                UserReport[]                 @relation("ReportsReceived")
   reportsMade                    UserReport[]                 @relation("ReportsMade")
   reportsReviewed                UserReport[]                 @relation("ReportsReviewed")
+  reportEvidenceUploaded         UserReportEvidence[]         @relation("UserReportEvidenceUploader")
   userStats                      UserStats?
   userSubscription               UserSubscription?
   vendorBid                      VendorBid[]
@@ -4426,6 +4427,7 @@ model UserReport {
   reviewedAt  DateTime?
   reviewNotes String?
   demerits    Demerit[]
+  evidence    UserReportEvidence[]
   bashEvent   BashEvent?   @relation(fields: [bashEventId], references: [id])
   reported    User         @relation("ReportsReceived", fields: [reportedId], references: [id], onDelete: Cascade)
   reporter    User         @relation("ReportsMade", fields: [reporterId], references: [id], onDelete: Cascade)
@@ -4437,6 +4439,22 @@ model UserReport {
   @@index([status])
 }
 
+model UserReportEvidence {
+  id           String     @id @default(cuid())
+  reportId     String
+  url          String
+  s3Key        String
+  mimetype     String
+  sizeBytes    Int
+  uploadedById String
+  createdAt    DateTime   @default(now())
+  report       UserReport @relation(fields: [reportId], references: [id], onDelete: Cascade)
+  uploadedBy   User       @relation("UserReportEvidenceUploader", fields: [uploadedById], references: [id], onDelete: Cascade)
+
+  @@index([reportId])
+  @@index([uploadedById])
+}
+
 model Demerit {
   id           String      @id @default(cuid())
   userId       String
@@ -5485,6 +5503,7 @@ enum AudioVisualSupportSubType {
 
 enum PromotionAndMarketingSubType {
   Influencer
+  ContentCreator
   Promoter
   CelebrityAppearance
 }
@@ -7505,6 +7524,10 @@ enum AuditAction {
   USER_SUSPENDED
   USER_UNSUSPENDED
   USER_DELETED
+  USER_DEACTIVATED
+  USER_DEMERITED
+  USER_REPORTED
+  USER_REPORT_IGNORED
   USER_DATA_EXPORTED
   PROFILE_UPDATED
 

package/src/__tests__/userReportTypes.test.ts

@@ -0,0 +1,103 @@
+import {
+  ALL_USER_REPORT_REASON_CODES,
+  REPORT_REASON_FUNNEL,
+  USER_REPORT_DETAILS_MAX_LENGTH,
+  USER_REPORT_EVIDENCE_MAX_BYTES,
+  USER_REPORT_EVIDENCE_MAX_FILES,
+  getUserReportReasonLabel,
+  getUserReportReasonPath,
+  isUserReportReasonCode,
+} from "../userReportTypes.js";
+
+describe("userReportTypes", () => {
+  describe("REPORT_REASON_FUNNEL", () => {
+    it("contains the six top-level categories", () => {
+      const codes = REPORT_REASON_FUNNEL.map((c) => c.code);
+      expect(codes).toEqual([
+        "HARASSMENT",
+        "IMPERSONATION",
+        "SPAM",
+        "UNSAFE",
+        "INAPPROPRIATE",
+        "OTHER",
+      ]);
+    });
+
+    it("each category has at least one sub-reason", () => {
+      for (const cat of REPORT_REASON_FUNNEL) {
+        expect(cat.reasons.length).toBeGreaterThan(0);
+        for (const r of cat.reasons) {
+          expect(r.code).toBeTruthy();
+          expect(r.label).toBeTruthy();
+        }
+      }
+    });
+
+    it("sub-reason codes are unique across the funnel", () => {
+      const seen = new Set<string>();
+      for (const cat of REPORT_REASON_FUNNEL) {
+        for (const r of cat.reasons) {
+          expect(seen.has(r.code)).toBe(false);
+          seen.add(r.code);
+        }
+      }
+    });
+
+    it("ALL_USER_REPORT_REASON_CODES mirrors the funnel", () => {
+      const flat = REPORT_REASON_FUNNEL.flatMap((c) => c.reasons.map((r) => r.code));
+      expect([...ALL_USER_REPORT_REASON_CODES]).toEqual(flat);
+    });
+  });
+
+  describe("isUserReportReasonCode", () => {
+    it("accepts any code in the funnel", () => {
+      for (const code of ALL_USER_REPORT_REASON_CODES) {
+        expect(isUserReportReasonCode(code)).toBe(true);
+      }
+    });
+
+    it.each([
+      ["unknown_code"],
+      [""],
+      ["spam_promotion"],
+      ["HARASSMENT"],
+    ])("rejects unknown / wrong-shape value: %s", (val) => {
+      expect(isUserReportReasonCode(val)).toBe(false);
+    });
+
+    it("rejects non-string values", () => {
+      expect(isUserReportReasonCode(undefined)).toBe(false);
+      expect(isUserReportReasonCode(null)).toBe(false);
+      expect(isUserReportReasonCode(42)).toBe(false);
+      expect(isUserReportReasonCode({})).toBe(false);
+    });
+  });
+
+  describe("getUserReportReasonLabel / getUserReportReasonPath", () => {
+    it("returns the human label for a known code", () => {
+      expect(getUserReportReasonLabel("SPAM_SCAM")).toBe("Scam, fraud, or phishing");
+    });
+
+    it("returns the original code when unknown", () => {
+      expect(getUserReportReasonLabel("nope")).toBe("nope");
+    });
+
+    it("formats path as 'Category › Sub-reason'", () => {
+      expect(getUserReportReasonPath("HARASSMENT_BULLYING")).toBe(
+        "Harassment or bullying › Bullying or repeated targeting"
+      );
+    });
+
+    it("returns the original code for path lookup of unknown", () => {
+      expect(getUserReportReasonPath("missing")).toBe("missing");
+    });
+  });
+
+  describe("limits constants", () => {
+    it("are conservative enough for a friendly UI but not absurd", () => {
+      expect(USER_REPORT_EVIDENCE_MAX_FILES).toBe(5);
+      expect(USER_REPORT_EVIDENCE_MAX_BYTES).toBe(25 * 1024 * 1024);
+      expect(USER_REPORT_DETAILS_MAX_LENGTH).toBe(4000);
+    });
+  });
+});

package/src/bashFeedTypes.ts

@@ -27,7 +27,16 @@ export interface BashFeedPostBashSummary {
   allowed?: string | null;
   notAllowed?: string | null;
   averageRating?: number | null;
-  _count?: { tickets: number };
+  _count?: {
+    tickets: number;
+    interests?: number;
+    /** Tickets with `checkedInAt` set (see feed attach util). */
+    checkedIn?: number;
+    /** `PublicBashRsvp` rows with status Going. */
+    rsvpGoing?: number;
+    /** `PublicBashRsvp` rows with status Maybe. */
+    rsvpMaybe?: number;
+  };
   activeOffers?: Array<{
     id: string;
     offerType: string;
@@ -146,6 +155,9 @@ export interface BashFeedPostBashSummaryWire {
     tickets: number;
     /** IdeaInterest rows (Prisma relation name `interests`) */
     interests?: number;
+    checkedIn?: number;
+    rsvpGoing?: number;
+    rsvpMaybe?: number;
   };
 }
 

package/src/definitions.ts

@@ -297,6 +297,17 @@ export const STRIPE_IDENTITY_RETURN_URL = `/verify-id` as const;
 export const MY_SERVICES_URL = "/my-services" as const;
 export const BASH_DETAIL_URL = `/bash` as const;
 export const BASH_DETAIL_URL_PATTERN = `/bash/$bashEventIdSlug` as const;
+
+/**
+ * Bash event wizard indices for the "How" major step. Must match bash-app
+ * `bashEventWizardHowSubsteps.ts` / `BashEventWizard.tsx`.
+ */
+export const BASH_EVENT_WIZARD_HOW_MAJOR_STEP = 7;
+/** Payout / Stripe Connect substep within "How" (app `BASH_EVENT_WIZARD_HOW_SUBSTEP.PAYOUT`). */
+export const BASH_EVENT_WIZARD_HOW_SUBSTEP_PAYOUT = 8;
+
+export const BASH_EVENT_WIZARD_PATH_PREFIX = "/bash-event-wizard" as const;
+
 export const SERVICE_PAGE_URL = `/service-page` as const;
 export const LOGIN_URL = `/login` as const;
 export const TICKET_DETAILS = `/ticket-details` as const;
@@ -616,6 +627,8 @@ export interface ApiResult<T, P extends ErrorDataType = ErrorDataType> {
   /** e.g. safe path to navigate after password reset */
   returnTo?: string;
   error?: string;
+  /** Machine-readable error code for clients (e.g. duplicate ticket transfer). */
+  code?: string;
   errorType?: ApiErrorType;
   errorData?: P;
   rawResponse?: Response;

package/src/extendedSchemas.ts

@@ -68,6 +68,7 @@ import {
     TicketMetadata,
     TicketTier,
     TicketTransfer,
+    TicketTransferInvite,
     User,
     UserPreferences,
     UserStats,
@@ -866,6 +867,17 @@ export interface ServiceBookingExt extends ServiceBooking {
 
 export type ServiceBookingPublicExt = Omit<ServiceBookingExt, "checkout">;
 
+/**
+ * Aggregated booking activity attached to public/owner service list payloads.
+ * `confirmedBookings` is the "completed bookings" signal used to rank services
+ * by Popularity on the home page.
+ */
+export interface ServiceBookingStats {
+  totalBookings: number;
+  confirmedBookings: number;
+  lastCompletedBooking: Date | string | null;
+}
+
 export interface ServiceExt extends Service {
   owner?: PublicUser | null;
   creator?: PublicUser | null;
@@ -903,6 +915,9 @@ export interface ServiceExt extends Service {
   /** Some list endpoints historically used this key; prefer `bookings` */
   serviceBookings?: ServiceBookingExt[];
 
+  /** Attached by list endpoints (public/owner) for popularity sort and recency badges. */
+  bookingStats?: ServiceBookingStats;
+
   // bookedCheckouts: ServiceBookingCheckoutExt[]; //not necessary to include
 }
 
@@ -1223,6 +1238,14 @@ export interface TicketExt extends Ticket {
   checkout?: Checkout;
   transfers?: TicketTransfer[];
   metadata?: TicketMetadata[];
+  /**
+   * Included on authenticated GET /event/:id for the viewer's tickets when a
+   * peer transfer invite row exists (see transfer-withdraw / check-in guards).
+   */
+  transferInvite?: Pick<
+    TicketTransferInvite,
+    "status" | "expiresAt" | "token" | "toEmail" | "toUserId"
+  > | null;
 }
 
 export interface CheckoutExt extends Checkout {

package/src/index.ts

@@ -8,6 +8,7 @@ export * from "./partnerStoreTypes.js";
 export * from "./bashFeedTypes.js";
 export * from "./membershipDefinitions.js";
 export * from "./aiApproval.js";
+export * from "./userReportTypes.js";
 
 // Re-export ALL Prisma enums as values (usable as runtime constants, e.g. ServiceTypes.Entertainment)
 // Excludes enums already re-exported by definitions.ts and membershipDefinitions.ts:

package/src/userReportTypes.ts

@@ -0,0 +1,252 @@
+/**
+ * Shared types for the user-report flow (public profile → admin dashboard).
+ * Reporting is a real-stakes flow, so all user-facing copy here is plain and specific.
+ *
+ * The selected sub-reason code is stored verbatim in `UserReport.reason`.
+ * Free text is stored in `UserReport.details`.
+ */
+
+/** Top-level funnel category. */
+export type UserReportCategoryCode =
+  | "HARASSMENT"
+  | "IMPERSONATION"
+  | "SPAM"
+  | "UNSAFE"
+  | "INAPPROPRIATE"
+  | "OTHER";
+
+/** Specific sub-reason. Persisted as `UserReport.reason`. */
+export type UserReportReasonCode =
+  // HARASSMENT
+  | "HARASSMENT_BULLYING"
+  | "HARASSMENT_THREATS"
+  | "HARASSMENT_HATE_SPEECH"
+  | "HARASSMENT_TARGETED"
+  // IMPERSONATION
+  | "IMPERSONATION_ME"
+  | "IMPERSONATION_SOMEONE_ELSE"
+  | "IMPERSONATION_FAKE_BUSINESS"
+  // SPAM
+  | "SPAM_PROMOTION"
+  | "SPAM_SCAM"
+  | "SPAM_FAKE_ENGAGEMENT"
+  // UNSAFE
+  | "UNSAFE_VIOLENT"
+  | "UNSAFE_SELF_HARM"
+  | "UNSAFE_MINORS"
+  | "UNSAFE_ILLEGAL_GOODS"
+  // INAPPROPRIATE
+  | "INAPPROPRIATE_NUDITY_SEXUAL"
+  | "INAPPROPRIATE_GRAPHIC_VIOLENCE"
+  | "INAPPROPRIATE_OFFENSIVE"
+  // OTHER
+  | "OTHER";
+
+export interface UserReportReasonOption {
+  code: UserReportReasonCode;
+  label: string;
+}
+
+export interface UserReportCategoryOption {
+  code: UserReportCategoryCode;
+  label: string;
+  description: string;
+  reasons: UserReportReasonOption[];
+}
+
+/**
+ * Funnel definition shared between the report modal (UI) and the API
+ * (validation that the chosen `reason` is a known code).
+ */
+export const REPORT_REASON_FUNNEL: readonly UserReportCategoryOption[] = [
+  {
+    code: "HARASSMENT",
+    label: "Harassment or bullying",
+    description: "Behavior that targets, intimidates, or threatens someone.",
+    reasons: [
+      { code: "HARASSMENT_BULLYING", label: "Bullying or repeated targeting" },
+      { code: "HARASSMENT_THREATS", label: "Threats of violence or harm" },
+      { code: "HARASSMENT_HATE_SPEECH", label: "Hate speech or discrimination" },
+      { code: "HARASSMENT_TARGETED", label: "Targeting me or someone I know" },
+    ],
+  },
+  {
+    code: "IMPERSONATION",
+    label: "Impersonation",
+    description: "Pretending to be a person or business they aren't.",
+    reasons: [
+      { code: "IMPERSONATION_ME", label: "Pretending to be me" },
+      { code: "IMPERSONATION_SOMEONE_ELSE", label: "Pretending to be someone else" },
+      { code: "IMPERSONATION_FAKE_BUSINESS", label: "Pretending to be a business or venue" },
+    ],
+  },
+  {
+    code: "SPAM",
+    label: "Spam or scam",
+    description: "Unsolicited promotion, scams, or fake engagement.",
+    reasons: [
+      { code: "SPAM_PROMOTION", label: "Unsolicited promotion" },
+      { code: "SPAM_SCAM", label: "Scam, fraud, or phishing" },
+      { code: "SPAM_FAKE_ENGAGEMENT", label: "Fake followers, ratings, or reviews" },
+    ],
+  },
+  {
+    code: "UNSAFE",
+    label: "Unsafe or threatening behavior",
+    description: "Activity that puts people at risk.",
+    reasons: [
+      { code: "UNSAFE_VIOLENT", label: "Violent behavior" },
+      { code: "UNSAFE_SELF_HARM", label: "Self-harm or suicide" },
+      { code: "UNSAFE_MINORS", label: "Endangering a minor" },
+      { code: "UNSAFE_ILLEGAL_GOODS", label: "Illegal goods or services" },
+    ],
+  },
+  {
+    code: "INAPPROPRIATE",
+    label: "Inappropriate content",
+    description: "Content that doesn't belong on Bash.",
+    reasons: [
+      { code: "INAPPROPRIATE_NUDITY_SEXUAL", label: "Nudity or sexual content" },
+      { code: "INAPPROPRIATE_GRAPHIC_VIOLENCE", label: "Graphic violence" },
+      { code: "INAPPROPRIATE_OFFENSIVE", label: "Offensive or disturbing content" },
+    ],
+  },
+  {
+    code: "OTHER",
+    label: "Something else",
+    description: "Tell us in your own words.",
+    reasons: [{ code: "OTHER", label: "Other (describe below)" }],
+  },
+] as const;
+
+/** All valid reason codes (built from the funnel — no drift). */
+export const ALL_USER_REPORT_REASON_CODES: readonly UserReportReasonCode[] =
+  REPORT_REASON_FUNNEL.flatMap((c) => c.reasons.map((r) => r.code));
+
+export const isUserReportReasonCode = (
+  value: unknown
+): value is UserReportReasonCode =>
+  typeof value === "string" &&
+  (ALL_USER_REPORT_REASON_CODES as readonly string[]).includes(value);
+
+/** Look up the human-readable label for a reason code. */
+export function getUserReportReasonLabel(code: string): string {
+  for (const cat of REPORT_REASON_FUNNEL) {
+    const match = cat.reasons.find((r) => r.code === code);
+    if (match) return match.label;
+  }
+  return code;
+}
+
+/** Look up "Category › Reason" path for a stored reason code. */
+export function getUserReportReasonPath(code: string): string {
+  for (const cat of REPORT_REASON_FUNNEL) {
+    const match = cat.reasons.find((r) => r.code === code);
+    if (match) return `${cat.label} › ${match.label}`;
+  }
+  return code;
+}
+
+/** Constants used by the evidence upload route. */
+export const USER_REPORT_EVIDENCE_MAX_FILES = 5;
+export const USER_REPORT_EVIDENCE_MAX_BYTES = 25 * 1024 * 1024;
+
+/** Max free-text length for `UserReport.details`. */
+export const USER_REPORT_DETAILS_MAX_LENGTH = 4000;
+
+// ─── DTOs ────────────────────────────────────────────────────────────────────
+
+export interface CreateUserReportRequest {
+  reportedId: string;
+  reason: UserReportReasonCode;
+  details?: string;
+  bashEventId?: string;
+}
+
+export interface UserReportEvidenceDto {
+  id: string;
+  url: string;
+  mimetype: string;
+  sizeBytes: number;
+  createdAt: string;
+}
+
+interface UserReportUserSummary {
+  id: string;
+  email: string | null;
+  username: string | null;
+  givenName: string | null;
+  familyName: string | null;
+  image: string | null;
+  uploadedImage: string | null;
+}
+
+export interface UserReportListItem {
+  id: string;
+  reporterId: string;
+  reportedId: string;
+  reason: UserReportReasonCode | string;
+  details: string;
+  status: string;
+  createdAt: string;
+  reviewerId: string | null;
+  reviewedAt: string | null;
+  reviewNotes: string | null;
+  evidenceCount: number;
+  reporter: UserReportUserSummary;
+  reported: UserReportUserSummary;
+}
+
+export interface UserReportDetail extends Omit<UserReportListItem, "evidenceCount"> {
+  evidence: UserReportEvidenceDto[];
+  /** Other pending reports against the same reported user. */
+  otherPendingReportsAgainstReported: number;
+  /** Total active demerits already on the reported user. */
+  reportedActiveDemerits: number;
+}
+
+/** Action verbs for the moderation dashboard (PATCH /reports/:id). */
+export type ReviewUserReportAction =
+  | "ignore"
+  | "suspend"
+  | "demerit"
+  | "deactivate"
+  | "delete";
+
+interface ReviewIgnore {
+  action: "ignore";
+  notes?: string;
+}
+interface ReviewSuspend {
+  action: "suspend";
+  reason: string;
+  /** ISO date; if omitted the user is suspended indefinitely. */
+  until?: string;
+  notes?: string;
+}
+interface ReviewDemerit {
+  action: "demerit";
+  reason: string;
+  /** Defaults to 1 server-side. */
+  points?: number;
+  notes?: string;
+}
+interface ReviewDeactivate {
+  action: "deactivate";
+  reason: string;
+  notes?: string;
+}
+interface ReviewDelete {
+  action: "delete";
+  reason: string;
+  /** Reviewer must type the reported user's username/email to confirm. */
+  confirmation: string;
+  notes?: string;
+}
+
+export type ReviewUserReportRequest =
+  | ReviewIgnore
+  | ReviewSuspend
+  | ReviewDemerit
+  | ReviewDeactivate
+  | ReviewDelete;

package/src/utils/__tests__/getBackendHost.test.ts

@@ -6,7 +6,7 @@
  * doesn't accidentally re-introduce the same class of bug we just fixed in
  * getFrontendHost (server-only env vars leaking into the browser code path).
  */
-import { getBackendHost } from "../urlUtils.js";
+import { getBackendHost, getFrontendHost } from "../urlUtils.js";
 
 type WindowLocationStub = {
   protocol: string;
@@ -126,3 +126,30 @@ describe("getBackendHost — Capacitor native (iOS / Android)", () => {
     expect(result).toBe(process.env.REACT_APP_API ?? "http://localhost:3500");
   });
 });
+
+describe("getFrontendHost — Capacitor native (iOS / Android)", () => {
+  it("uses the public web host instead of the WebView localhost origin", () => {
+    setWindow(
+      {
+        protocol: "capacitor:",
+        hostname: "localhost",
+        host: "localhost",
+        port: "",
+      },
+      { isNativePlatform: () => true }
+    );
+
+    expect(getFrontendHost()).toBe("https://bash.community");
+  });
+
+  it("keeps regular local dev behavior for browser localhost", () => {
+    setWindow({
+      protocol: "http:",
+      hostname: "localhost",
+      host: "localhost:3000",
+      port: "3000",
+    });
+
+    expect(getFrontendHost()).toBe("http://localhost:3000");
+  });
+});

package/src/utils/__tests__/getFrontendHost.native.test.ts

@@ -0,0 +1,75 @@
+type WindowLocationStub = {
+  protocol: string;
+  hostname: string;
+  host: string;
+  port: string;
+};
+
+type CapacitorStub = { isNativePlatform?: () => boolean };
+
+const ORIGINAL_WINDOW = (globalThis as { window?: unknown }).window;
+const ORIGINAL_FRONTEND_URL = process.env.REACT_APP_FRONTEND_URL;
+
+function setWindow(loc: WindowLocationStub, capacitor?: CapacitorStub): void {
+  (
+    globalThis as unknown as {
+      window: { location: WindowLocationStub; Capacitor?: CapacitorStub };
+    }
+  ).window = {
+    location: loc,
+    ...(capacitor ? { Capacitor: capacitor } : {}),
+  };
+}
+
+function clearWindow(): void {
+  if (ORIGINAL_WINDOW === undefined) {
+    delete (globalThis as { window?: unknown }).window;
+  } else {
+    (globalThis as { window?: unknown }).window = ORIGINAL_WINDOW;
+  }
+}
+
+afterEach(() => {
+  clearWindow();
+  jest.resetModules();
+  if (ORIGINAL_FRONTEND_URL === undefined) {
+    delete process.env.REACT_APP_FRONTEND_URL;
+  } else {
+    process.env.REACT_APP_FRONTEND_URL = ORIGINAL_FRONTEND_URL;
+  }
+});
+
+describe("getFrontendHost — native public URL contract", () => {
+  it("returns bash.community for a Capacitor localhost WebView", async () => {
+    setWindow(
+      {
+        protocol: "capacitor:",
+        hostname: "localhost",
+        host: "localhost",
+        port: "",
+      },
+      { isNativePlatform: () => true }
+    );
+
+    const { getFrontendHost } = await import("../urlUtils.js");
+
+    expect(getFrontendHost()).toBe("https://bash.community");
+  });
+
+  it("honors REACT_APP_FRONTEND_URL for native QA builds", async () => {
+    process.env.REACT_APP_FRONTEND_URL = "https://qa.bash.community";
+    setWindow(
+      {
+        protocol: "capacitor:",
+        hostname: "localhost",
+        host: "localhost",
+        port: "",
+      },
+      { isNativePlatform: () => true }
+    );
+
+    const { getFrontendHost } = await import("../urlUtils.js");
+
+    expect(getFrontendHost()).toBe("https://qa.bash.community");
+  });
+});