@geekity/cms 0.30.0 → 0.31.0

package/dist/admin/uploads.js

@@ -1,135 +1,7 @@
-import { mkdir, writeFile } from 'node:fs/promises';
-import path from 'node:path';
-import { matchesSignature, UPLOAD_MEDIA_TYPES } from '../content/media.js';
-import { stripMetadata, UnreadableMetadataError } from '../content/metadata/index.js';
-import { slugify } from '../content/slug.js';
-import { generateImageVariants } from '../images/variants.js';
-import { UPLOAD_ASSET_PREFIX, UPLOAD_DIRECTORY } from '../web/assets.js';
-import { ADMIN_PREFIX } from './session.js';
+import { largestUploadLimit, refusedUpload, storeUpload, tooLargeMessage, UPLOAD_ENVELOPE_BYTES, UPLOAD_FIELD, uploadMarkdown, } from '../media/uploads.js';
+import { ADMIN_PREFIX } from '../site/admin-paths.js';
 /** Where the editor posts a file it wants stored. */
 export const UPLOADS_PATH = `${ADMIN_PREFIX}/uploads`;
-/** The form field the file arrives in. */
-export const UPLOAD_FIELD = 'file';
-/**
- * Slack allowed on top of the size limit when a `Content-Length` is checked.
- *
- * A multipart body is the file plus a boundary, a couple of headers and a
- * trailing marker. Nobody wants a 9.99 MiB image refused because its envelope
- * pushed the request over ten, so the header check is deliberately generous
- * and {@link mountUploads} does the exact one on the file itself.
- */
-export const UPLOAD_ENVELOPE_BYTES = 8192;
-/** Whether an upload came to a refusal rather than a stored file. */
-export function refusedUpload(outcome) {
-    return 'error' in outcome;
-}
-/**
- * Validate one submitted file and write it under
- * `content/uploads/{yyyy}/{mm}/{slug}{ext}`, or say why it cannot be.
- *
- * Three things have to agree before anything is written — the extension is on
- * the site's allowlist, the media type the browser declared is one that
- * extension is allowed to have, and the file's first bytes are that format's.
- * A name is never overwritten; a second `photo.png` becomes `photo-2.png`.
- *
- * It is a function rather than part of the endpoint because the editor's
- * uploads and the settings screen's avatar are the same rules over the same
- * directory, and two copies of them would be two chances to disagree about
- * what a site accepts.
- */
-export async function storeUpload(file, config, options = {}) {
-    if (!(file instanceof File)) {
-        return { status: 400, error: 'That upload carried no file.' };
-    }
-    const original = baseName(file.name);
-    const accepted = acceptUpload(original, declaredType(file.type), new Uint8Array(await file.arrayBuffer()), config, options);
-    if (refusedUpload(accepted))
-        return accepted;
-    const { extension, media, bytes: clean } = accepted;
-    const now = new Date();
-    const month = `${String(now.getUTCFullYear()).padStart(4, '0')}/${String(now.getUTCMonth() + 1).padStart(2, '0')}`;
-    const directory = path.join(config.contentDir, UPLOAD_DIRECTORY, ...month.split('/'));
-    await mkdir(directory, { recursive: true });
-    const stem = slugify(original.slice(0, original.length - extension.length)) || 'upload';
-    const name = await writeWithoutOverwriting(directory, stem, extension, clean);
-    // Derived immediately rather than on first sight in a page, so the encoding
-    // is paid for by whoever uploaded the file and not by whoever reads the
-    // post. A format with nothing to derive — a GIF, a PDF, a text file — comes
-    // straight back (decision-10), and a failure is reported and swallowed: a
-    // stored file with no variants is a site that serves the original, which is
-    // what it did before this feature existed.
-    try {
-        await generateImageVariants(config, `${month}/${name}`);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.warn(`Stored ${month}/${name} but could not derive its variants: ${message}`);
-    }
-    return {
-        url: `${UPLOAD_ASSET_PREFIX}${month}/${name}`,
-        media,
-        label: original.slice(0, original.length - extension.length).trim() || name,
-    };
-}
-export function acceptUpload(name, declared, bytes, config, options = {}) {
-    const extension = path.extname(name).toLowerCase();
-    if (!config.uploadTypes.includes(extension)) {
-        const allowed = config.uploadTypes.join(', ');
-        return {
-            status: 415,
-            error: extension === ''
-                ? `That file has no extension, so there is no telling what it is. This site accepts ${allowed}.`
-                : `Uploads of ${extension} are not allowed here. This site accepts ${allowed}.`,
-        };
-    }
-    // Guaranteed by resolveConfig, which refuses an allowlist naming anything
-    // the table has no entry for.
-    const media = UPLOAD_MEDIA_TYPES.get(extension);
-    if (options.imagesOnly === true && media.kind !== 'image') {
-        return { status: 415, error: `A ${extension} is not an image, and this has to be one.` };
-    }
-    if (declared !== '' && !media.declared.includes(declared)) {
-        return {
-            status: 415,
-            error: `That file says it is ${declared}, which is not what a ${extension} is.`,
-        };
-    }
-    const limit = uploadLimit(media, config);
-    if (bytes.byteLength > limit) {
-        return { status: 413, error: tooLargeMessage(limit) };
-    }
-    if (!matchesSignature(media, bytes)) {
-        return { status: 415, error: `That file does not look like a ${extension} inside.` };
-    }
-    try {
-        return { extension, media, bytes: stripMetadata(extension, bytes).bytes };
-    }
-    catch (error) {
-        if (!(error instanceof UnreadableMetadataError))
-            throw error;
-        return {
-            status: 415,
-            error: `${error.message} Its location and camera details could not be removed, so it was not stored.`,
-        };
-    }
-}
-/**
- * The largest file of this kind a site accepts: audio and video have a limit
- * of their own, since an episode is far bigger than any picture.
- */
-export function uploadLimit(media, config) {
-    return media.kind === 'audio' || media.kind === 'video'
-        ? config.uploadMediaMaxBytes
-        : config.uploadMaxBytes;
-}
-/**
- * The most any upload may weigh. The headers do not say what a file is, so a
- * check made before reading it can only hold it to the larger limit, and
- * {@link storeUpload} holds each file to its own once it knows.
- */
-export function largestUploadLimit(config) {
-    return Math.max(config.uploadMaxBytes, config.uploadMediaMaxBytes);
-}
 /**
  * Refuse an oversized upload by its headers, before anything reads it.
  *
@@ -192,65 +64,4 @@ export function mountUploads(app) {
         return c.json(result, 201);
     });
 }
-/**
- * Write the bytes under the first name in the directory that is free.
- *
- * The exclusive flag is what makes "free" true rather than merely true a
- * moment ago: two uploads of `photo.png` racing each other both ask for the
- * same name, one of them gets `EEXIST`, and it moves on to `photo-2.png`
- * instead of overwriting what the other just wrote.
- */
-async function writeWithoutOverwriting(directory, stem, extension, bytes) {
-    for (let suffix = 1;; suffix += 1) {
-        const name = suffix === 1 ? `${stem}${extension}` : `${stem}-${String(suffix)}${extension}`;
-        try {
-            await writeFile(path.join(directory, name), bytes, { flag: 'wx' });
-            return name;
-        }
-        catch (error) {
-            if (error.code !== 'EEXIST')
-                throw error;
-        }
-    }
-}
-/**
- * The Markdown for one upload: an embed for an image, a link for anything else.
- *
- * It is a function of its own because the editor's upload control is no longer
- * the only thing that offers it — the media screen hands out the same line for
- * a file uploaded months ago — and a picture that embedded from one screen and
- * linked from the other would be a difference nobody could explain.
- */
-export function uploadMarkdown(options) {
-    if (!options.image)
-        return `[${escapeLabel(options.label)}](${options.url})`;
-    // A file name is not a description (TASK-141): an image with no alt text in
-    // the library is embedded with none, and publishing it says so.
-    const alt = options.alt?.kind === 'described' ? escapeLabel(options.alt.text) : '';
-    return `![${alt}](${options.url})`;
-}
-/** What an upload over the site's limit is told, and the limit it went over. */
-export function tooLargeMessage(limit) {
-    return `That file is too big. This site accepts uploads up to ${String(limit)} bytes.`;
-}
-/**
- * The last segment of a submitted filename.
- *
- * A browser sends a bare name, but a request is not a browser: anything with a
- * path in it is reduced to its final component, so a name cannot be used to
- * choose a directory. Both separators are cut, because a Windows client sends
- * backslashes.
- */
-function baseName(value) {
-    const segments = value.split(/[\\/]/);
-    return segments[segments.length - 1] ?? '';
-}
-/** A `Content-Type` header without its parameters, lower case. */
-function declaredType(value) {
-    return (value.split(';')[0] ?? '').trim().toLowerCase();
-}
-/** A filename as Markdown link text: the three characters that would break out. */
-function escapeLabel(value) {
-    return value.replace(/([\\[\]])/g, '\\$1');
-}
 //# sourceMappingURL=uploads.js.map

package/dist/admin/uploads.js.map

@@ -1 +1 @@
-{"version":3,"file":"uploads.js","sourceRoot":"","sources":["../../src/admin/uploads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEtF,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,qDAAqD;AACrD,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,YAAY,UAAU,CAAC;AAEtD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAoD1C,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAC3B,OAAiC;IAEjC,OAAO,OAAO,IAAI,OAAO,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,MAAoB,EACpB,OAAO,GAAuB,EAAE;IAEhC,IAAI,CAAC,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,YAAY,CAC3B,QAAQ,EACR,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EACvB,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,EACxC,MAAM,EACN,OAAO,CACR,CAAC;IACF,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEpD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACnH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAC;IACxF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAE9E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,2CAA2C;IAC3C,IAAI,CAAC;QACH,MAAM,qBAAqB,CAAC,MAAM,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,uCAAuC,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,OAAO;QACL,GAAG,EAAE,GAAG,mBAAmB,GAAG,KAAK,IAAI,IAAI,EAAE;QAC7C,KAAK;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;KAC5E,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,QAAgB,EAChB,KAAiB,EACjB,MAAoF,EACpF,OAAO,GAAuB,EAAE;IAEhC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,GAAG;YACX,KAAK,EACH,SAAS,KAAK,EAAE;gBACd,CAAC,CAAC,oFAAoF,OAAO,GAAG;gBAChG,CAAC,CAAC,cAAc,SAAS,4CAA4C,OAAO,GAAG;SACpF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,8BAA8B;IAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAoB,CAAC;IAEnE,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1D,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,SAAS,2CAA2C,EAAE,CAAC;IAC3F,CAAC;IAED,IAAI,QAAQ,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,wBAAwB,QAAQ,yBAAyB,SAAS,MAAM;SAChF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,UAAU,GAAG,KAAK,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kCAAkC,SAAS,UAAU,EAAE,CAAC;IACvF,CAAC;IAED,IAAI,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC7D,OAAO;YACL,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,GAAG,KAAK,CAAC,OAAO,8EAA8E;SACtG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,KAAsB,EACtB,MAAsE;IAEtE,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QACrD,CAAC,CAAC,MAAM,CAAC,mBAAmB;QAC5B,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAsE;IAEtE,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAkC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACpF,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,EAAE,CAAC;IAE3C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,KAAK,GAAG,qBAAqB,EAAE,CAAC;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,mCAAmC;QACnC,OAAO,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;YACrC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC;AAEF,yEAAyE;AACzE,SAAS,qBAAqB,CAAC,MAA0B;IACvD,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,GAAqB;IAChD,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEpE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAiB;YAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,cAAc,CAAC;gBACvB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;aACtC,CAAC;SACH,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,uBAAuB,CACpC,SAAiB,EACjB,IAAY,EACZ,SAAiB,EACjB,KAAiB;IAEjB,KAAK,IAAI,MAAM,GAAG,CAAC,GAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;QAC5F,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,GAAG,GAAG,CAAC;IAC7E,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,OAAO,KAAK,GAAG,KAAK,OAAO,CAAC,GAAG,GAAG,CAAC;AACrC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,yDAAyD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,kEAAkE;AAClE,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC1D,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"uploads.js","sourceRoot":"","sources":["../../src/admin/uploads.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,qDAAqD;AACrD,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,YAAY,UAAU,CAAC;AAUtD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAkC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACpF,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,EAAE,CAAC;IAE3C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,KAAK,GAAG,qBAAqB,EAAE,CAAC;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,mCAAmC;QACnC,OAAO,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;YACrC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC;AAEF,yEAAyE;AACzE,SAAS,qBAAqB,CAAC,MAA0B;IACvD,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,GAAqB;IAChD,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEpE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAiB;YAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,cAAc,CAAC;gBACvB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;aACtC,CAAC;SACH,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/admin/users.d.ts

@@ -1,9 +1,7 @@
 import type { Hono } from 'hono';
-import type { GeekityEnv } from '../env.ts';
-import type { ProfileLink, User } from './accounts.ts';
+import type { GeekityEnv } from '../web/env.ts';
+import type { ProfileLink, User } from '../site/users.ts';
 import type { AdminRender } from './documents.ts';
-/** Where the list of users lives. */
-export declare const USERS_PATH = "/admin/users";
 /**
  * Where the add form lives, and where it posts.
  *
@@ -13,18 +11,9 @@ export declare const USERS_PATH = "/admin/users";
  * top of a list of everybody.
  */
 export declare const ADD_USER_PATH = "/admin/users/new";
-/**
- * Where one user is edited.
- *
- * The split documents.ts already makes between a listing and `basePath/:slug`
- * (TASK-97): the table says who there is, and one screen per person holds
- * every field that person has, each with a label beside it. A row of
- * unlabelled boxes in a table cell could not.
- */
-export declare function editUserPath(id: number): string;
 /**
  * Users > Connected apps: the apps holding a token for whoever is signed in
- * (TASK-162). Mounted by `indieauth/connected-apps.ts`; named here so the
+ * (TASK-162). Mounted by `admin/connected-apps.ts`; named here so the
  * menu can link it without importing the IndieAuth side.
  */
 export declare const CONNECTED_APPS_PATH = "/admin/users/apps";
@@ -33,7 +22,7 @@ export declare const CONNECTED_APPS_CHILD = "apps";
 /**
  * Users > App activity: what apps sent to the IndieAuth and Micropub
  * endpoints, and what they were answered (TASK-221). Mounted by
- * `indieauth/app-activity.ts`; named here for the same reason as Connected apps.
+ * `admin/app-activity.ts`; named here for the same reason as Connected apps.
  */
 export declare const APP_ACTIVITY_PATH = "/admin/users/activity";
 /** The child of Users the app activity screen is. */
@@ -126,6 +115,22 @@ export interface MountUsersOptions {
  * keeps the current-password check honest.
  */
 export declare function mountUsers(app: Hono<GeekityEnv>, options: MountUsersOptions): void;
+/**
+ * Take a user out of the file. Returns `false` when there was nothing to take.
+ *
+ * Their IndieAuth tokens go with them (TASK-160): a token is a file in
+ * `data/` too, so it is revoked here, where every caller deletes a user.
+ *
+ * Their sessions are not ended here: sessions are in the database, and the
+ * screen that deletes a user ends them itself. A session that outlives this —
+ * one in a database restored from a backup, say — names a user the file no
+ * longer holds, and the admin guard turns that into no session at all.
+ */
+export declare function deleteUser(input: {
+    dataDir: string;
+    userId: number;
+    now: Date;
+}): Promise<boolean>;
 /**
  * Delete a user.
  *

package/dist/admin/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/admin/users.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAwB5C,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAMlD,qCAAqC;AACrC,eAAO,MAAM,UAAU,iBAA0B,CAAC;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,qBAAsB,CAAC;AAEjD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE/C;AAcD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,sBAAuB,CAAC;AAExD,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,0BAA2B,CAAC;AAE1D,qDAAqD;AACrD,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAE7C,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,0BAA2B,CAAC;AAE7D,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,wBAAyB,CAAC;AAEvD,0DAA0D;AAC1D,eAAO,MAAM,eAAe,uBAAwB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,yBAA0B,CAAC;AAEzD,sCAAsC;AACtC,eAAO,MAAM,uBAAuB,+BAAgC,CAAC;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,oCAAoC,CAAC;AAE7E,4FAA4F;AAC5F,eAAO,MAAM,eAAe,uBAAwB,CAAC;AAErD,oDAAoD;AACpD,eAAO,MAAM,WAAW;aACtB,QAAQ,EAAE,UAAU;aACpB,QAAQ,EAAE,UAAU;aACpB,KAAK,EAAE,OAAO;aACd,QAAQ,EAAE,UAAU;aACpB,eAAe,EAAE,kBAAkB;aACnC,WAAW,EAAE,cAAc;aAC3B,uBAAuB,EAAE,2BAA2B;aACpD,MAAM,EAAE,SAAS;IACjB,mEAAmE;aACnE,KAAK,EAAE,OAAO;IACd;;;;;;;;OAQG;aACH,EAAE,EAAE,IAAI;IACR,8EAA8E;aAC9E,IAAI,EAAE,MAAM;IACZ,wDAAwD;aACxD,WAAW,EAAE,cAAc;IAC3B,yCAAyC;aACzC,GAAG,EAAE,KAAK;IACV,yCAAyC;aACzC,MAAM,EAAE,QAAQ;IAChB,gEAAgE;aAChE,QAAQ,EAAE,WAAW;IACrB,wCAAwC;aACxC,QAAQ,EAAE,UAAU;IACpB,2DAA2D;aAC3D,KAAK,EAAE,OAAO;IACd,yFAAyF;aACzF,UAAU,EAAE,aAAa;CACjB,CAAC;AAEX,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,oFAAoF;IACpF,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAyWlF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,yEAAyE;IACzE,MAAM,EAAE,IAAI,GAAG,SAAS,CAAC;IACzB,qBAAqB;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,GAAG,SAAS,CASrB;AAED,uEAAuE;AACvE,MAAM,MAAM,sBAAsB,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,sBAAsB,CAYzB;AAOD,2DAA2D;AAC3D,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvF;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,UAAQ,EAChB,KAAK,SAAK,GACT,eAAe,CAejB;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,8DACqB,CAAC;AAE9D,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,2EAA2E;AAC3E,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAoHD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE,CAE9D;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASxE;AAmCD,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,GAAG,MAAM,CAOpF"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/admin/users.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAgBhD,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAa1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAMlD;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,qBAAsB,CAAC;AAcjD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,sBAAuB,CAAC;AAExD,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,0BAA2B,CAAC;AAE1D,qDAAqD;AACrD,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAE7C,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,0BAA2B,CAAC;AAE7D,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,wBAAyB,CAAC;AAEvD,0DAA0D;AAC1D,eAAO,MAAM,eAAe,uBAAwB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,yBAA0B,CAAC;AAEzD,sCAAsC;AACtC,eAAO,MAAM,uBAAuB,+BAAgC,CAAC;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,oCAAoC,CAAC;AAE7E,4FAA4F;AAC5F,eAAO,MAAM,eAAe,uBAAwB,CAAC;AAErD,oDAAoD;AACpD,eAAO,MAAM,WAAW;aACtB,QAAQ,EAAE,UAAU;aACpB,QAAQ,EAAE,UAAU;aACpB,KAAK,EAAE,OAAO;aACd,QAAQ,EAAE,UAAU;aACpB,eAAe,EAAE,kBAAkB;aACnC,WAAW,EAAE,cAAc;aAC3B,uBAAuB,EAAE,2BAA2B;aACpD,MAAM,EAAE,SAAS;IACjB,mEAAmE;aACnE,KAAK,EAAE,OAAO;IACd;;;;;;;;OAQG;aACH,EAAE,EAAE,IAAI;IACR,8EAA8E;aAC9E,IAAI,EAAE,MAAM;IACZ,wDAAwD;aACxD,WAAW,EAAE,cAAc;IAC3B,yCAAyC;aACzC,GAAG,EAAE,KAAK;IACV,yCAAyC;aACzC,MAAM,EAAE,QAAQ;IAChB,gEAAgE;aAChE,QAAQ,EAAE,WAAW;IACrB,wCAAwC;aACxC,QAAQ,EAAE,UAAU;IACpB,2DAA2D;aAC3D,KAAK,EAAE,OAAO;IACd,yFAAyF;aACzF,UAAU,EAAE,aAAa;CACjB,CAAC;AAEX,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,oFAAoF;IACpF,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAuVlF;AAmBD;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,IAAI,CAAC;CACX,GAAG,OAAO,CAAC,OAAO,CAAC,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,yEAAyE;IACzE,MAAM,EAAE,IAAI,GAAG,SAAS,CAAC;IACzB,qBAAqB;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,GAAG,SAAS,CASrB;AAED,uEAAuE;AACvE,MAAM,MAAM,sBAAsB,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,sBAAsB,CAYzB;AAOD,2DAA2D;AAC3D,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvF;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,UAAQ,EAChB,KAAK,SAAK,GACT,eAAe,CAejB;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,8DACqB,CAAC;AAE9D,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,2EAA2E;AAC3E,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AA+GD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE,CAE9D;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASxE;AAmCD,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,GAAG,MAAM,CAOpF"}

package/dist/admin/users.js

@@ -1,16 +1,16 @@
 import { randomInt } from 'node:crypto';
-import { authorHref } from '../web/authors.js';
-import { isLinkUrl, LINK_REL_RULE, LINK_URL_RULE, splitLinkRel } from '../web/navigation.js';
-import { DEFAULT_DELIVERY_MODE, deliveryMode, notificationEvent, notificationSwitches, } from '../notifications/preferences.js';
-import { countUsers, createUser, deleteUser, DuplicateUsernameError, findUserById, listUsers, setUserAdminTheme, setUserEmail, setUserNotification, setUserNotificationMode, setUserPassword, setUserProfile, verifyUserPassword, } from './accounts.js';
-import { ADMIN_THEMES, adminTheme } from './admin-theme.js';
+import { countUsers, createUser, removeUserRecord, DuplicateUsernameError, findUserById, listUsers, setUserAdminTheme, setUserEmail, setUserNotification, setUserNotificationMode, setUserPassword, setUserProfile, verifyUserPassword, } from '../site/users.js';
+import { authorHref } from '../content/authors.js';
+import { isLinkUrl, LINK_REL_RULE, LINK_URL_RULE, splitLinkRel } from '../site/navigation.js';
+import { DEFAULT_DELIVERY_MODE, deliveryMode, notificationEvent, notificationSwitches, } from '../site/notification-preferences.js';
+import { revokeTokensForUser } from '../indieauth/tokens.js';
+import { stringOrEmpty } from '../util/forms.js';
+import { ADMIN_THEMES, adminTheme } from '../site/admin-theme.js';
 import { emailProblem, passwordProblem, usernameProblem } from './credentials.js';
 import { flash } from './flash.js';
-import { ADMIN_PREFIX } from './session.js';
+import { editUserPath, USERS_PATH } from '../site/admin-paths.js';
 import { toldFollowers } from './settings-page.js';
 import { ADMIN_TEMPLATES } from './templates.js';
-/** Where the list of users lives. */
-export const USERS_PATH = `${ADMIN_PREFIX}/users`;
 /**
  * Where the add form lives, and where it posts.
  *
@@ -20,17 +20,6 @@ export const USERS_PATH = `${ADMIN_PREFIX}/users`;
  * top of a list of everybody.
  */
 export const ADD_USER_PATH = `${USERS_PATH}/new`;
-/**
- * Where one user is edited.
- *
- * The split documents.ts already makes between a listing and `basePath/:slug`
- * (TASK-97): the table says who there is, and one screen per person holds
- * every field that person has, each with a label beside it. A row of
- * unlabelled boxes in a table cell could not.
- */
-export function editUserPath(id) {
-    return `${USERS_PATH}/${String(id)}`;
-}
 /**
  * The id in `/admin/users/<id>`, or `undefined` for a segment that is not one.
  *
@@ -45,7 +34,7 @@ function pathId(segment) {
 }
 /**
  * Users > Connected apps: the apps holding a token for whoever is signed in
- * (TASK-162). Mounted by `indieauth/connected-apps.ts`; named here so the
+ * (TASK-162). Mounted by `admin/connected-apps.ts`; named here so the
  * menu can link it without importing the IndieAuth side.
  */
 export const CONNECTED_APPS_PATH = `${USERS_PATH}/apps`;
@@ -54,7 +43,7 @@ export const CONNECTED_APPS_CHILD = 'apps';
 /**
  * Users > App activity: what apps sent to the IndieAuth and Micropub
  * endpoints, and what they were answered (TASK-221). Mounted by
- * `indieauth/app-activity.ts`; named here for the same reason as Connected apps.
+ * `admin/app-activity.ts`; named here for the same reason as Connected apps.
  */
 export const APP_ACTIVITY_PATH = `${USERS_PATH}/activity`;
 /** The child of Users the app activity screen is. */
@@ -147,15 +136,21 @@ export function mountUsers(app, options) {
     app.get(ADD_USER_PATH, (c) => render(c, ADMIN_TEMPLATES.usersNew, addScreen(c)));
     app.post(ADD_USER_PATH, async (c) => {
         const body = await c.req.parseBody();
-        const username = field(body[USER_FIELDS.username]).trim();
-        const supplied = field(body[USER_FIELDS.password]);
-        const email = field(body[USER_FIELDS.email]).trim();
-        const generate = field(body[USER_FIELDS.generate]) !== '';
+        const username = stringOrEmpty(body[USER_FIELDS.username]).trim();
+        const supplied = stringOrEmpty(body[USER_FIELDS.password]);
+        const email = stringOrEmpty(body[USER_FIELDS.email]).trim();
+        const generate = stringOrEmpty(body[USER_FIELDS.generate]) !== '';
         const password = generate ? generatePassword() : supplied;
         const problems = addUserProblems(username, password, generate, email);
         if (Object.keys(problems).length === 0) {
             try {
-                await createUser({ dataDir: c.var.config.dataDir, username, password, email });
+                await createUser({
+                    dataDir: c.var.config.dataDir,
+                    username,
+                    password,
+                    email,
+                    now: c.var.config.now(),
+                });
             }
             catch (error) {
                 if (!(error instanceof DuplicateUsernameError))
@@ -186,9 +181,9 @@ export function mountUsers(app, options) {
         if (session === undefined || user === undefined)
             return c.redirect(USERS_PATH, 303);
         const body = await c.req.parseBody();
-        const current = field(body[USER_FIELDS.currentPassword]);
-        const next = field(body[USER_FIELDS.newPassword]);
-        const confirmation = field(body[USER_FIELDS.newPasswordConfirmation]);
+        const current = stringOrEmpty(body[USER_FIELDS.currentPassword]);
+        const next = stringOrEmpty(body[USER_FIELDS.newPassword]);
+        const confirmation = stringOrEmpty(body[USER_FIELDS.newPasswordConfirmation]);
         const problems = changePasswordProblems({
             correct: verifyUserPassword(c.var.config.dataDir, user.username, current) !== undefined,
             next,
@@ -228,15 +223,11 @@ export function mountUsers(app, options) {
      * what is stored back in it.
      */
     app.post(USER_EMAIL_PATH, async (c) => {
-        const dataDir = c.var.config.dataDir;
-        const body = await c.req.parseBody();
-        const id = Number(field(body[USER_FIELDS.userId]));
-        const email = field(body[USER_FIELDS.email]).trim();
-        const target = Number.isInteger(id) ? findUserById(dataDir, id) : undefined;
-        if (target === undefined) {
-            flash(c, 'error', 'That user is already gone.');
-            return c.redirect(USERS_PATH, 303);
-        }
+        const named = await namedUser(c);
+        if (named instanceof Response)
+            return named;
+        const { dataDir, body, target } = named;
+        const email = stringOrEmpty(body[USER_FIELDS.email]).trim();
         const problem = emailProblem(email);
         if (problem !== undefined) {
             flash(c, 'error', problem);
@@ -264,21 +255,17 @@ export function mountUsers(app, options) {
      * than reported, and because the line to fix has to still be there to fix.
      */
     app.post(USER_PROFILE_PATH, async (c) => {
-        const dataDir = c.var.config.dataDir;
-        const body = await c.req.parseBody();
-        const id = Number(field(body[USER_FIELDS.userId]));
-        const target = Number.isInteger(id) ? findUserById(dataDir, id) : undefined;
-        if (target === undefined) {
-            flash(c, 'error', 'That user is already gone.');
-            return c.redirect(USERS_PATH, 303);
-        }
+        const named = await namedUser(c);
+        if (named instanceof Response)
+            return named;
+        const { dataDir, body, target } = named;
         const typed = {
-            displayName: field(body[USER_FIELDS.displayName]),
-            bio: field(body[USER_FIELDS.bio]),
-            avatar: field(body[USER_FIELDS.avatar]),
-            jobTitle: field(body[USER_FIELDS.jobTitle]),
-            location: field(body[USER_FIELDS.location]),
-            links: field(body[USER_FIELDS.links]),
+            displayName: stringOrEmpty(body[USER_FIELDS.displayName]),
+            bio: stringOrEmpty(body[USER_FIELDS.bio]),
+            avatar: stringOrEmpty(body[USER_FIELDS.avatar]),
+            jobTitle: stringOrEmpty(body[USER_FIELDS.jobTitle]),
+            location: stringOrEmpty(body[USER_FIELDS.location]),
+            links: stringOrEmpty(body[USER_FIELDS.links]),
         };
         const problem = profileLinkLineProblem(typed.links);
         if (problem !== undefined) {
@@ -313,15 +300,11 @@ export function mountUsers(app, options) {
      * render.
      */
     app.post(USER_NOTIFICATIONS_PATH, async (c) => {
-        const dataDir = c.var.config.dataDir;
-        const body = await c.req.parseBody();
-        const id = Number(field(body[USER_FIELDS.userId]));
-        const target = Number.isInteger(id) ? findUserById(dataDir, id) : undefined;
-        if (target === undefined) {
-            flash(c, 'error', 'That user is already gone.');
-            return c.redirect(USERS_PATH, 303);
-        }
-        const name = field(body[USER_FIELDS.event]);
+        const named = await namedUser(c);
+        if (named instanceof Response)
+            return named;
+        const { dataDir, body, target } = named;
+        const name = stringOrEmpty(body[USER_FIELDS.event]);
         const event = notificationEvent(name);
         if (event === undefined) {
             flash(c, 'error', 'That is not something this site can tell anybody about.');
@@ -329,7 +312,7 @@ export function mountUsers(app, options) {
         }
         // An unticked checkbox submits no field at all, so its absence is the
         // answer rather than a missing one.
-        const on = field(body[USER_FIELDS.on]) !== '';
+        const on = stringOrEmpty(body[USER_FIELDS.on]) !== '';
         await setUserNotification({ dataDir, userId: target.id, event: name, on });
         flash(c, 'notice', on
             ? `${target.username} will be emailed about ${event.label.toLowerCase()}.`
@@ -345,21 +328,17 @@ export function mountUsers(app, options) {
      * render.
      */
     app.post(USER_NOTIFICATION_MODE_PATH, async (c) => {
-        const dataDir = c.var.config.dataDir;
-        const body = await c.req.parseBody();
-        const id = Number(field(body[USER_FIELDS.userId]));
-        const target = Number.isInteger(id) ? findUserById(dataDir, id) : undefined;
-        if (target === undefined) {
-            flash(c, 'error', 'That user is already gone.');
-            return c.redirect(USERS_PATH, 303);
-        }
-        const name = field(body[USER_FIELDS.event]);
+        const named = await namedUser(c);
+        if (named instanceof Response)
+            return named;
+        const { dataDir, body, target } = named;
+        const name = stringOrEmpty(body[USER_FIELDS.event]);
         const event = notificationEvent(name);
         if (event === undefined || !event.batched) {
             flash(c, 'error', 'That is not a notice this site can batch up.');
             return c.redirect(editUserPath(target.id), 303);
         }
-        const wanted = deliveryMode(field(body[USER_FIELDS.mode]));
+        const wanted = deliveryMode(stringOrEmpty(body[USER_FIELDS.mode]));
         if (wanted === undefined) {
             flash(c, 'error', 'That is not one of the choices.');
             return c.redirect(editUserPath(target.id), 303);
@@ -378,7 +357,7 @@ export function mountUsers(app, options) {
         if (user === undefined)
             return c.redirect(USERS_PATH, 303);
         const body = await c.req.parseBody();
-        const wanted = field(body[USER_FIELDS.adminTheme]);
+        const wanted = stringOrEmpty(body[USER_FIELDS.adminTheme]);
         const theme = adminTheme(wanted);
         if (wanted !== '' && theme === undefined) {
             flash(c, 'error', 'That is not one of the themes.');
@@ -393,7 +372,7 @@ export function mountUsers(app, options) {
     app.post(DELETE_USER_PATH, async (c) => {
         const dataDir = c.var.config.dataDir;
         const body = await c.req.parseBody();
-        const id = Number(field(body[USER_FIELDS.userId]));
+        const id = Number(stringOrEmpty(body[USER_FIELDS.userId]));
         const target = Number.isInteger(id) ? findUserById(dataDir, id) : undefined;
         const refusal = deleteUserRefusal({
             target,
@@ -404,7 +383,7 @@ export function mountUsers(app, options) {
             flash(c, 'error', refusal);
             return c.redirect(USERS_PATH, 303);
         }
-        await deleteUser({ dataDir, userId: target.id });
+        await deleteUser({ dataDir, userId: target.id, now: c.var.config.now() });
         // Their sessions go with them. The foreign key that used to do this went
         // with the users table (decision-9), so it is done here — and a session
         // that outlives this one, in a database restored from a backup, is not a
@@ -428,6 +407,34 @@ export function mountUsers(app, options) {
         return render(c, ADMIN_TEMPLATES.usersEdit, userScreen(c, user));
     });
 }
+async function namedUser(c) {
+    const dataDir = c.var.config.dataDir;
+    const body = await c.req.parseBody();
+    const id = Number(stringOrEmpty(body[USER_FIELDS.userId]));
+    const target = Number.isInteger(id) ? findUserById(dataDir, id) : undefined;
+    if (target === undefined) {
+        flash(c, 'error', GONE_USER);
+        return c.redirect(USERS_PATH, 303);
+    }
+    return { dataDir, body, target };
+}
+const GONE_USER = 'That user is already gone.';
+/**
+ * Take a user out of the file. Returns `false` when there was nothing to take.
+ *
+ * Their IndieAuth tokens go with them (TASK-160): a token is a file in
+ * `data/` too, so it is revoked here, where every caller deletes a user.
+ *
+ * Their sessions are not ended here: sessions are in the database, and the
+ * screen that deletes a user ends them itself. A session that outlives this —
+ * one in a database restored from a backup, say — names a user the file no
+ * longer holds, and the admin guard turns that into no session at all.
+ */
+export async function deleteUser(input) {
+    const deleted = await removeUserRecord(input);
+    await revokeTokensForUser(input.dataDir, input.userId, input.now);
+    return deleted;
+}
 /**
  * Delete a user.
  *
@@ -439,7 +446,7 @@ export function mountUsers(app, options) {
  */
 export function deleteUserRefusal(input) {
     if (input.target === undefined)
-        return 'That user is already gone.';
+        return GONE_USER;
     if (input.total <= 1) {
         return `${input.target.username} is the only user. Add another before deleting this one.`;
     }
@@ -603,10 +610,6 @@ function themeChoices(user) {
         })),
     ];
 }
-/** A form field as a string. A file upload, or a missing field, is the empty one. */
-function field(value) {
-    return typeof value === 'string' ? value : '';
-}
 /**
  * A textarea of links as the list a profile stores: one per line, `Label |
  * URL`, or a bare URL that labels itself.