@helyx/module-account-gate 1.0.1

package/dist/password-resource.js

@@ -0,0 +1,208 @@
+import { DashboardActionValidationError, HELYX_SERVICE_NAMES, } from "@helyx/sdk";
+import { ACCOUNT_GATE_IDENTITY } from "./contracts.js";
+import { parseAccountGateConfiguration } from "./configuration.js";
+import { managedResourceSummary } from "./managed-resource-summary.js";
+import { hashPasswordEntryPhrase } from "./password-entry.js";
+const RESOURCE_ID = "shared-phrase";
+const select = [
+    "guild_id",
+    "encoded_hash",
+    "ignore_case",
+    "trim_whitespace",
+    "revision",
+    "created_at",
+    "updated_at",
+];
+export const passwordEntryPhraseResource = {
+    id: "password-entry-phrase",
+    availableWhileDisabled: true,
+    async list(context) {
+        const row = await findSecret(context.services, context.guildId);
+        return { items: row ? [managedResourceSummary(safeDetail(row))] : [] };
+    },
+    async read(context, resourceId) {
+        if (resourceId !== RESOURCE_ID)
+            return null;
+        const row = await findSecret(context.services, context.guildId);
+        return row ? safeDetail(row) : null;
+    },
+    preview() {
+        return Promise.resolve({
+            ephemeral: true,
+            embed: {
+                title: "Password Entry phrase",
+                description: "The replacement phrase will be converted to a one-way hash. The phrase and hash are not shown after saving.",
+                color: 0x7c3aed,
+            },
+        });
+    },
+    async create(context, value) {
+        const records = context.services.get(HELYX_SERVICE_NAMES.records);
+        if (await findSecret(context.services, context.guildId)) {
+            throw new DashboardActionValidationError("A shared phrase is already configured. Open it and replace the phrase.");
+        }
+        const rules = await currentRules(context.services, context.guildId);
+        const encodedHash = await hashPasswordEntryPhrase(replacementPhrase(value), rules);
+        const now = new Date();
+        const result = await records.appendUnique({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "password_secrets",
+            uniqueBy: ["guild_id"],
+            values: {
+                guild_id: context.guildId,
+                encoded_hash: encodedHash,
+                ignore_case: rules.ignoreCase,
+                trim_whitespace: rules.trimWhitespace,
+                revision: 1,
+                created_at: now,
+                updated_at: now,
+            },
+        });
+        if (!result.created) {
+            throw new DashboardActionValidationError("The shared phrase changed in another session. Reload and try again.");
+        }
+        return safeDetail({
+            revision: 1,
+            updated_at: now,
+        });
+    },
+    async update(context, input) {
+        if (input.resourceId !== RESOURCE_ID) {
+            throw new DashboardActionValidationError("The Password Entry phrase was not found.");
+        }
+        const rules = await currentRules(context.services, context.guildId);
+        const encodedHash = await hashPasswordEntryPhrase(replacementPhrase(input.value), rules);
+        const now = new Date();
+        const result = await context.services
+            .get(HELYX_SERVICE_NAMES.records)
+            .updateOne({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "password_secrets",
+            where: { guild_id: context.guildId },
+            expected: { field: "revision", value: input.expectedRevision },
+            values: {
+                encoded_hash: encodedHash,
+                ignore_case: rules.ignoreCase,
+                trim_whitespace: rules.trimWhitespace,
+                revision: input.expectedRevision + 1,
+                updated_at: now,
+            },
+            audit: {
+                guildId: context.guildId,
+                actorUserId: context.actor.userId,
+                action: "account_gate.password_phrase_replaced",
+                source: "dashboard",
+                correlationId: context.correlationId,
+                idempotencyKey: context.correlationId,
+                targetType: "account_gate_password_phrase",
+                targetId: context.guildId,
+                metadata: { revision: input.expectedRevision + 1 },
+            },
+        });
+        if (!result.updated) {
+            throw new DashboardActionValidationError("The shared phrase changed in another session. Reload and try again.");
+        }
+        return safeDetail({
+            revision: input.expectedRevision + 1,
+            updated_at: now,
+        });
+    },
+    async delete(context, input) {
+        if (input.resourceId !== RESOURCE_ID)
+            return { deleted: false };
+        const current = await findSecret(context.services, context.guildId);
+        if (!current || number(current.revision) !== input.expectedRevision) {
+            throw new DashboardActionValidationError("The shared phrase changed in another session. Reload and try again.");
+        }
+        const result = await context.services
+            .get(HELYX_SERVICE_NAMES.records)
+            .deleteMany({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "password_secrets",
+            where: { guild_id: context.guildId },
+            limit: 1,
+        });
+        return { deleted: result.deleted === 1 };
+    },
+    executeAction() {
+        return Promise.reject(new DashboardActionValidationError("Password Entry phrase actions are not supported."));
+    },
+};
+export async function getPasswordSecret(records, guildId) {
+    const row = await records.findOne({
+        moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+        collection: "password_secrets",
+        select,
+        where: { guild_id: guildId },
+    });
+    if (!row)
+        return null;
+    return {
+        encodedHash: string(row.encoded_hash),
+        ignoreCase: boolean(row.ignore_case),
+        trimWhitespace: boolean(row.trim_whitespace),
+    };
+}
+function safeDetail(row) {
+    const updatedAt = row.updated_at instanceof Date ? row.updated_at : new Date(0);
+    return {
+        id: RESOURCE_ID,
+        revision: number(row.revision),
+        status: "configured",
+        title: "Password Entry phrase",
+        description: "A one-way phrase hash is configured. Enter a replacement to change it.",
+        attributes: {
+            phraseConfigured: true,
+        },
+        updatedAt: updatedAt.toISOString(),
+        value: {
+            replacementPhrase: "",
+        },
+    };
+}
+async function findSecret(services, guildId) {
+    return services
+        .get(HELYX_SERVICE_NAMES.records)
+        .findOne({
+        moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+        collection: "password_secrets",
+        select,
+        where: { guild_id: guildId },
+    });
+}
+async function currentRules(services, guildId) {
+    const record = await services
+        .get(HELYX_SERVICE_NAMES.configuration)
+        .get(guildId, ACCOUNT_GATE_IDENTITY.moduleId);
+    if (!record) {
+        throw new DashboardActionValidationError("Save the Access Control settings before configuring a shared phrase.");
+    }
+    const configuration = parseAccountGateConfiguration(record.value);
+    return {
+        ignoreCase: configuration.passwordIgnoreCase,
+        trimWhitespace: configuration.passwordTrimWhitespace,
+    };
+}
+function replacementPhrase(value) {
+    const phrase = value.replacementPhrase;
+    if (typeof phrase !== "string") {
+        throw new DashboardActionValidationError("Enter a replacement phrase containing 4 to 200 characters.");
+    }
+    return phrase;
+}
+function string(value) {
+    if (typeof value !== "string")
+        throw new Error("Password secret is invalid");
+    return value;
+}
+function boolean(value) {
+    if (typeof value !== "boolean")
+        throw new Error("Password secret is invalid");
+    return value;
+}
+function number(value) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value))
+        throw new Error("Password secret is invalid");
+    return value;
+}
+//# sourceMappingURL=password-resource.js.map

package/dist/privacy.d.ts

@@ -0,0 +1,4 @@
+import type { ServiceAccess } from "@helyx/sdk";
+export declare function privacySuppressionBlocksWork(suppressedAt: Date | null, workCreatedAt: Date): boolean;
+export declare function isAccountGateWorkSuppressed(services: ServiceAccess, guildId: string, memberUserId: string, workCreatedAt: Date): Promise<boolean>;
+//# sourceMappingURL=privacy.d.ts.map

package/dist/privacy.js

@@ -0,0 +1,20 @@
+import { HELYX_SERVICE_NAMES } from "@helyx/sdk";
+import { ACCOUNT_GATE_IDENTITY } from "./contracts.js";
+export function privacySuppressionBlocksWork(suppressedAt, workCreatedAt) {
+    return (suppressedAt !== null && suppressedAt.getTime() >= workCreatedAt.getTime());
+}
+export async function isAccountGateWorkSuppressed(services, guildId, memberUserId, workCreatedAt) {
+    const row = await services
+        .get(HELYX_SERVICE_NAMES.records)
+        .findOne({
+        moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+        collection: "privacy_suppressions",
+        select: ["suppressed_at"],
+        where: {
+            guild_id: guildId,
+            member_user_id: memberUserId,
+        },
+    });
+    return privacySuppressionBlocksWork(row?.suppressed_at instanceof Date ? row.suppressed_at : null, workCreatedAt);
+}
+//# sourceMappingURL=privacy.js.map

package/dist/public-channel-resource.d.ts

@@ -0,0 +1,4 @@
+import type { ModuleManagedResource, ModuleRecordService } from "@helyx/sdk";
+export declare const preGatePublicChannelResource: ModuleManagedResource;
+export declare function loadPreGatePublicChannelIds(records: ModuleRecordService, guildId: string): Promise<readonly string[]>;
+//# sourceMappingURL=public-channel-resource.d.ts.map

package/dist/public-channel-resource.js

@@ -0,0 +1,135 @@
+import { DashboardActionValidationError, HELYX_SERVICE_NAMES, } from "@helyx/sdk";
+import { ACCOUNT_GATE_IDENTITY } from "./contracts.js";
+import { managedResourceSummary } from "./managed-resource-summary.js";
+import { accountGateRecords } from "./records.js";
+const SNOWFLAKE = /^\d{17,20}$/u;
+export const preGatePublicChannelResource = {
+    id: "pre-gate-public-channels",
+    availableWhileDisabled: true,
+    async list(context, input) {
+        const page = await recordService(context).findMany({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "public_channels",
+            select: accountGateRecords.public_channels.readableFields,
+            where: { guild_id: context.guildId },
+            orderBy: [
+                { field: "guild_id", direction: "asc" },
+                { field: "channel_id", direction: "asc" },
+            ],
+            limit: Math.min(100, input.limit),
+        });
+        return {
+            items: page.records.map((row) => managedResourceSummary(channelDetail(row))),
+        };
+    },
+    async read(context, resourceId) {
+        const row = await recordService(context).findOne({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "public_channels",
+            select: accountGateRecords.public_channels.readableFields,
+            where: { guild_id: context.guildId, channel_id: resourceId },
+        });
+        return row ? channelDetail(row) : null;
+    },
+    preview(_context, value) {
+        const channelId = channelValue(value);
+        return Promise.resolve({
+            ephemeral: true,
+            embed: {
+                title: "Pre-gate public channel",
+                description: `<#${channelId}> will be allowed to remain visible before members complete Account Gate.`,
+                color: 0x7c3aed,
+            },
+        });
+    },
+    async create(context, value) {
+        const channelId = channelValue(value);
+        const channel = await context.services
+            .get(HELYX_SERVICE_NAMES.discordResources)
+            .inspectChannel({ guildId: context.guildId, channelId });
+        if (!channel.exists ||
+            !channel.guildMatches ||
+            !["guild_text", "guild_announcement"].includes(channel.type))
+            throw new DashboardActionValidationError("Choose a text or announcement channel from this Discord server.");
+        const createdAt = new Date();
+        const result = await recordService(context).appendUnique({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "public_channels",
+            uniqueBy: ["guild_id", "channel_id"],
+            values: {
+                guild_id: context.guildId,
+                channel_id: channelId,
+                created_at: createdAt,
+            },
+        });
+        if (!result.created)
+            throw new DashboardActionValidationError("That channel is already in the pre-gate public allowlist.");
+        return detail(channelId, createdAt);
+    },
+    update() {
+        return Promise.reject(new DashboardActionValidationError("Remove this channel and add another channel instead."));
+    },
+    async delete(context, input) {
+        const result = await recordService(context).deleteMany({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "public_channels",
+            where: {
+                guild_id: context.guildId,
+                channel_id: input.resourceId,
+            },
+            limit: 1,
+        });
+        return { deleted: result.deleted === 1 };
+    },
+    executeAction() {
+        return Promise.reject(new DashboardActionValidationError("Pre-gate public channel actions are not supported."));
+    },
+};
+export async function loadPreGatePublicChannelIds(records, guildId) {
+    const page = await records.findMany({
+        moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+        collection: "public_channels",
+        select: accountGateRecords.public_channels.readableFields,
+        where: { guild_id: guildId },
+        orderBy: [
+            { field: "guild_id", direction: "asc" },
+            { field: "channel_id", direction: "asc" },
+        ],
+        limit: 100,
+    });
+    return page.records.map((row) => stringValue(row.channel_id));
+}
+function channelDetail(row) {
+    return detail(stringValue(row.channel_id), dateValue(row.created_at));
+}
+function detail(channelId, createdAt) {
+    return {
+        id: channelId,
+        revision: 1,
+        status: "allowed",
+        title: `Channel ${channelId}`,
+        description: "Intentionally visible before Account Gate completion.",
+        attributes: { channelId },
+        updatedAt: createdAt.toISOString(),
+        value: { channelId },
+    };
+}
+function channelValue(value) {
+    if (typeof value.channelId !== "string" || !SNOWFLAKE.test(value.channelId))
+        throw new DashboardActionValidationError("Choose a valid Discord text or announcement channel.");
+    return value.channelId;
+}
+function recordService(context) {
+    return context.services.get(HELYX_SERVICE_NAMES.records);
+}
+function stringValue(value) {
+    if (typeof value !== "string")
+        throw new Error("Pre-gate channel record is invalid");
+    return value;
+}
+function dateValue(value) {
+    if (!(value instanceof Date))
+        throw new Error("Pre-gate channel record is invalid");
+    return value;
+}
+//# sourceMappingURL=public-channel-resource.js.map

package/dist/question-resource.d.ts

@@ -0,0 +1,3 @@
+import type { ModuleManagedResource } from "@helyx/sdk";
+export declare const serverQuestionResource: ModuleManagedResource;
+//# sourceMappingURL=question-resource.d.ts.map

package/dist/question-resource.js

@@ -0,0 +1,246 @@
+import { randomUUID } from "node:crypto";
+import { DashboardActionValidationError, HELYX_SERVICE_NAMES, } from "@helyx/sdk";
+import { validateServerQuestion } from "./challenges.js";
+import { ACCOUNT_GATE_IDENTITY } from "./contracts.js";
+import { managedResourceSummary } from "./managed-resource-summary.js";
+import { accountGateRecords } from "./records.js";
+export const serverQuestionResource = {
+    id: "server-questions",
+    availableWhileDisabled: true,
+    async list(context, input) {
+        const page = await records(context).findMany({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "questions",
+            select: accountGateRecords.questions.readableFields,
+            where: { guild_id: context.guildId },
+            orderBy: [
+                { field: "guild_id", direction: "asc" },
+                { field: "sort_order", direction: "asc" },
+                { field: "question_id", direction: "asc" },
+            ],
+            limit: Math.min(100, input.limit),
+            ...(input.search ? { search: input.search } : {}),
+        });
+        return {
+            items: page.records.map((row) => managedResourceSummary(questionDetail(row))),
+        };
+    },
+    async read(context, resourceId) {
+        const row = await records(context).findOne({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "questions",
+            select: accountGateRecords.questions.readableFields,
+            where: { guild_id: context.guildId, question_id: resourceId },
+        });
+        return row ? questionDetail(row) : null;
+    },
+    preview(_context, value) {
+        const question = questionFromValue("preview", value);
+        return Promise.resolve({
+            ephemeral: true,
+            componentsV2: {
+                accentColor: 0x7c3aed,
+                text: [
+                    { content: "## Server Question preview" },
+                    { content: question.question, markdown: false },
+                    ...question.answers.map((answer) => ({
+                        content: `• ${answer}`,
+                        markdown: false,
+                    })),
+                ],
+            },
+        });
+    },
+    async create(context, value, intent = "draft") {
+        const question = questionFromValue(randomUUID(), value);
+        const now = new Date();
+        const count = await records(context).count({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "questions",
+            where: { guild_id: context.guildId },
+        });
+        if (count >= 100) {
+            throw new DashboardActionValidationError("Access Control supports up to 100 server questions.");
+        }
+        await records(context).append({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "questions",
+            values: {
+                question_id: question.id,
+                guild_id: context.guildId,
+                question_text: question.question,
+                answers_json: JSON.stringify(question.answers),
+                correct_option_index: question.correctOption,
+                enabled: intent === "publish" && booleanValue(value.enabled, true),
+                sort_order: count,
+                revision: 1,
+                created_at: now,
+                updated_at: now,
+            },
+        });
+        await records(context).appendUnique({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "question_creators",
+            uniqueBy: ["question_id"],
+            values: {
+                attribution_id: randomUUID(),
+                question_id: question.id,
+                guild_id: context.guildId,
+                creator_user_id: context.actor.userId,
+                created_at: now,
+            },
+        });
+        return detailFromQuestion(question, intent === "publish" && booleanValue(value.enabled, true), 1, now);
+    },
+    async update(context, input) {
+        const question = questionFromValue(input.resourceId, input.value);
+        const now = new Date();
+        const result = await records(context).updateOne({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "questions",
+            where: {
+                guild_id: context.guildId,
+                question_id: input.resourceId,
+            },
+            expected: { field: "revision", value: input.expectedRevision },
+            values: {
+                question_text: question.question,
+                answers_json: JSON.stringify(question.answers),
+                correct_option_index: question.correctOption,
+                enabled: booleanValue(input.value.enabled, true),
+                revision: input.expectedRevision + 1,
+                updated_at: now,
+            },
+            audit: {
+                guildId: context.guildId,
+                actorUserId: context.actor.userId,
+                action: "account_gate.question_updated",
+                source: "dashboard",
+                correlationId: context.correlationId,
+                idempotencyKey: context.correlationId,
+                targetType: "account_gate_question",
+                targetId: input.resourceId,
+                metadata: {
+                    enabled: booleanValue(input.value.enabled, true),
+                    answerCount: question.answers.length,
+                },
+            },
+        });
+        if (!result.updated) {
+            throw new DashboardActionValidationError("This question changed in another session. Reload and try again.");
+        }
+        return detailFromQuestion(question, booleanValue(input.value.enabled, true), input.expectedRevision + 1, now);
+    },
+    async delete(context, input) {
+        const row = await this.read(context, input.resourceId);
+        if (!row)
+            return { deleted: false };
+        if (row.revision !== input.expectedRevision) {
+            throw new DashboardActionValidationError("This question changed in another session. Reload and try again.");
+        }
+        const result = await records(context).deleteMany({
+            moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+            collection: "questions",
+            where: {
+                guild_id: context.guildId,
+                question_id: input.resourceId,
+            },
+            limit: 1,
+        });
+        if (result.deleted === 1) {
+            await records(context).deleteMany({
+                moduleId: ACCOUNT_GATE_IDENTITY.moduleId,
+                collection: "question_creators",
+                where: { question_id: input.resourceId },
+                limit: 1,
+            });
+        }
+        return { deleted: result.deleted === 1 };
+    },
+    executeAction() {
+        return Promise.reject(new DashboardActionValidationError("Server Question actions are not supported."));
+    },
+};
+function questionFromValue(id, value) {
+    const question = text(value.question, 200, "question");
+    const correctAnswer = text(value.correctAnswer, 80, "correct answer");
+    if (typeof value.incorrectAnswers !== "string") {
+        throw new DashboardActionValidationError("Enter two to four incorrect answers, one per line.");
+    }
+    const incorrect = value.incorrectAnswers
+        .split(/\r?\n/u)
+        .map((answer) => answer.trim())
+        .filter(Boolean);
+    return validateServerQuestion({
+        id,
+        question,
+        answers: [correctAnswer, ...incorrect],
+        correctOption: 0,
+    });
+}
+function questionDetail(row) {
+    const question = validateServerQuestion({
+        id: row.question_id,
+        question: row.question_text,
+        answers: JSON.parse(stringValue(row.answers_json)),
+        correctOption: row.correct_option_index,
+    });
+    return detailFromQuestion(question, booleanValue(row.enabled, false), numberValue(row.revision), dateValue(row.updated_at));
+}
+function detailFromQuestion(question, enabled, revision, updatedAt) {
+    const incorrect = question.answers.filter((_, index) => index !== question.correctOption);
+    return {
+        id: question.id,
+        revision,
+        status: enabled ? "enabled" : "draft",
+        title: question.question,
+        description: `${question.answers.length} answer options`,
+        attributes: {
+            status: enabled ? "Enabled" : "Draft",
+            updatedAt: updatedAt.toISOString(),
+        },
+        updatedAt: updatedAt.toISOString(),
+        value: {
+            question: question.question,
+            correctAnswer: question.answers[question.correctOption],
+            incorrectAnswers: incorrect.join("\n"),
+            enabled,
+        },
+    };
+}
+function records(context) {
+    return context.services.get(HELYX_SERVICE_NAMES.records);
+}
+function text(value, maximum, field) {
+    if (typeof value !== "string") {
+        throw new DashboardActionValidationError(`Enter a valid ${field}.`);
+    }
+    const normalized = value.trim();
+    if (normalized.length < 1 || normalized.length > maximum) {
+        throw new DashboardActionValidationError(`The ${field} must contain 1 to ${maximum} characters.`);
+    }
+    return normalized;
+}
+function stringValue(value) {
+    if (typeof value !== "string")
+        throw new Error("Question record is invalid");
+    return value;
+}
+function numberValue(value) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value))
+        throw new Error("Question record is invalid");
+    return value;
+}
+function booleanValue(value, fallback) {
+    if (value === undefined)
+        return fallback;
+    if (typeof value !== "boolean")
+        throw new DashboardActionValidationError("Choose whether this question is enabled.");
+    return value;
+}
+function dateValue(value) {
+    if (!(value instanceof Date))
+        throw new Error("Question record is invalid");
+    return value;
+}
+//# sourceMappingURL=question-resource.js.map