@helyx/module-account-gate 1.0.1

package/dist/managed-resource-summary.d.ts

@@ -0,0 +1,3 @@
+import type { ManagedResourceDetail, ManagedResourceSummary } from "@helyx/sdk";
+export declare function managedResourceSummary(detail: ManagedResourceDetail): ManagedResourceSummary;
+//# sourceMappingURL=managed-resource-summary.d.ts.map

package/dist/managed-resource-summary.js

@@ -0,0 +1,6 @@
+export function managedResourceSummary(detail) {
+    const { value, ...summary } = detail;
+    void value;
+    return summary;
+}
+//# sourceMappingURL=managed-resource-summary.js.map

package/dist/member-resource.d.ts

@@ -0,0 +1,3 @@
+import type { ModuleManagedResource } from "@helyx/sdk";
+export declare const accountGateMemberResource: ModuleManagedResource;
+//# sourceMappingURL=member-resource.d.ts.map

package/dist/member-resource.js

@@ -0,0 +1,348 @@
+import { createHash } from "node:crypto";
+import { DashboardActionValidationError, HELYX_SERVICE_NAMES, } from "@helyx/sdk";
+import { parseAccountGateConfiguration } from "./configuration.js";
+import { ACCOUNT_GATE_IDENTITY, ACCOUNT_GATE_SESSION_PURPOSE, } from "./contracts.js";
+import { accountGateRecords } from "./records.js";
+const PAGE_SIZE = 10;
+const SEARCH_RESULT_LIMIT = 25;
+const RETENTION_MS = 90 * 24 * 60 * 60 * 1_000;
+const DISCORD_SNOWFLAKE = /^\d{17,20}$/u;
+export const accountGateMemberResource = {
+    id: "members",
+    async list(context, input) {
+        const search = input.search?.trim() ?? "";
+        if (search.length > 100)
+            throw new DashboardActionValidationError("Search using a Discord display name or user ID of up to 100 characters.");
+        if (search)
+            return searchKnownMembers(context, search, input.cursor);
+        const page = await memberRecords(context).findMany({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "member_summaries",
+            select: accountGateRecords.member_summaries.readableFields,
+            where: { guild_id: context.guildId },
+            orderBy: [
+                { field: "guild_id", direction: "asc" },
+                { field: "member_user_id", direction: "asc" },
+            ],
+            ...(input.cursor
+                ? { cursor: decodeRecordCursor(input.cursor, context.guildId) }
+                : {}),
+            limit: PAGE_SIZE,
+        });
+        const identities = await resolveLiveIdentities(context, page.records.map((row) => stringValue(row.member_user_id)));
+        return {
+            items: page.records.map((row) => memberSummary(row, identities.get(stringValue(row.member_user_id)))),
+            ...(page.nextCursor
+                ? {
+                    nextCursor: encodeRecordCursor(context.guildId, stringValue(page.nextCursor[1])),
+                }
+                : {}),
+        };
+    },
+    async read(context, resourceId) {
+        validateMemberId(resourceId);
+        const row = await loadMemberSummary(context, resourceId);
+        if (!row)
+            return null;
+        const identities = await resolveLiveIdentities(context, [resourceId]);
+        return memberDetail(row, identities.get(resourceId));
+    },
+    preview() {
+        return Promise.reject(unsupported());
+    },
+    create() {
+        return Promise.reject(unsupported());
+    },
+    update() {
+        return Promise.reject(unsupported());
+    },
+    delete() {
+        return Promise.reject(unsupported());
+    },
+    async executeAction(context, input) {
+        if (input.actionId !== "revoke")
+            throw new DashboardActionValidationError("This Access Control member action is not supported.");
+        validateMemberId(input.resourceId);
+        const row = await loadMemberSummary(context, input.resourceId);
+        if (!row)
+            throw new DashboardActionValidationError("Member not found.");
+        const revision = numberValue(row.revision);
+        if (revision !== input.expectedRevision)
+            throw new DashboardActionValidationError("This member changed in another session. Refresh and try again.");
+        const [member] = await discordResources(context).resolveMemberSnapshots({
+            guildId: context.guildId,
+            userIds: [input.resourceId],
+        });
+        if (!member?.exists)
+            throw new DashboardActionValidationError("This member has left the server. There is no live Discord access to revoke.");
+        if (member.isBot)
+            throw new DashboardActionValidationError("Bot accounts cannot be managed through Access Control.");
+        const configurationRecord = await context.services
+            .get(HELYX_SERVICE_NAMES.configuration)
+            .get(context.guildId, ACCOUNT_GATE_IDENTITY.moduleId);
+        if (!configurationRecord)
+            throw new DashboardActionValidationError("Save the Access Control settings before revoking access.");
+        const configuration = parseAccountGateConfiguration(configurationRecord.value);
+        const roles = context.services.get(HELYX_SERVICE_NAMES.memberRoles);
+        try {
+            await roles.removeApprovedRole({
+                guildId: context.guildId,
+                memberUserId: input.resourceId,
+                roleId: configuration.verifiedRoleId,
+                moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+                reason: "Access Control dashboard access revocation",
+            });
+        }
+        catch {
+            throw new DashboardActionValidationError("Discord did not remove the configured access role. Check the bot role hierarchy and try again.");
+        }
+        let temporaryRolesRestored = true;
+        try {
+            await roles.reconcileApprovedRoles({
+                guildId: context.guildId,
+                memberUserId: input.resourceId,
+                allowedRoleIds: [
+                    configuration.verifiedRoleId,
+                    ...configuration.temporaryRoleIds,
+                ],
+                desiredRoleIds: configuration.temporaryRoleIds,
+                moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+                reason: "Access Control dashboard access revocation",
+            });
+        }
+        catch {
+            temporaryRolesRestored = false;
+        }
+        const now = new Date();
+        const updated = await memberRecords(context).updateOne({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "member_summaries",
+            where: {
+                guild_id: context.guildId,
+                member_user_id: input.resourceId,
+            },
+            expected: { field: "revision", value: revision },
+            requireModuleEnabledForGuildId: context.guildId,
+            values: {
+                join_generation: numberValue(row.join_generation) + 1,
+                deadline_at: now,
+                pending_reason: "none",
+                left_at: new Date(0),
+                last_decision: "revoked",
+                revision: revision + 1,
+                retention_until: new Date(now.getTime() + RETENTION_MS),
+                updated_at: now,
+            },
+            audit: {
+                guildId: context.guildId,
+                actorUserId: context.actor.userId,
+                action: "account_gate.access_revoked",
+                source: "dashboard",
+                correlationId: context.correlationId,
+                idempotencyKey: context.correlationId,
+                targetType: "account_gate_member",
+                targetId: input.resourceId,
+                metadata: { temporaryRolesRestored },
+            },
+        });
+        if (!updated.updated)
+            throw new DashboardActionValidationError("Discord access was removed, but the member state changed concurrently. Refresh before taking another action.");
+        const sessions = context.services.get(HELYX_SERVICE_NAMES.sessions);
+        const session = await sessions.getFor(context.guildId, input.resourceId, ACCOUNT_GATE_SESSION_PURPOSE);
+        if (session)
+            await sessions.delete(session.sessionId);
+        const refreshed = await loadMemberSummary(context, input.resourceId);
+        if (!refreshed)
+            throw new Error("Revoked Access Control member disappeared");
+        const identities = await resolveLiveIdentities(context, [input.resourceId]);
+        return memberDetail(refreshed, identities.get(input.resourceId));
+    },
+};
+async function searchKnownMembers(context, search, cursor) {
+    if (DISCORD_SNOWFLAKE.test(search)) {
+        const row = await loadMemberSummary(context, search);
+        if (!row)
+            return { items: [] };
+        const identities = await resolveLiveIdentities(context, [search]);
+        return { items: [memberSummary(row, identities.get(search))] };
+    }
+    const offset = cursor ? decodeSearchCursor(cursor, search) : 0;
+    const matches = await discordResources(context).searchMembers({
+        guildId: context.guildId,
+        query: search,
+        limit: SEARCH_RESULT_LIMIT,
+    });
+    const known = (await Promise.all(matches
+        .filter(({ isBot }) => !isBot)
+        .map(async (identity) => ({
+        identity: {
+            userId: identity.userId,
+            displayName: identity.displayName,
+            avatarUrl: identity.avatarUrl ?? "",
+        },
+        row: await loadMemberSummary(context, identity.userId),
+    })))).filter((item) => item.row !== null);
+    const page = known.slice(offset, offset + PAGE_SIZE);
+    const nextOffset = offset + page.length;
+    return {
+        items: page.map(({ identity, row }) => memberSummary(row, identity)),
+        ...(nextOffset < known.length
+            ? { nextCursor: encodeSearchCursor(nextOffset, search) }
+            : {}),
+    };
+}
+async function resolveLiveIdentities(context, userIds) {
+    if (userIds.length === 0)
+        return new Map();
+    const resolved = await discordResources(context).resolveMembers({
+        guildId: context.guildId,
+        userIds,
+    });
+    return new Map(resolved.flatMap((member) => member.displayName === null
+        ? []
+        : [
+            [
+                member.userId,
+                {
+                    userId: member.userId,
+                    displayName: member.displayName,
+                    avatarUrl: member.avatarUrl ?? "",
+                },
+            ],
+        ]));
+}
+function memberSummary(row, identity) {
+    const memberUserId = stringValue(row.member_user_id);
+    const completedAt = successfulDate(row.previous_success_at);
+    const status = displayStatus(stringValue(row.last_decision));
+    const updatedAt = dateValue(row.updated_at);
+    return {
+        id: memberUserId,
+        revision: numberValue(row.revision),
+        status,
+        title: identity?.displayName ?? "Member left server",
+        description: memberUserId,
+        attributes: {
+            memberUserId,
+            displayName: identity?.displayName ?? null,
+            avatarUrl: identity?.avatarUrl ?? null,
+            memberPresent: identity !== undefined,
+            completedAt: completedAt?.toISOString() ?? null,
+        },
+        updatedAt: updatedAt.toISOString(),
+    };
+}
+function memberDetail(row, identity) {
+    const summary = memberSummary(row, identity);
+    return {
+        ...summary,
+        value: {
+            memberUserId: summary.id,
+            memberPresent: identity !== undefined,
+        },
+    };
+}
+function displayStatus(decision) {
+    if (decision === "passed")
+        return "passed";
+    if (decision === "review")
+        return "review";
+    if (decision === "revoked")
+        return "revoked";
+    if (decision === "pending" || decision === "finalizing")
+        return "pending";
+    return "failed";
+}
+async function loadMemberSummary(context, memberUserId) {
+    return memberRecords(context).findOne({
+        moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+        collection: "member_summaries",
+        select: accountGateRecords.member_summaries.readableFields,
+        where: { guild_id: context.guildId, member_user_id: memberUserId },
+    });
+}
+function memberRecords(context) {
+    return context.services.get(HELYX_SERVICE_NAMES.records);
+}
+function discordResources(context) {
+    return context.services.get(HELYX_SERVICE_NAMES.discordResources);
+}
+function encodeRecordCursor(guildId, memberUserId) {
+    return Buffer.from(JSON.stringify({ version: 1, kind: "records", guildId, memberUserId })).toString("base64url");
+}
+function decodeRecordCursor(cursor, guildId) {
+    const value = decodeCursor(cursor);
+    if (value.kind !== "records" ||
+        value.guildId !== guildId ||
+        typeof value.memberUserId !== "string" ||
+        !DISCORD_SNOWFLAKE.test(value.memberUserId))
+        throw new DashboardActionValidationError("The Access Control member page cursor is invalid.");
+    return [guildId, value.memberUserId];
+}
+function encodeSearchCursor(offset, search) {
+    return Buffer.from(JSON.stringify({
+        version: 1,
+        kind: "search",
+        offset,
+        searchHash: searchHash(search),
+    })).toString("base64url");
+}
+function decodeSearchCursor(cursor, search) {
+    const value = decodeCursor(cursor);
+    if (value.kind !== "search" ||
+        value.searchHash !== searchHash(search) ||
+        typeof value.offset !== "number" ||
+        !Number.isSafeInteger(value.offset) ||
+        value.offset < 1 ||
+        value.offset > SEARCH_RESULT_LIMIT)
+        throw new DashboardActionValidationError("The Access Control member search cursor is invalid.");
+    return value.offset;
+}
+function decodeCursor(cursor) {
+    if (cursor.length < 1 || cursor.length > 500)
+        throw new DashboardActionValidationError("The Access Control member page cursor is invalid.");
+    try {
+        const value = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
+        if (!value ||
+            typeof value !== "object" ||
+            Array.isArray(value) ||
+            value.version !== 1)
+            throw new Error("invalid");
+        return value;
+    }
+    catch {
+        throw new DashboardActionValidationError("The Access Control member page cursor is invalid.");
+    }
+}
+function searchHash(search) {
+    return createHash("sha256")
+        .update(search.trim().toLocaleLowerCase("en-GB"))
+        .digest("base64url");
+}
+function successfulDate(value) {
+    const date = dateValue(value);
+    return date.getTime() > 0 ? date : null;
+}
+function validateMemberId(value) {
+    if (!DISCORD_SNOWFLAKE.test(value))
+        throw new DashboardActionValidationError("The Access Control member ID is invalid.");
+}
+function unsupported() {
+    return new DashboardActionValidationError("Access Control members can only be listed or have access revoked.");
+}
+function stringValue(value) {
+    if (typeof value !== "string")
+        throw new Error("Access Control member record is invalid");
+    return value;
+}
+function numberValue(value) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value))
+        throw new Error("Access Control member record is invalid");
+    return value;
+}
+function dateValue(value) {
+    if (!(value instanceof Date))
+        throw new Error("Access Control member record is invalid");
+    return value;
+}
+//# sourceMappingURL=member-resource.js.map

package/dist/panel-resource.d.ts

@@ -0,0 +1,15 @@
+import type { ModuleManagedResource, ModuleRecordService } from "@helyx/sdk";
+type GatePanelAccessType = "challenges" | "password" | "emoji";
+interface PanelPassword {
+    encodedHash: string;
+    ignoreCase: boolean;
+    trimWhitespace: boolean;
+}
+export declare const gatePanelResource: ModuleManagedResource;
+export declare function getGatePanelRuntime(store: ModuleRecordService, guildId: string, panelId: string): Promise<{
+    accessType: GatePanelAccessType;
+    password: PanelPassword | null;
+} | null>;
+export declare function hasPasswordGatePanel(store: ModuleRecordService, guildId: string): Promise<boolean>;
+export {};
+//# sourceMappingURL=panel-resource.d.ts.map