@igstack/app-catalog-backend-core 6.10.3 → 6.11.0

package/src/modules/communityTools/router.ts

@@ -0,0 +1,172 @@
+import { TRPCError } from '@trpc/server'
+import { z } from 'zod'
+import type { User } from 'better-auth/types'
+import type { CommunityToolsOptions } from '../../middleware/types'
+import {
+  adminProcedure as adminBase,
+  protectedProcedure as protectedBase,
+  publicProcedure as publicBase,
+  router,
+  t,
+} from '../../server/trpcSetup'
+import type { Actor } from '../visitor/visitorIdentity'
+import * as service from './service'
+import * as write from './writeService'
+
+function requireActor(actor: Actor | null): Actor {
+  if (!actor) {
+    throw new TRPCError({
+      code: 'PRECONDITION_FAILED',
+      message: 'This action needs cookies enabled',
+    })
+  }
+  return actor
+}
+
+function writerOf(ctx: {
+  user: User
+  isAdmin: boolean
+  actor: Actor | null
+}): write.Writer {
+  return {
+    user: ctx.user,
+    isAdmin: ctx.isAdmin,
+    actor: requireActor(ctx.actor),
+  }
+}
+
+/**
+ * `options.capturer` is used as given: resolving the playwright default is the caller's
+ * job (`createAcMiddleware`), so a router built directly never launches a browser.
+ */
+export function createCommunityToolsRouter(options?: CommunityToolsOptions) {
+  const enabled = options?.enabled ?? false
+  const deps = {
+    captureHosts: options?.captureHosts ?? [],
+    capturer: options?.capturer ?? null,
+  }
+
+  // One router shape whether enabled or not, so clients see every procedure in the
+  // type; when disabled every procedure but `config` answers NOT_FOUND.
+  const whenEnabled = t.middleware(({ next }) => {
+    if (!enabled) {
+      throw new TRPCError({
+        code: 'NOT_FOUND',
+        message: 'Community tools are disabled',
+      })
+    }
+    return next()
+  })
+  const publicProcedure = publicBase.use(whenEnabled)
+  const protectedProcedure = protectedBase.use(whenEnabled)
+  const adminProcedure = adminBase.use(whenEnabled)
+
+  return router({
+    config: publicBase.query(() => ({ enabled })),
+
+    list: publicProcedure.query(({ ctx }) => {
+      return service.listTools(ctx.user, ctx.isAdmin, new Date(), deps)
+    }),
+
+    countByApp: publicProcedure.query(() => service.countByApp()),
+
+    get: publicProcedure
+      .input(z.object({ slug: z.string() }))
+      .query(async ({ input, ctx }) => {
+        const tool = await service.getTool(
+          input.slug,
+          ctx.user,
+          ctx.isAdmin,
+          new Date(),
+          deps,
+        )
+        if (!tool) {
+          throw new TRPCError({
+            code: 'NOT_FOUND',
+            message: 'Tool not found',
+          })
+        }
+        return tool
+      }),
+
+    recordView: publicProcedure
+      .input(z.object({ slug: z.string() }))
+      .mutation(({ input, ctx }) => {
+        const actor = requireActor(ctx.actor)
+        return service.recordView(input.slug, actor, ctx.user, new Date())
+      }),
+
+    pins: protectedProcedure.query(({ ctx }) => {
+      return service.listPins(
+        ctx.user.id,
+        ctx.user,
+        ctx.isAdmin,
+        new Date(),
+        deps,
+      )
+    }),
+
+    pin: protectedProcedure
+      .input(z.object({ slug: z.string() }))
+      .mutation(({ input, ctx }) => {
+        return service.pinTool(input.slug, ctx.user.id)
+      }),
+
+    like: protectedProcedure
+      .input(z.object({ slug: z.string() }))
+      .mutation(({ input, ctx }) => {
+        return service.likeTool(input.slug, ctx.user)
+      }),
+
+    unlike: protectedProcedure
+      .input(z.object({ slug: z.string() }))
+      .mutation(({ input, ctx }) => {
+        return service.unlikeTool(input.slug, ctx.user.id)
+      }),
+
+    unpin: protectedProcedure
+      .input(z.object({ slug: z.string() }))
+      .mutation(({ input, ctx }) => {
+        return service.unpinTool(input.slug, ctx.user.id)
+      }),
+
+    reorderPins: protectedProcedure
+      .input(z.object({ slugs: z.array(z.string()) }))
+      .mutation(({ input, ctx }) => {
+        return service.reorderPins(input.slugs, ctx.user.id)
+      }),
+
+    preview: protectedProcedure
+      .input(z.object({ url: z.string().max(2000) }))
+      .mutation(({ input }) => write.previewTool(input.url, deps)),
+
+    add: protectedProcedure
+      .input(write.toolInputSchema)
+      .mutation(({ input, ctx }) =>
+        write.addTool(input, writerOf(ctx), deps, new Date()),
+      ),
+
+    edit: protectedProcedure
+      .input(write.toolInputSchema.extend({ slug: z.string() }))
+      .mutation(({ input, ctx }) =>
+        write.editTool(input, writerOf(ctx), deps, new Date()),
+      ),
+
+    archive: protectedProcedure
+      .input(
+        z.object({
+          slug: z.string(),
+          reason: z.string().trim().min(1).max(500),
+        }),
+      )
+      .mutation(({ input, ctx }) =>
+        write.archiveTool(input.slug, input.reason, writerOf(ctx), new Date()),
+      ),
+
+    approve: adminProcedure
+      .input(z.object({ slug: z.string() }))
+      .mutation(({ input, ctx }) =>
+        write.approveTool(input.slug, writerOf(ctx), new Date()),
+      ),
+  })
+}

package/src/modules/communityTools/service.ts

@@ -0,0 +1,380 @@
+import { TRPCError } from '@trpc/server'
+import type { User } from 'better-auth/types'
+import { getDbClient } from '../../db/client'
+import type { Actor } from '../visitor/visitorIdentity'
+import type { CommunityTool } from '@igstack/app-catalog-shared-core'
+import type { CaptureDeps } from './healthJob'
+import { LIKES, toView } from './toView'
+
+export async function listTools(
+  user: User | null,
+  isAdmin: boolean,
+  now: Date,
+  capture: CaptureDeps,
+): Promise<CommunityTool[]> {
+  const db = getDbClient()
+
+  const tools = await db.dbCommunityTool.findMany({
+    include: {
+      owners: true,
+      namedOwners: true,
+      likes: LIKES,
+      tags: true,
+    },
+  })
+
+  const toolIds = tools.map((t) => t.id)
+
+  // Fetch all persons in one query
+  const ownerSlugs = tools.flatMap((t) => t.owners.map((o) => o.personSlug))
+  const uniqueOwnerSlugs = Array.from(new Set(ownerSlugs))
+  const persons = await db.dbPerson.findMany({
+    where: { slug: { in: uniqueOwnerSlugs } },
+  })
+  const personMap = new Map(persons.map((p) => [p.slug, p]))
+
+  // Get view counts for all tools
+  const today = new Date(now)
+  today.setUTCHours(0, 0, 0, 0)
+  const thirtyDaysAgo = new Date(today)
+  thirtyDaysAgo.setUTCDate(thirtyDaysAgo.getUTCDate() - 29)
+
+  const viewCounts = await Promise.all(
+    toolIds.map(async (toolId) => {
+      const [views30d, viewsAll] = await Promise.all([
+        db.dbCommunityToolView.count({
+          where: { toolId, day: { gte: thirtyDaysAgo } },
+        }),
+        db.dbCommunityToolView.count({ where: { toolId } }),
+      ])
+      return { toolId, views30d, viewsAll }
+    }),
+  )
+  const viewCountMap = new Map(
+    viewCounts.map((v) => [
+      v.toolId,
+      { views30d: v.views30d, viewsAll: v.viewsAll },
+    ]),
+  )
+
+  return Promise.all(
+    tools.map((tool) =>
+      toView(
+        tool,
+        personMap,
+        viewCountMap.get(tool.id)!,
+        user,
+        isAdmin,
+        now,
+        capture,
+      ),
+    ),
+  )
+}
+
+/** How many live tools carry each official app's tag, by app slug. */
+export async function countByApp(): Promise<Record<string, number>> {
+  const rows = await getDbClient().dbCommunityToolTag.groupBy({
+    by: ['value'],
+    where: { kind: 'app', tool: { archivedAt: null } },
+    _count: { _all: true },
+  })
+  return Object.fromEntries(rows.map((r) => [r.value, r._count._all]))
+}
+
+export async function getTool(
+  slug: string,
+  user: User | null,
+  isAdmin: boolean,
+  now: Date,
+  capture: CaptureDeps,
+): Promise<CommunityTool | null> {
+  const db = getDbClient()
+
+  const tool = await db.dbCommunityTool.findUnique({
+    where: { slug },
+    include: {
+      owners: true,
+      namedOwners: true,
+      likes: LIKES,
+      tags: true,
+    },
+  })
+
+  if (!tool) return null
+
+  const ownerSlugs = tool.owners.map((o) => o.personSlug)
+  const persons = await db.dbPerson.findMany({
+    where: { slug: { in: ownerSlugs } },
+  })
+  const personMap = new Map(persons.map((p) => [p.slug, p]))
+
+  const today = new Date(now)
+  today.setUTCHours(0, 0, 0, 0)
+  const thirtyDaysAgo = new Date(today)
+  thirtyDaysAgo.setUTCDate(thirtyDaysAgo.getUTCDate() - 29)
+
+  const [views30d, viewsAll] = await Promise.all([
+    db.dbCommunityToolView.count({
+      where: { toolId: tool.id, day: { gte: thirtyDaysAgo } },
+    }),
+    db.dbCommunityToolView.count({ where: { toolId: tool.id } }),
+  ])
+
+  return toView(
+    tool,
+    personMap,
+    { views30d, viewsAll },
+    user,
+    isAdmin,
+    now,
+    capture,
+  )
+}
+
+export async function recordView(
+  slug: string,
+  actor: Actor,
+  user: User | null,
+  now: Date,
+): Promise<{ views30d: number; viewsAll: number }> {
+  const db = getDbClient()
+
+  const tool = await db.dbCommunityTool.findUnique({ where: { slug } })
+  if (!tool) {
+    throw new Error('Tool not found')
+  }
+
+  const day = new Date(now)
+  day.setUTCHours(0, 0, 0, 0)
+
+  await db.dbCommunityToolView.upsert({
+    where: {
+      toolId_actorHash_day: {
+        toolId: tool.id,
+        actorHash: actor.hash,
+        day,
+      },
+    },
+    create: {
+      toolId: tool.id,
+      actorHash: actor.hash,
+      userId: user?.id ?? null,
+      day,
+      at: now,
+    },
+    update: {
+      at: now,
+      userId: user?.id ?? null,
+    },
+  })
+
+  const thirtyDaysAgo = new Date(day)
+  thirtyDaysAgo.setUTCDate(thirtyDaysAgo.getUTCDate() - 29)
+
+  const [views30d, viewsAll] = await Promise.all([
+    db.dbCommunityToolView.count({
+      where: { toolId: tool.id, day: { gte: thirtyDaysAgo } },
+    }),
+    db.dbCommunityToolView.count({ where: { toolId: tool.id } }),
+  ])
+
+  return { views30d, viewsAll }
+}
+
+export async function listPins(
+  userId: string,
+  user: User | null,
+  isAdmin: boolean,
+  now: Date,
+  capture: CaptureDeps,
+): Promise<CommunityTool[]> {
+  const db = getDbClient()
+
+  const pins = await db.dbCommunityToolPin.findMany({
+    where: { userId },
+    orderBy: { position: 'asc' },
+    include: {
+      tool: {
+        include: {
+          owners: true,
+          namedOwners: true,
+          likes: LIKES,
+          tags: true,
+        },
+      },
+    },
+  })
+
+  const toolIds = pins.map((p) => p.tool.id)
+
+  const ownerSlugs = pins.flatMap((p) => p.tool.owners.map((o) => o.personSlug))
+  const uniqueOwnerSlugs = Array.from(new Set(ownerSlugs))
+  const persons = await db.dbPerson.findMany({
+    where: { slug: { in: uniqueOwnerSlugs } },
+  })
+  const personMap = new Map(persons.map((p) => [p.slug, p]))
+
+  const today = new Date(now)
+  today.setUTCHours(0, 0, 0, 0)
+  const thirtyDaysAgo = new Date(today)
+  thirtyDaysAgo.setUTCDate(thirtyDaysAgo.getUTCDate() - 29)
+
+  const viewCounts = await Promise.all(
+    toolIds.map(async (toolId) => {
+      const [views30d, viewsAll] = await Promise.all([
+        db.dbCommunityToolView.count({
+          where: { toolId, day: { gte: thirtyDaysAgo } },
+        }),
+        db.dbCommunityToolView.count({ where: { toolId } }),
+      ])
+      return { toolId, views30d, viewsAll }
+    }),
+  )
+  const viewCountMap = new Map(
+    viewCounts.map((v) => [
+      v.toolId,
+      { views30d: v.views30d, viewsAll: v.viewsAll },
+    ]),
+  )
+
+  return Promise.all(
+    pins.map((pin) =>
+      toView(
+        pin.tool,
+        personMap,
+        viewCountMap.get(pin.tool.id)!,
+        user,
+        isAdmin,
+        now,
+        capture,
+      ),
+    ),
+  )
+}
+
+async function requireToolId(slug: string): Promise<string> {
+  const tool = await getDbClient().dbCommunityTool.findUnique({
+    where: { slug },
+    select: { id: true },
+  })
+  if (!tool) {
+    throw new TRPCError({ code: 'NOT_FOUND', message: 'Tool not found' })
+  }
+  return tool.id
+}
+
+/** Pinning a pinned tool leaves it where it is. */
+export async function pinTool(slug: string, userId: string): Promise<void> {
+  const db = getDbClient()
+  const toolId = await requireToolId(slug)
+
+  const maxPin = await db.dbCommunityToolPin.findFirst({
+    where: { userId },
+    orderBy: { position: 'desc' },
+  })
+
+  await db.dbCommunityToolPin.upsert({
+    where: { userId_toolId: { userId, toolId } },
+    create: { userId, toolId, position: maxPin ? maxPin.position + 1 : 0 },
+    update: {},
+  })
+}
+
+/** Prisma's unique-constraint error. */
+function isUniqueViolation(error: unknown): boolean {
+  return (
+    error instanceof Error &&
+    'code' in error &&
+    (error as { code: unknown }).code === 'P2002'
+  )
+}
+
+/** Liking twice is one like. */
+export async function likeTool(
+  slug: string,
+  user: { id: string; name: string },
+): Promise<void> {
+  const toolId = await requireToolId(slug)
+  try {
+    await getDbClient().dbCommunityToolLike.upsert({
+      where: { toolId_userId: { toolId, userId: user.id } },
+      create: { toolId, userId: user.id, userName: user.name },
+      update: {},
+    })
+  } catch (error) {
+    // Two likes at once both miss, and one insert loses the race: still liked.
+    if (!isUniqueViolation(error)) throw error
+  }
+}
+
+/** Unliking what was never liked changes nothing. */
+export async function unlikeTool(slug: string, userId: string): Promise<void> {
+  const toolId = await requireToolId(slug)
+  await getDbClient().dbCommunityToolLike.deleteMany({
+    where: { toolId, userId },
+  })
+}
+
+export async function unpinTool(slug: string, userId: string): Promise<void> {
+  const toolId = await requireToolId(slug)
+  await getDbClient().dbCommunityToolPin.deleteMany({
+    where: { userId, toolId },
+  })
+}
+
+export async function reorderPins(
+  slugs: string[],
+  userId: string,
+): Promise<void> {
+  const db = getDbClient()
+
+  // Get all pins for this user
+  const pins = await db.dbCommunityToolPin.findMany({
+    where: { userId },
+    include: { tool: true },
+    orderBy: { position: 'asc' },
+  })
+
+  // Create a map of slug to pin
+  const slugToPin = new Map(pins.map((p) => [p.tool.slug, p]))
+
+  // Build new order: named slugs first, then unlisted pins in current order
+  const namedPins = slugs
+    .map((slug) => slugToPin.get(slug))
+    .filter((p) => p !== undefined)
+  const unlistedPins = pins.filter((p) => !slugs.includes(p.tool.slug))
+  const newOrder = [...namedPins, ...unlistedPins]
+
+  // Update positions
+  await Promise.all(
+    newOrder.map((pin, index) =>
+      db.dbCommunityToolPin.update({
+        where: {
+          userId_toolId: {
+            userId,
+            toolId: pin.toolId,
+          },
+        },
+        data: { position: index },
+      }),
+    ),
+  )
+}
+
+export async function computeCanEdit(
+  tool: { id: string; addedByUserId: string },
+  user: User | null,
+  isAdmin: boolean,
+): Promise<boolean> {
+  if (!user) return false
+  if (isAdmin) return true
+  if (tool.addedByUserId === user.id) return true
+
+  const db = getDbClient()
+  const owners = await db.dbCommunityToolOwner.findMany({
+    where: { toolId: tool.id },
+  })
+
+  return owners.some((o: { personSlug: string }) => o.personSlug === user.email)
+}

package/src/modules/communityTools/toView.ts

@@ -0,0 +1,112 @@
+import type { User } from 'better-auth/types'
+import type {
+  CommunityTag,
+  CommunityTool,
+  PersonRef,
+} from '@igstack/app-catalog-shared-core'
+import { isCaptureAllowed, lifecycleOf } from '@igstack/app-catalog-shared-core'
+import type { DbPerson, Prisma } from '../../generated/prisma/client'
+import type { CaptureDeps } from './healthJob'
+import { computeCanEdit } from './service'
+
+/** The likes a view reads: newest first, for "Liked by". */
+export const LIKES = {
+  orderBy: { createdAt: 'desc' },
+  select: { userId: true, userName: true },
+} as const satisfies Prisma.DbCommunityTool$likesArgs
+
+/** How many likers a view names; the rest are a count. */
+const LIKED_BY_NAMES = 8
+
+type DbToolWithRelations = Prisma.DbCommunityToolGetPayload<{
+  include: {
+    owners: true
+    namedOwners: true
+    tags: true
+    likes: typeof LIKES
+  }
+}>
+
+export async function toView(
+  tool: DbToolWithRelations,
+  personMap: Map<string, DbPerson>,
+  viewCounts: { views30d: number; viewsAll: number },
+  user: User | null,
+  isAdmin: boolean,
+  now: Date,
+  capture: CaptureDeps,
+): Promise<CommunityTool> {
+  const owners: PersonRef[] = tool.owners.map((o) => {
+    const person = personMap.get(o.personSlug)
+    if (person) {
+      const name = `${person.firstName} ${person.lastName}`.trim()
+      return { slug: o.personSlug, name: name || o.personSlug }
+    }
+    return { slug: o.personSlug, name: o.personSlug }
+  })
+  // Outside the directory: a name to ask for, never an editor.
+  for (const o of tool.namedOwners) owners.push({ slug: null, name: o.name })
+
+  const tags: CommunityTag[] = tool.tags.map((t) => ({
+    kind: t.kind,
+    value: t.value,
+  }))
+
+  const lifecycle = lifecycleOf(
+    {
+      failingSince: tool.failingSince,
+      archivedAt: tool.archivedAt,
+      archivedBy: tool.archivedBy,
+      archivedReason: tool.archivedReason,
+    },
+    now,
+  )
+
+  // Never visited yet, and a visit will come: the same conditions `checkTool`
+  // runs under. A finished visit sets `lastCheckAt`, failed or not.
+  const capturePending =
+    !tool.screenshotAssetId &&
+    !tool.lastCheckAt &&
+    capture.capturer !== null &&
+    isCaptureAllowed(tool.url, capture.captureHosts)
+
+  const canEdit = await computeCanEdit(
+    { id: tool.id, addedByUserId: tool.addedByUserId },
+    user,
+    isAdmin,
+  )
+
+  return {
+    slug: tool.slug,
+    name: tool.name,
+    url: tool.url,
+    host: tool.host,
+    summary: tool.summary,
+    descriptionMd: tool.descriptionMd,
+    owners,
+    addedBy: {
+      userId: tool.addedByUserId,
+      name: tool.addedByName,
+    },
+    createdAt: tool.createdAt.toISOString(),
+    // ponytail: every like row is read per view; a counted column if likes run to thousands.
+    likes: tool.likes.length,
+    likedByMe: !!user && tool.likes.some((l) => l.userId === user.id),
+    // The viewer's own like is `likedByMe`; the names are everyone else's.
+    likedBy: tool.likes
+      .filter((l) => l.userId !== user?.id)
+      .slice(0, LIKED_BY_NAMES)
+      .map((l) => l.userName),
+    siteUpdatedAt: tool.siteUpdatedAt?.toISOString() ?? null,
+    tags,
+    views30d: viewCounts.views30d,
+    viewsAll: viewCounts.viewsAll,
+    reviewed: tool.reviewedAt !== null,
+    lifecycle,
+    screenshotId: tool.screenshotAssetId ?? null,
+    faviconId: tool.faviconAssetId ?? null,
+    capturedAt: tool.capturedAt?.toISOString() ?? null,
+    capturePending,
+    canEdit,
+  }
+}