npm - @devchitchat/chat - Versions diffs - 0.0.0 - Mend

@devchitchat/chat 0.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (131) hide show

package/README.md +313 -0
package/index.js +148 -0
package/migrate/001-drop-channel-invites.js +3 -0
package/migrate/002-invite-initial-roles.js +5 -0
package/migrate/003-dm-channels.js +35 -0
package/migrate/004-notifications.js +15 -0
package/migrate/005-uploads.js +21 -0
package/migrate/006-mention-priority.js +3 -0
package/migrate/007-push-subscriptions.js +14 -0
package/migrate/008-messages-channel-seq-index.js +3 -0
package/migrate/009-message-reactions.js +15 -0
package/migrate/010-edit-messages.js +7 -0
package/package.json +51 -0
package/pages/_error.html +12 -0
package/pages/_layout.html +31 -0
package/pages/_layout.js +13 -0
package/pages/admin/_layout.html +52 -0
package/pages/admin/_layout.js +8 -0
package/pages/admin/bots/[userId].js +88 -0
package/pages/admin/bots/[userId].phtml +89 -0
package/pages/admin/bots/index.js +41 -0
package/pages/admin/bots/index.phtml +58 -0
package/pages/admin/index.js +8 -0
package/pages/admin/invites/index.js +72 -0
package/pages/admin/invites/index.phtml +88 -0
package/pages/admin/users/[userId].js +60 -0
package/pages/admin/users/[userId].phtml +57 -0
package/pages/admin/users/index.js +20 -0
package/pages/admin/users/index.phtml +37 -0
package/pages/api/uploads/index.js +66 -0
package/pages/api/user/settings.js +26 -0
package/pages/auth/signout.js +14 -0
package/pages/channels/[channelId].js +99 -0
package/pages/channels/[channelId].phtml +173 -0
package/pages/index.js +33 -0
package/pages/invite/[token].js +10 -0
package/pages/login/index.js +57 -0
package/pages/login/index.phtml +29 -0
package/pages/public/client/action-sheet.js +77 -0
package/pages/public/client/app.js +38 -0
package/pages/public/client/auth-tabs.js +13 -0
package/pages/public/client/emoji-data.js +197 -0
package/pages/public/client/islands/call.js +1770 -0
package/pages/public/client/islands/sidebar.js +1197 -0
package/pages/public/client/long-press.js +59 -0
package/pages/public/client/modal.js +50 -0
package/pages/public/client/router.js +87 -0
package/pages/public/client/rtc-peer-manager.js +344 -0
package/pages/public/client/settings-sync.js +76 -0
package/pages/public/client/shared/messages.js +147 -0
package/pages/public/client/swipe-nav.js +98 -0
package/pages/public/client/theme.js +27 -0
package/pages/public/client/ws.js +71 -0
package/pages/public/favicon.ico +0 -0
package/pages/public/favicon.png +0 -0
package/pages/public/icon.png +0 -0
package/pages/public/manifest.json +11 -0
package/pages/public/sw.js +38 -0
package/pages/public/themes/base.css +1786 -0
package/pages/public/themes/dark.css +22 -0
package/pages/public/themes/forest.css +22 -0
package/pages/public/themes/light.css +23 -0
package/pages/public/themes/ocean.css +22 -0
package/pages/public/themes/rose.css +22 -0
package/pages/registration/index.js +35 -0
package/pages/registration/index.phtml +38 -0
package/pages/uploads/[uploadId]/[filename].js +45 -0
package/src/adapters/InMemoryAuthRepository.js +74 -0
package/src/adapters/InMemoryChannelRepository.js +138 -0
package/src/adapters/InMemoryDeliveryRepository.js +52 -0
package/src/adapters/InMemoryFileStore.js +53 -0
package/src/adapters/InMemoryHubRepository.js +85 -0
package/src/adapters/InMemoryMessageRepository.js +35 -0
package/src/adapters/InMemoryReactionRepository.js +45 -0
package/src/adapters/InMemorySearchRepository.js +37 -0
package/src/adapters/InMemorySignalingRepository.js +35 -0
package/src/adapters/InMemoryUploadRepository.js +36 -0
package/src/adapters/InMemoryUserSettingsRepository.js +15 -0
package/src/adapters/LocalFileStore.js +40 -0
package/src/adapters/SqliteAuthRepository.js +184 -0
package/src/adapters/SqliteChannelRepository.js +149 -0
package/src/adapters/SqliteDeliveryRepository.js +53 -0
package/src/adapters/SqliteHubRepository.js +99 -0
package/src/adapters/SqliteMessageRepository.js +90 -0
package/src/adapters/SqlitePushRepository.js +39 -0
package/src/adapters/SqliteReactionRepository.js +50 -0
package/src/adapters/SqliteSearchRepository.js +42 -0
package/src/adapters/SqliteSignalingRepository.js +50 -0
package/src/adapters/SqliteUploadRepository.js +34 -0
package/src/adapters/SqliteUserSettingsRepository.js +23 -0
package/src/adminAuth.js +25 -0
package/src/config.js +11 -0
package/src/context.js +77 -0
package/src/core/dm.js +10 -0
package/src/core/mentions.js +27 -0
package/src/core/messages.js +21 -0
package/src/core/reactions.js +6 -0
package/src/core/roles.js +5 -0
package/src/core/uploads.js +107 -0
package/src/db/initDb.js +225 -0
package/src/db/openDb.js +18 -0
package/src/db/runMigrations.js +45 -0
package/src/db/transaction.js +11 -0
package/src/ports/IFileStore.js +34 -0
package/src/services/AuthService.js +208 -0
package/src/services/BotService.js +148 -0
package/src/services/ChannelService.js +176 -0
package/src/services/DeliveryService.js +28 -0
package/src/services/HubService.js +133 -0
package/src/services/MessageService.js +122 -0
package/src/services/NotificationService.js +45 -0
package/src/services/PresenceService.js +55 -0
package/src/services/ReactionService.js +57 -0
package/src/services/SearchService.js +21 -0
package/src/services/SignalingService.js +177 -0
package/src/services/UploadService.js +111 -0
package/src/services/UserSettingsService.js +30 -0
package/src/services/WebPushService.js +217 -0
package/src/util/crypto.js +21 -0
package/src/util/errors.js +14 -0
package/src/util/ids.js +3 -0
package/src/util/logger.js +21 -0
package/src/ws/ChatServer.js +478 -0
package/src/ws/handlers/authHandlers.js +152 -0
package/src/ws/handlers/channelHandlers.js +166 -0
package/src/ws/handlers/hubHandlers.js +82 -0
package/src/ws/handlers/messageHandlers.js +88 -0
package/src/ws/handlers/pushHandlers.js +25 -0
package/src/ws/handlers/reactionHandlers.js +27 -0
package/src/ws/handlers/rtcHandlers.js +126 -0
package/styles.css +22 -0

package/pages/_layout.html ADDED Viewed

@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="dark">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
+  <meta name="apple-mobile-web-app-capable" content="yes">
+  <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
+  <meta name="apple-mobile-web-app-title" content="devchitchat">
+  <link rel="apple-touch-icon" href="{{base}}/icon.png">
+  <link rel="manifest" href="{{base}}/manifest.json">
+  <title>{{pageTitle}} — devchitchat</title>
+  <link rel="stylesheet" href="{{base}}/themes/base.css">
+  <link rel="stylesheet" href="{{base}}/themes/dark.css" id="theme-stylesheet">
+  <script>window.__BASE_PATH__ = "{{base}}"</script>
+  <script type="importmap">
+  {
+    "imports": {
+      "@devchitchat/rdbljs": "{{base}}/vendor/rdbl.js"
+    }
+  }
+  </script>
+</head>
+<body>
+  <main class="app-shell">
+    {{content}}
+  </main>
+  <script type="module" src="{{base}}/client/theme.js"></script>
+  <script type="module" src="{{base}}/client/app.js"></script>
+</body>
+</html>

package/pages/_layout.js ADDED Viewed

@@ -0,0 +1,13 @@
+import { sessionFromRequest } from '../src/context.js'
+import { BASE_PATH } from '../src/config.js'
+export async function data(req) {
+  const session = sessionFromRequest(req)
+  const user = session?.user ?? null
+  return {
+    user,
+    isAdmin: user?.roles?.includes('admin') ?? false,
+    pageTitle: 'Chat',
+    base: BASE_PATH,
+  }
+}

package/pages/admin/_layout.html ADDED Viewed

@@ -0,0 +1,52 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="dark">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
+  <meta name="apple-mobile-web-app-capable" content="yes">
+  <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
+  <meta name="apple-mobile-web-app-title" content="devchitchat">
+  <link rel="apple-touch-icon" href="{{base}}/icon.png">
+  <link rel="manifest" href="{{base}}/manifest.json">
+  <title>Admin — devchitchat</title>
+  <link rel="stylesheet" href="{{base}}/themes/base.css">
+  <link rel="stylesheet" href="{{base}}/themes/dark.css" id="theme-stylesheet">
+  <script>window.__BASE_PATH__ = "{{base}}"</script>
+  <script type="importmap">
+  {
+    "imports": {
+      "@devchitchat/rdbljs": "{{base}}/vendor/rdbl.js"
+    }
+  }
+  </script>
+</head>
+<body>
+  <header class="admin-topbar">
+    <a href="{{base}}/" class="admin-topbar-brand">devchitchat</a>
+    {{#if user}}
+    <span class="admin-topbar-user">{{user.display_name}}</span>
+    {{/if}}
+    <div class="admin-topbar-actions">
+      <label for="theme-picker" class="sr-only">Theme</label>
+      <select id="theme-picker" aria-label="Choose theme" autocomplete="off">
+        <option value="dark">Dark</option>
+        <option value="light">Light</option>
+        <option value="ocean">Ocean</option>
+        <option value="forest">Forest</option>
+        <option value="rose">Rose</option>
+      </select>
+      {{#if user}}
+      <form method="POST" action="{{base}}/auth/signout">
+        <button type="submit" class="btn-ghost btn-sm">Sign out</button>
+      </form>
+      {{/if}}
+    </div>
+  </header>
+  <main>
+    {{content}}
+  </main>
+  <script type="module" src="{{base}}/client/theme.js"></script>
+</body>
+</html>

package/pages/admin/_layout.js ADDED Viewed

@@ -0,0 +1,8 @@
+import { sessionFromRequest } from '../../src/context.js'
+import { BASE_PATH } from '../../src/config.js'
+export async function data(req) {
+  const session = sessionFromRequest(req)
+  const user = session?.user ?? null
+  return { user, base: BASE_PATH }
+}

package/pages/admin/bots/[userId].js ADDED Viewed

@@ -0,0 +1,88 @@
+import { requireAdminSession } from '../../../src/adminAuth.js'
+import { botService, channelService } from '../../../src/context.js'
+import { randomToken } from '../../../src/util/crypto.js'
+import { p } from '../../../src/config.js'
+// In-memory flash store: flashId → plaintext token. Consumed once on GET.
+// Lost on restart, which is fine — the token was already shown or is gone.
+const tokenFlashes = new Map()
+function getBotUserId(req) {
+  return new URL(req.url).pathname.split('/').pop()
+}
+export function GET(req) {
+  const session = requireAdminSession(req)
+  if (session instanceof Response) return session
+  const botUserId = getBotUserId(req)
+  const bot = botService.getBot({ userId: botUserId, requestingUserId: session.user.user_id })
+  const url = new URL(req.url)
+  // Consume the flash token once — removes it from the map so it can't be replayed
+  const flashId = url.searchParams.get('flash_id') ?? null
+  const createdToken = flashId ? (tokenFlashes.get(flashId) ?? null) : null
+  if (flashId) tokenFlashes.delete(flashId)
+  const flash = url.searchParams.get('flash') ?? null
+  // All channels for channel assignment checkboxes
+  const allChannels = channelService.listChannels(session.user.user_id, session.user.roles)
+  const botChannelIds = new Set(bot.channels.map(c => c.channel_id))
+  return {
+    user: session.user,
+    pageTitle: `Admin — Bot: ${bot.handle}`,
+    bot,
+    createdToken,
+    flash,
+    tokens: bot.tokens.map(t => ({
+      ...t,
+      created_at_fmt: new Date(t.created_at).toLocaleString(),
+      expires_at_fmt: t.expires_at ? new Date(t.expires_at).toLocaleString() : 'Never',
+      last_used_at_fmt: t.last_used_at ? new Date(t.last_used_at).toLocaleString() : 'Never',
+      revoked: !!t.revoked_at,
+      expired: !t.revoked_at && t.expires_at != null && t.expires_at <= Date.now(),
+    })),
+    allChannels: allChannels.map(c => ({
+      ...c,
+      checked: botChannelIds.has(c.channel_id),
+    })),
+  }
+}
+export async function POST(req) {
+  const session = requireAdminSession(req)
+  if (session instanceof Response) return session
+  const botUserId = getBotUserId(req)
+  const form = await req.formData()
+  const action = form.get('action')
+  if (action === 'create_token') {
+    const label = form.get('label')?.trim() || null
+    const ttlDays = parseInt(form.get('ttl_days') || '', 10)
+    const ttlMs = Number.isFinite(ttlDays) && ttlDays > 0 ? ttlDays * 24 * 60 * 60 * 1000 : null
+    const result = botService.createToken({ userId: botUserId, label, ttlMs, requestingUserId: session.user.user_id })
+    // Store the token in the server-side flash map — never put it in the URL
+    const flashId = randomToken(8)
+    tokenFlashes.set(flashId, result.token)
+    return Response.redirect(
+      new URL(p(`/admin/bots/${botUserId}?flash_id=${encodeURIComponent(flashId)}`), req.url),
+      303
+    )
+  }
+  if (action === 'revoke_token') {
+    const tokenId = form.get('token_id')
+    botService.revokeToken({ tokenId, requestingUserId: session.user.user_id })
+    return Response.redirect(new URL(p(`/admin/bots/${botUserId}?flash=token_revoked`), req.url), 303)
+  }
+  if (action === 'set_channels') {
+    const channelIds = form.getAll('channel_ids')
+    botService.setBotChannels({ userId: botUserId, channelIds, requestingUserId: session.user.user_id })
+    return Response.redirect(new URL(p(`/admin/bots/${botUserId}?flash=channels_updated`), req.url), 303)
+  }
+  return new Response('Bad request', { status: 400 })
+}

package/pages/admin/bots/[userId].phtml ADDED Viewed

@@ -0,0 +1,89 @@
+<div class="admin-page">
+  <nav class="admin-nav">
+    <a href="{{base}}/admin/invites" class="admin-nav-link">Invites</a>
+    <a href="{{base}}/admin/users" class="admin-nav-link">Users</a>
+    <a href="{{base}}/admin/bots" class="admin-nav-link active">Bots</a>
+  </nav>
+  <h1>Bot: <code>{{bot.handle}}</code></h1>
+  <p class="admin-hint">{{bot.display_name}}</p>
+  {{#if flash}}
+  <div class="admin-notice admin-notice--success">Saved.</div>
+  {{/if}}
+  {{#if createdToken}}
+  <div class="admin-notice admin-notice--success">
+    <strong>Token created.</strong> Copy it now — it will not be shown again:<br>
+    <code class="token-display">{{createdToken}}</code>
+  </div>
+  {{/if}}
+  <section class="admin-section">
+    <h2>API tokens</h2>
+    <form method="POST" class="admin-form admin-form--inline">
+      <input type="hidden" name="action" value="create_token">
+      <input type="text" name="label" placeholder="Token label (optional)">
+      <select name="ttl_days">
+        <option value="">No expiry</option>
+        <option value="30">30 days</option>
+        <option value="90">90 days</option>
+        <option value="365">1 year</option>
+      </select>
+      <button type="submit" class="btn">Create token</button>
+    </form>
+    {{#if tokens}}
+    <table class="data-table">
+      <thead>
+        <tr>
+          <th>Label</th>
+          <th>Created</th>
+          <th>Expires</th>
+          <th>Last used</th>
+          <th>Status</th>
+          <th></th>
+        </tr>
+      </thead>
+      <tbody>
+      {{#each tokens}}
+        <tr>
+          <td>{{label}}</td>
+          <td>{{created_at_fmt}}</td>
+          <td>{{expires_at_fmt}}</td>
+          <td>{{last_used_at_fmt}}</td>
+          <td>{{#if revoked}}<span class="tag tag--warn">Revoked</span>{{/if}}{{#if expired}}<span class="tag tag--warn">Expired</span>{{/if}}</td>
+          <td>
+            {{#unless revoked}}
+            <form method="POST" class="inline">
+              <input type="hidden" name="action" value="revoke_token">
+              <input type="hidden" name="token_id" value="{{token_id}}">
+              <button type="submit" class="btn-ghost btn-danger">Revoke</button>
+            </form>
+            {{/unless}}
+          </td>
+        </tr>
+      {{/each}}
+      </tbody>
+    </table>
+    {{/if}}
+    {{#unless tokens}}
+    <p class="admin-empty">No tokens yet.</p>
+    {{/unless}}
+  </section>
+  <section class="admin-section">
+    <h2>Channel access</h2>
+    <form method="POST" class="admin-form">
+      <input type="hidden" name="action" value="set_channels">
+      {{#each allChannels}}
+      <label class="checkbox-label">
+        <input type="checkbox" name="channel_ids" value="{{channel_id}}" {{#if checked}}checked{{/if}}>
+        # {{name}}
+      </label>
+      {{/each}}
+      <button type="submit" class="btn">Save channel access</button>
+    </form>
+  </section>
+</div>

package/pages/admin/bots/index.js ADDED Viewed

@@ -0,0 +1,41 @@
+import { requireAdminSession } from '../../../src/adminAuth.js'
+import { botService } from '../../../src/context.js'
+import { p } from '../../../src/config.js'
+export function GET(req) {
+  const session = requireAdminSession(req)
+  if (session instanceof Response) return session
+  const bots = botService.listBots({ requestingUserId: session.user.user_id })
+  return {
+    user: session.user,
+    pageTitle: 'Admin — Bots',
+    bots: bots.map(b => ({
+      ...b,
+      created_at_fmt: new Date(b.created_at).toLocaleString(),
+    })),
+  }
+}
+export async function POST(req) {
+  const session = requireAdminSession(req)
+  if (session instanceof Response) return session
+  const form = await req.formData()
+  const handle = form.get('handle')?.trim()
+  const displayName = form.get('display_name')?.trim() || handle
+  const tokenLabel = form.get('token_label')?.trim() || null
+  const result = botService.createBot({
+    handle,
+    displayName,
+    tokenLabel,
+    requestingUserId: session.user.user_id,
+  })
+  return Response.redirect(
+    new URL(p(`/admin/bots/${result.userId}?created_token=${encodeURIComponent(result.token)}`), req.url),
+    303
+  )
+}

package/pages/admin/bots/index.phtml ADDED Viewed

@@ -0,0 +1,58 @@
+<div class="admin-page">
+  <nav class="admin-nav">
+    <a href="{{base}}/admin/invites" class="admin-nav-link">Invites</a>
+    <a href="{{base}}/admin/users" class="admin-nav-link">Users</a>
+    <a href="{{base}}/admin/bots" class="admin-nav-link active">Bots</a>
+  </nav>
+  <h1>Bots</h1>
+  <section class="admin-section">
+    <h2>Create bot</h2>
+    <form method="POST" action="{{base}}/admin/bots" class="admin-form">
+      <div class="form-row">
+        <label for="handle">Handle</label>
+        <input type="text" id="handle" name="handle" required placeholder="e.g. deploy-bot">
+      </div>
+      <div class="form-row">
+        <label for="display_name">Display name</label>
+        <input type="text" id="display_name" name="display_name" placeholder="e.g. Deploy Bot">
+      </div>
+      <div class="form-row">
+        <label for="token_label">Initial token label (optional)</label>
+        <input type="text" id="token_label" name="token_label" placeholder="e.g. production">
+      </div>
+      <button type="submit" class="btn">Create bot</button>
+    </form>
+  </section>
+  <section class="admin-section">
+    <h2>Existing bots</h2>
+    {{#if bots}}
+    <table class="data-table">
+      <thead>
+        <tr>
+          <th>Handle</th>
+          <th>Display name</th>
+          <th>Tokens</th>
+          <th>Created</th>
+          <th></th>
+        </tr>
+      </thead>
+      <tbody>
+      {{#each bots}}
+        <tr>
+          <td><code>{{handle}}</code></td>
+          <td>{{display_name}}</td>
+          <td>{{tokens.length}}</td>
+          <td>{{created_at_fmt}}</td>
+          <td><a href="{{base}}/admin/bots/{{user_id}}" class="btn-ghost">Manage</a></td>
+        </tr>
+      {{/each}}
+      </tbody>
+    </table>
+    {{else}}
+    <p class="admin-empty">No bots yet.</p>
+    {{/if}}
+  </section>
+</div>

package/pages/admin/index.js ADDED Viewed

@@ -0,0 +1,8 @@
+import { requireAdminSession } from '../../src/adminAuth.js'
+import { p } from '../../src/config.js'
+export function GET(req) {
+  const session = requireAdminSession(req)
+  if (session instanceof Response) return session
+  return Response.redirect(new URL(p('/admin/invites'), req.url), 302)
+}

package/pages/admin/invites/index.js ADDED Viewed

@@ -0,0 +1,72 @@
+import { requireAdminSession } from '../../../src/adminAuth.js'
+import { auth } from '../../../src/context.js'
+import { p } from '../../../src/config.js'
+export function GET(req) {
+  const session = requireAdminSession(req)
+  if (session instanceof Response) return session
+  const url = new URL(req.url)
+  const createdToken = url.searchParams.get('created') ?? null
+  const origin = url.origin
+  const invites = auth.listInvites({ requestingUserId: session.user.user_id })
+  const now = Date.now()
+  return {
+    user: session.user,
+    pageTitle: 'Admin — Invites',
+    createdToken,
+    createdLink: createdToken ? `${origin}${p('/registration')}?invite=${encodeURIComponent(createdToken)}` : null,
+    invites: invites.map(inv => ({
+      ...inv,
+      expired: inv.expires_at <= now,
+      exhausted: inv.uses >= inv.max_uses,
+      expires_at_fmt: new Date(inv.expires_at).toLocaleString(),
+      roles_label: (() => {
+        try {
+          const r = JSON.parse(inv.initial_roles_json ?? '["user"]')
+          return r.includes('guest') ? 'Guest' : 'User'
+        } catch { return 'User' }
+      })(),
+      is_guest: (() => {
+        try { return JSON.parse(inv.initial_roles_json ?? '["user"]').includes('guest') } catch { return false }
+      })(),
+    })),
+  }
+}
+export async function POST(req) {
+  const session = requireAdminSession(req)
+  if (session instanceof Response) return session
+  const form = await req.formData()
+  const action = form.get('action')
+  if (action === 'create') {
+    const ttlHours = Number(form.get('ttl_hours') ?? 24)
+    const maxUses = Number(form.get('max_uses') ?? 1)
+    const note = form.get('note')?.trim() || null
+    const roleValue = form.get('roles') ?? 'user'
+    const roles = roleValue === 'guest' ? ['guest'] : ['user']
+    const invite = auth.createInvite({
+      createdByUserId: session.user.user_id,
+      ttlMs: ttlHours * 60 * 60 * 1000,
+      maxUses,
+      note,
+      roles,
+    })
+    return Response.redirect(
+      new URL(p(`/admin/invites?created=${encodeURIComponent(invite.inviteToken)}`), req.url),
+      303
+    )
+  }
+  if (action === 'revoke') {
+    const inviteId = form.get('invite_id')
+    auth.revokeInvite({ inviteId, requestingUserId: session.user.user_id })
+    return Response.redirect(new URL(p('/admin/invites'), req.url), 303)
+  }
+  return new Response('Bad request', { status: 400 })
+}

package/pages/admin/invites/index.phtml ADDED Viewed

@@ -0,0 +1,88 @@
+<div class="admin-page">
+  <nav class="admin-nav">
+    <a href="{{base}}/admin/invites" class="admin-nav-link active">Invites</a>
+    <a href="{{base}}/admin/users" class="admin-nav-link">Users</a>
+    <a href="{{base}}/admin/bots" class="admin-nav-link">Bots</a>
+  </nav>
+  <h1>Invite tokens</h1>
+  {{#if createdToken}}
+  <div class="admin-notice admin-notice--success">
+    <strong>Invite created.</strong> Send this link — it will not be shown again:<br>
+    <a href="{{createdLink}}" class="invite-link">{{createdLink}}</a>
+    <p class="admin-hint">Or share just the token if you prefer:<br>
+    <code class="token-display">{{createdToken}}</code></p>
+  </div>
+  {{/if}}
+  <section class="admin-section">
+    <h2>Create invite</h2>
+    <form method="POST" action="{{base}}/admin/invites" class="admin-form">
+      <input type="hidden" name="action" value="create">
+      <div class="form-row">
+        <label for="ttl_hours">Expires in (hours)</label>
+        <input type="number" id="ttl_hours" name="ttl_hours" value="24" min="1" max="720">
+      </div>
+      <div class="form-row">
+        <label for="max_uses">Max uses</label>
+        <input type="number" id="max_uses" name="max_uses" value="1" min="1" max="100">
+      </div>
+      <div class="form-row">
+        <label for="note">Note (optional)</label>
+        <input type="text" id="note" name="note" placeholder="e.g. For Alice">
+      </div>
+      <div class="form-row">
+        <label for="roles">Account type</label>
+        <select id="roles" name="roles">
+          <option value="user">User — can see public channels</option>
+          <option value="guest">Guest — can only see channels they're added to</option>
+        </select>
+      </div>
+      <button type="submit" class="btn">Create invite</button>
+    </form>
+  </section>
+  <section class="admin-section">
+    <h2>Active invites</h2>
+    {{#if invites}}
+    <table class="data-table">
+      <thead>
+        <tr>
+          <th>Note</th>
+          <th>Created by</th>
+          <th>Account type</th>
+          <th>Expires</th>
+          <th>Uses</th>
+          <th>Status</th>
+          <th></th>
+        </tr>
+      </thead>
+      <tbody>
+      {{#each invites}}
+        <tr>
+          <td>{{note}}</td>
+          <td>{{created_by_handle}}</td>
+          <td>{{#if is_guest}}<span class="tag tag--muted">Guest</span>{{else}}User{{/if}}</td>
+          <td>{{expires_at_fmt}}</td>
+          <td>{{uses}} / {{max_uses}}</td>
+          <td>
+            {{#if expired}}<span class="tag tag--warn">Expired</span>{{/if}}
+            {{#if exhausted}}<span class="tag tag--warn">Exhausted</span>{{/if}}
+          </td>
+          <td>
+            <form method="POST" action="{{base}}/admin/invites" class="inline">
+              <input type="hidden" name="action" value="revoke">
+              <input type="hidden" name="invite_id" value="{{invite_id}}">
+              <button type="submit" class="btn-ghost btn-danger">Revoke</button>
+            </form>
+          </td>
+        </tr>
+      {{/each}}
+      </tbody>
+    </table>
+    {{else}}
+    <p class="admin-empty">No invites yet.</p>
+    {{/if}}
+  </section>
+</div>

package/pages/admin/users/[userId].js ADDED Viewed

@@ -0,0 +1,60 @@
+import { requireAdminSession } from '../../../src/adminAuth.js'
+import { auth } from '../../../src/context.js'
+import { p } from '../../../src/config.js'
+function getTargetUserId(req) {
+  return new URL(req.url).pathname.split('/').pop()
+}
+export function GET(req) {
+  const session = requireAdminSession(req)
+  if (session instanceof Response) return session
+  const targetUserId = getTargetUserId(req)
+  const target = auth.getUser(targetUserId)
+  if (!target) return new Response('User not found', { status: 404 })
+  const url = new URL(req.url)
+  const flash = url.searchParams.get('flash') ?? null
+  return {
+    user: session.user,
+    pageTitle: `Admin — Edit ${target.handle}`,
+    target,
+    targetRolesJson: JSON.stringify(target.roles),
+    isAdmin: target.roles.includes('admin'),
+    isUser: target.roles.includes('user'),
+    isGuest: target.roles.includes('guest'),
+    isBot: target.roles.includes('bot'),
+    flash,
+  }
+}
+export async function POST(req) {
+  const session = requireAdminSession(req)
+  if (session instanceof Response) return session
+  const targetUserId = getTargetUserId(req)
+  const form = await req.formData()
+  const action = form.get('action')
+  if (action === 'set_display_name') {
+    const displayName = form.get('display_name')
+    auth.adminUpdateDisplayName({ targetUserId, displayName, requestingUserId: session.user.user_id })
+    return Response.redirect(new URL(p(`/admin/users/${targetUserId}?flash=display_name_updated`), req.url), 303)
+  }
+  if (action === 'set_roles') {
+    const roles = form.getAll('roles')
+    auth.setUserRoles({ targetUserId, roles, requestingUserId: session.user.user_id })
+    return Response.redirect(new URL(p(`/admin/users/${targetUserId}?flash=roles_updated`), req.url), 303)
+  }
+  if (action === 'set_password') {
+    const newPassword = form.get('new_password')
+    await auth.adminSetPassword({ targetUserId, newPassword, requestingUserId: session.user.user_id })
+    return Response.redirect(new URL(p(`/admin/users/${targetUserId}?flash=password_updated`), req.url), 303)
+  }
+  return new Response('Bad request', { status: 400 })
+}