@devchitchat/chat 4.0.0 → 4.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devchitchat/chat",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "A small chat app. p2p video and screenshare.",
   "scripts": {
     "dev": "bun --watch index.js",

package/pages/admin/bots/[userId].js

@@ -1,5 +1,5 @@
 import { requireAdminSession } from '../../../src/adminAuth.js'
-import { botService, channelService } from '../../../src/context.js'
+import { botService, channelService, hubService } from '../../../src/context.js'
 import { randomToken } from '../../../src/util/crypto.js'
 import { p } from '../../../src/config.js'
 
@@ -25,10 +25,34 @@ export function GET(req) {
   if (flashId) tokenFlashes.delete(flashId)
   const flash = url.searchParams.get('flash') ?? null
 
-  // All channels for channel assignment checkboxes
   const allChannels = channelService.listChannels(session.user.user_id, session.user.roles)
+  const allHubs     = hubService.listHubs(session.user.user_id, session.user.roles)
   const botChannelIds = new Set(bot.channels.map(c => c.channel_id))
 
+  // Group channels by hub, preserving hub order; collect channels with no hub separately
+  const hubMap = new Map(allHubs.map(h => [h.hub_id, { ...h, channels: [] }]))
+  const noHubChannels = []
+  for (const ch of allChannels) {
+    const entry = { ...ch, checked: botChannelIds.has(ch.channel_id) }
+    if (ch.hub_id && hubMap.has(ch.hub_id)) {
+      hubMap.get(ch.hub_id).channels.push(entry)
+    } else {
+      noHubChannels.push(entry)
+    }
+  }
+
+  // Compute hub-level checked/indeterminate state for UI rendering
+  const hubGroups = [...hubMap.values()]
+    .filter(h => h.channels.length > 0)
+    .map(h => {
+      const checkedCount = h.channels.filter(c => c.checked).length
+      return {
+        ...h,
+        hubChecked:       checkedCount === h.channels.length,
+        hubIndeterminate: checkedCount > 0 && checkedCount < h.channels.length,
+      }
+    })
+
   return {
     user: session.user,
     pageTitle: `Admin — Bot: ${bot.handle}`,
@@ -37,16 +61,14 @@ export function GET(req) {
     flash,
     tokens: bot.tokens.map(t => ({
       ...t,
-      created_at_fmt: new Date(t.created_at).toLocaleString(),
-      expires_at_fmt: t.expires_at ? new Date(t.expires_at).toLocaleString() : 'Never',
+      created_at_fmt:   new Date(t.created_at).toLocaleString(),
+      expires_at_fmt:   t.expires_at ? new Date(t.expires_at).toLocaleString() : 'Never',
       last_used_at_fmt: t.last_used_at ? new Date(t.last_used_at).toLocaleString() : 'Never',
-      revoked: !!t.revoked_at,
-      expired: !t.revoked_at && t.expires_at != null && t.expires_at <= Date.now(),
-    })),
-    allChannels: allChannels.map(c => ({
-      ...c,
-      checked: botChannelIds.has(c.channel_id),
+      revoked:  !!t.revoked_at,
+      expired:  !t.revoked_at && t.expires_at != null && t.expires_at <= Date.now(),
     })),
+    hubGroups,
+    noHubChannels,
   }
 }
 
@@ -66,22 +88,19 @@ export async function POST(req) {
     // Store the token in the server-side flash map — never put it in the URL
     const flashId = randomToken(8)
     tokenFlashes.set(flashId, result.token)
-    return Response.redirect(
-      new URL(p(`/admin/bots/${botUserId}?flash_id=${encodeURIComponent(flashId)}`), req.url),
-      303
-    )
+    return Response.redirect(p(`/admin/bots/${botUserId}?flash_id=${encodeURIComponent(flashId)}`), 303)
   }
 
   if (action === 'revoke_token') {
     const tokenId = form.get('token_id')
     botService.revokeToken({ tokenId, requestingUserId: session.user.user_id })
-    return Response.redirect(new URL(p(`/admin/bots/${botUserId}?flash=token_revoked`), req.url), 303)
+    return Response.redirect(p(`/admin/bots/${botUserId}?flash=token_revoked`), 303)
   }
 
   if (action === 'set_channels') {
     const channelIds = form.getAll('channel_ids')
     botService.setBotChannels({ userId: botUserId, channelIds, requestingUserId: session.user.user_id })
-    return Response.redirect(new URL(p(`/admin/bots/${botUserId}?flash=channels_updated`), req.url), 303)
+    return Response.redirect(p(`/admin/bots/${botUserId}?flash=channels_updated`), 303)
   }
 
   return new Response('Bad request', { status: 400 })

package/pages/admin/bots/[userId].phtml

@@ -75,15 +75,88 @@
 
   <section class="admin-section">
     <h2>Channel access</h2>
-    <form method="POST" class="admin-form">
+    <form method="POST" class="admin-form" id="channel-access-form">
       <input type="hidden" name="action" value="set_channels">
-      {{#each allChannels}}
-      <label class="checkbox-label">
-        <input type="checkbox" name="channel_ids" value="{{channel_id}}" {{#if checked}}checked{{/if}}>
-        # {{name}}
-      </label>
+
+      {{#each hubGroups}}
+      <details class="hub-group" {{#if hubChecked}}open{{/if}}{{#if hubIndeterminate}}open{{/if}}>
+        <summary class="hub-group__summary">
+          <input type="checkbox"
+            class="hub-checkbox"
+            data-hub="{{hub_id}}"
+            {{#if hubChecked}}checked{{/if}}
+            {{#if hubIndeterminate}}data-indeterminate="true"{{/if}}>
+          <span class="hub-group__name">{{name}}</span>
+          <span class="hub-group__badge">{{visibility}}</span>
+        </summary>
+        <div class="hub-group__channels">
+          {{#each channels}}
+          <label class="checkbox-label checkbox-label--indented">
+            <input type="checkbox"
+              class="channel-checkbox"
+              name="channel_ids"
+              value="{{channel_id}}"
+              data-hub="{{hub_id}}"
+              {{#if checked}}checked{{/if}}>
+            # {{name}}
+          </label>
+          {{/each}}
+        </div>
+      </details>
       {{/each}}
+
+      {{#if noHubChannels}}
+      <details class="hub-group" open>
+        <summary class="hub-group__summary">
+          <span class="hub-group__name">No hub</span>
+        </summary>
+        <div class="hub-group__channels">
+          {{#each noHubChannels}}
+          <label class="checkbox-label checkbox-label--indented">
+            <input type="checkbox"
+              class="channel-checkbox"
+              name="channel_ids"
+              value="{{channel_id}}"
+              {{#if checked}}checked{{/if}}>
+            # {{name}}
+          </label>
+          {{/each}}
+        </div>
+      </details>
+      {{/if}}
+
       <button type="submit" class="btn">Save channel access</button>
     </form>
   </section>
+
+  <script>
+    // Set indeterminate state (can't be done in HTML, only via JS property)
+    document.querySelectorAll('.hub-checkbox[data-indeterminate="true"]').forEach(cb => {
+      cb.indeterminate = true
+    })
+
+    // Hub checkbox toggles all its channel checkboxes
+    document.querySelectorAll('.hub-checkbox').forEach(hubCb => {
+      hubCb.addEventListener('change', () => {
+        const hubId = hubCb.dataset.hub
+        document.querySelectorAll(`.channel-checkbox[data-hub="${hubId}"]`).forEach(ch => {
+          ch.checked = hubCb.checked
+        })
+        hubCb.indeterminate = false
+      })
+    })
+
+    // Channel checkbox updates its hub checkbox state
+    document.querySelectorAll('.channel-checkbox[data-hub]').forEach(chanCb => {
+      chanCb.addEventListener('change', () => {
+        const hubId = chanCb.dataset.hub
+        const hubCb = document.querySelector(`.hub-checkbox[data-hub="${hubId}"]`)
+        if (!hubCb) return
+        const siblings = [...document.querySelectorAll(`.channel-checkbox[data-hub="${hubId}"]`)]
+        const checkedCount = siblings.filter(c => c.checked).length
+        hubCb.checked = checkedCount === siblings.length
+        hubCb.indeterminate = checkedCount > 0 && checkedCount < siblings.length
+      })
+    })
+  </script>
 </div>

package/pages/admin/bots/index.js

@@ -34,8 +34,5 @@ export async function POST(req) {
     requestingUserId: session.user.user_id,
   })
 
-  return Response.redirect(
-    new URL(p(`/admin/bots/${result.userId}?created_token=${encodeURIComponent(result.token)}`), req.url),
-    303
-  )
+  return Response.redirect(p(`/admin/bots/${result.userId}?created_token=${encodeURIComponent(result.token)}`), 303)
 }

package/pages/admin/index.js

@@ -4,5 +4,5 @@ import { p } from '../../src/config.js'
 export function GET(req) {
   const session = requireAdminSession(req)
   if (session instanceof Response) return session
-  return Response.redirect(new URL(p('/admin/invites'), req.url), 302)
+  return Response.redirect(p('/admin/invites'), 302)
 }

package/pages/admin/invites/index.js

@@ -56,16 +56,13 @@ export async function POST(req) {
       note,
       roles,
     })
-    return Response.redirect(
-      new URL(p(`/admin/invites?created=${encodeURIComponent(invite.inviteToken)}`), req.url),
-      303
-    )
+    return Response.redirect(p(`/admin/invites?created=${encodeURIComponent(invite.inviteToken)}`), 303)
   }
 
   if (action === 'revoke') {
     const inviteId = form.get('invite_id')
     auth.revokeInvite({ inviteId, requestingUserId: session.user.user_id })
-    return Response.redirect(new URL(p('/admin/invites'), req.url), 303)
+    return Response.redirect(p('/admin/invites'), 303)
   }
 
   return new Response('Bad request', { status: 400 })

package/pages/admin/users/[userId].js

@@ -41,19 +41,19 @@ export async function POST(req) {
   if (action === 'set_display_name') {
     const displayName = form.get('display_name')
     auth.adminUpdateDisplayName({ targetUserId, displayName, requestingUserId: session.user.user_id })
-    return Response.redirect(new URL(p(`/admin/users/${targetUserId}?flash=display_name_updated`), req.url), 303)
+    return Response.redirect(p(`/admin/users/${targetUserId}?flash=display_name_updated`), 303)
   }
 
   if (action === 'set_roles') {
     const roles = form.getAll('roles')
     auth.setUserRoles({ targetUserId, roles, requestingUserId: session.user.user_id })
-    return Response.redirect(new URL(p(`/admin/users/${targetUserId}?flash=roles_updated`), req.url), 303)
+    return Response.redirect(p(`/admin/users/${targetUserId}?flash=roles_updated`), 303)
   }
 
   if (action === 'set_password') {
     const newPassword = form.get('new_password')
     await auth.adminSetPassword({ targetUserId, newPassword, requestingUserId: session.user.user_id })
-    return Response.redirect(new URL(p(`/admin/users/${targetUserId}?flash=password_updated`), req.url), 303)
+    return Response.redirect(p(`/admin/users/${targetUserId}?flash=password_updated`), 303)
   }
 
   return new Response('Bad request', { status: 400 })

package/pages/channels/[channelId].js

@@ -14,7 +14,7 @@ function sanitizeForFrontEnd(html) {
 
 export async function GET(req) {
   const session = sessionFromRequest(req)
-  if (!session) return Response.redirect(new URL(p('/login'), req.url), 302)
+  if (!session) return Response.redirect(p('/login'), 302)
 
   const url = new URL(req.url)
   const channelId = url.pathname.split('/').pop()

package/pages/index.js

@@ -4,7 +4,7 @@ import { p } from '../src/config.js'
 export async function GET(req) {
   const session = sessionFromRequest(req)
   if (!session) {
-    return Response.redirect(new URL(p('/login'), req.url), 302)
+    return Response.redirect(p('/login'), 302)
   }
 
   const user = session.user
@@ -15,19 +15,19 @@ export async function GET(req) {
   const { settings } = userSettingsService.getSettings(user.user_id)
   if (settings.last_channel_id) {
     if (channelService.canAccessChannel(settings.last_channel_id, user.user_id, user.roles)) {
-      return Response.redirect(new URL(p(`/channels/${settings.last_channel_id}`), req.url), 302)
+      return Response.redirect(p(`/channels/${settings.last_channel_id}`), 302)
     }
     userSettingsService.putSettings(user.user_id, { last_channel_id: null }, Date.now())
   }
 
   const channels = channelService.listChannels(user.user_id, user.roles)
   if (channels.length > 0) {
-    return Response.redirect(new URL(p(`/channels/${channels[0].channel_id}`), req.url), 302)
+    return Response.redirect(p(`/channels/${channels[0].channel_id}`), 302)
   }
 
   // No channels yet — bootstrap defaults and redirect
   const hub = hubService.ensureDefaultHub(user.user_id)
   const channel = channelService.ensureDefaultChannel(hub.hub_id, user.user_id)
   channelService.joinChannel({ channelId: channel.channel_id, userId: user.user_id, userRoles: user.roles })
-  return Response.redirect(new URL(p(`/channels/${channel.channel_id}`), req.url), 302)
+  return Response.redirect(p(`/channels/${channel.channel_id}`), 302)
 }

package/pages/invite/[token].js

@@ -6,5 +6,5 @@ import { p } from '../../src/config.js'
 export async function GET(req) {
   const url = new URL(req.url)
   const token = url.pathname.split('/').pop()
-  return Response.redirect(new URL(p(`/login?invite=${encodeURIComponent(token)}`), req.url), 302)
+  return Response.redirect(p(`/login?invite=${encodeURIComponent(token)}`), 302)
 }

package/pages/login/index.js

@@ -3,7 +3,7 @@ import { p } from '../../src/config.js'
 
 export async function GET(req) {
   const session = sessionFromRequest(req)
-  if (session) return Response.redirect(new URL(p('/'), req.url), 302)
+  if (session) return Response.redirect(p('/'), 302)
 
   const url = new URL(req.url)
   const inviteToken = url.searchParams.get('invite') ?? ''

package/pages/public/themes/base.css

@@ -1484,6 +1484,64 @@ body:has(.admin-topbar) main {
   cursor: pointer;
 }
 
+.checkbox-label--indented {
+  padding-left: 24px;
+}
+
+.hub-group {
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  margin-bottom: 8px;
+  overflow: hidden;
+}
+
+.hub-group__summary {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 8px 12px;
+  background: var(--bg-secondary);
+  cursor: pointer;
+  font-size: 14px;
+  font-weight: 500;
+  list-style: none;
+  user-select: none;
+}
+
+.hub-group__summary::-webkit-details-marker { display: none; }
+
+.hub-group__summary::before {
+  content: '▶';
+  font-size: 10px;
+  color: var(--text-muted);
+  transition: transform 0.15s;
+  flex-shrink: 0;
+}
+
+details.hub-group[open] > .hub-group__summary::before {
+  transform: rotate(90deg);
+}
+
+.hub-group__name {
+  flex: 1;
+}
+
+.hub-group__badge {
+  font-size: 11px;
+  font-weight: normal;
+  color: var(--text-muted);
+  background: var(--bg-input);
+  padding: 2px 6px;
+  border-radius: 10px;
+}
+
+.hub-group__channels {
+  padding: 8px 12px;
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+
 .token-display {
   display: inline-block;
   margin-top: 8px;

package/pages/registration/index.js

@@ -3,7 +3,7 @@ import { p } from '../../src/config.js'
 
 export async function GET(req) {
   const session = sessionFromRequest(req)
-  if (session) return Response.redirect(new URL(p('/'), req.url), 302)
+  if (session) return Response.redirect(p('/'), 302)
 
   const url = new URL(req.url)
   const inviteToken = url.searchParams.get('invite') ?? ''

package/src/adapters/SqliteChannelRepository.js

@@ -49,6 +49,18 @@ export class SqliteChannelRepository {
     ).all()
   }
 
+  listMemberships({ userId }) {
+    return this.db.prepare(
+      `SELECT c.channel_id, c.hub_id, c.name, c.kind, c.visibility, c.topic, c.sort_order, h.name AS hub_name
+       FROM channels c
+       JOIN hubs h ON c.hub_id = h.hub_id
+       JOIN channel_members cm ON cm.channel_id = c.channel_id
+       WHERE c.deleted_at IS NULL AND h.deleted_at IS NULL
+         AND cm.user_id = ? AND cm.left_at IS NULL AND cm.banned_at IS NULL
+       ORDER BY h.name, c.sort_order ASC, c.created_at ASC`
+    ).all(userId)
+  }
+
   listAccessible({ userId, isGuest = false }) {
     return this.db.prepare(
       `SELECT c.channel_id, c.hub_id, c.name, c.kind, c.visibility, c.topic, c.sort_order, h.name AS hub_name

package/src/services/BotService.js

@@ -11,10 +11,11 @@ import { randomToken, hashToken } from '../util/crypto.js'
 import { ServiceError } from '../util/errors.js'
 
 export class BotService {
-  constructor({ authService, authRepo, channelRepo, nowFn = () => Date.now() }) {
+  constructor({ authService, authRepo, channelRepo, hubService, nowFn = () => Date.now() }) {
     this.authService = authService
     this.authRepo = authRepo
     this.channelRepo = channelRepo
+    this.hubService = hubService
     this.nowFn = nowFn
   }
 
@@ -119,10 +120,22 @@ export class BotService {
     for (const channelId of toLeave) {
       this.channelRepo.setMemberLeft({ channelId, userId, now })
     }
+
+    // Ensure hub membership for every channel in the final set.
+    // Done after the membership loop so it covers both new and pre-existing
+    // channel memberships (upsert is idempotent so re-running is safe).
+    const hubIds = new Set()
+    for (const channelId of next) {
+      const channel = this.channelRepo.findById({ channelId })
+      if (channel?.hub_id) hubIds.add(channel.hub_id)
+    }
+    for (const hubId of hubIds) {
+      this.hubService.joinHub(hubId, userId)
+    }
   }
 
   _getBotChannels(userId) {
-    return this.channelRepo.listAccessible({ userId })
+    return this.channelRepo.listMemberships({ userId })
   }
 
   // ── Internals ──────────────────────────────────────────────────────────────

package/src/ws/ChatServer.js

@@ -77,7 +77,7 @@ export class ChatServer {
     this.notificationService = new NotificationService({ deliveryService: this.deliveryService, authService: this.auth })
     this.presenceService  = new PresenceService()
     this.signalingService = new SignalingService({ signalingRepo: new SqliteSignalingRepository({ db }) })
-    this.botService       = new BotService({ authService: this.auth, authRepo, channelRepo })
+    this.botService       = new BotService({ authService: this.auth, authRepo, channelRepo, hubService: this.hubService })
     this.pushService      = new WebPushService({
       vapidPublicKey:  process.env.VAPID_PUBLIC_KEY  ?? null,
       vapidPrivateKey: process.env.VAPID_PRIVATE_KEY ?? null,
@@ -323,8 +323,12 @@ export class ChatServer {
         })
         .filter(Boolean)
     } else {
+      const memberIds = new Set(
+        this.channelService.listChannelMembers(channelId).map(m => m.user_id)
+      )
       candidates = this.auth.listUsersBasic()
-        .filter(u => u.user_id !== senderId && !u.roles.includes('bot'))
+        .filter(u => u.user_id !== senderId)
+        .filter(u => !u.roles.includes('bot') || memberIds.has(u.user_id))
         .map(u => ({ user_id: u.user_id, handle: u.handle }))
     }
 
@@ -337,7 +341,6 @@ export class ChatServer {
       }))
       if (priority === 'now' && this.pushService.isConfigured()) {
         const sender   = this.auth.getUser(senderId)
-        const channel  = this.channelService.getChannel(channelId)
         this.pushService.sendToUser({
           userId:    user_id,
           title:     `@${sender?.handle ?? 'someone'} mentioned you`,