@igstack/app-catalog-backend-core 6.3.1-alpha-20261003051755 → 6.5.0

package/src/modules/comments/commentsRouter.ts

@@ -1,85 +0,0 @@
-import { TRPCError } from '@trpc/server'
-import { z } from 'zod'
-import { publicProcedure, router } from '../../server/trpcSetup'
-import type { Visitor } from './visitorIdentity'
-import {
-  CommentError,
-  MAX_BODY_LENGTH,
-  addComment,
-  deleteComment,
-  editComment,
-  listComments,
-} from './service'
-
-const bodyInput = z.string().min(1).max(MAX_BODY_LENGTH)
-
-/**
- * Writing needs a visitor token, and the token is issued on the request that reads
- * the comment list — so by the time anyone can click Post, the cookie exists. A
- * missing one here means cookies are blocked, which no error code describes well;
- * PRECONDITION_FAILED at least separates it from a permission problem.
- */
-function requireVisitor(visitor: Visitor | null): Visitor {
-  if (!visitor) {
-    throw new TRPCError({
-      code: 'PRECONDITION_FAILED',
-      message: 'Commenting needs cookies enabled',
-    })
-  }
-  return visitor
-}
-
-const REASON_CODES = {
-  'not-found': 'NOT_FOUND',
-  'not-author': 'FORBIDDEN',
-  'window-closed': 'FORBIDDEN',
-  empty: 'BAD_REQUEST',
-} as const
-
-async function mapErrors<T>(work: () => Promise<T>): Promise<T> {
-  try {
-    return await work()
-  } catch (error) {
-    if (error instanceof CommentError) {
-      throw new TRPCError({
-        code: REASON_CODES[error.reason],
-        message: error.message,
-      })
-    }
-    throw error
-  }
-}
-
-export function createCommentsRouter() {
-  return router({
-    list: publicProcedure
-      .input(z.object({ resourceSlug: z.string() }))
-      .query(({ input, ctx }) => listComments(input.resourceSlug, ctx.visitor)),
-
-    add: publicProcedure
-      .input(z.object({ resourceSlug: z.string(), body: bodyInput }))
-      .mutation(({ input, ctx }) =>
-        mapErrors(() =>
-          addComment(
-            input.resourceSlug,
-            input.body,
-            requireVisitor(ctx.visitor),
-          ),
-        ),
-      ),
-
-    edit: publicProcedure
-      .input(z.object({ id: z.string(), body: bodyInput }))
-      .mutation(({ input, ctx }) =>
-        mapErrors(() =>
-          editComment(input.id, input.body, requireVisitor(ctx.visitor)),
-        ),
-      ),
-
-    remove: publicProcedure
-      .input(z.object({ id: z.string() }))
-      .mutation(({ input, ctx }) =>
-        mapErrors(() => deleteComment(input.id, requireVisitor(ctx.visitor))),
-      ),
-  })
-}

package/src/modules/comments/service.ts

@@ -1,174 +0,0 @@
-import { getDbClient } from '../../db/client'
-import type { Visitor } from './visitorIdentity'
-
-/** How long an author may edit or delete their own comment. */
-export const EDIT_WINDOW_MS = 60 * 60 * 1000
-
-export const MAX_BODY_LENGTH = 1000
-
-/**
- * What a maintainer did with a comment. Null while nobody has looked at it.
- *
- * Mirrors the Prisma enum rather than importing it, so the view type stays
- * usable on the client.
- */
-export type CommentStatus = 'applied' | 'acknowledged'
-
-/** One comment as a client sees it. Never carries an author hash. */
-export interface CommentView {
-  id: string
-  authorName: string
-  body: string
-  createdAt: string
-  /** Null when the comment has never been edited. */
-  editedAt: string | null
-  /**
-   * Null until a maintainer reviews the comment. `applied` is deliberately
-   * visible to everyone: it tells the next reader that comments reach a human
-   * and change the catalog.
-   */
-  status: CommentStatus | null
-  /** One answer from the maintainers, or null. */
-  reviewerReply: string | null
-  /** Whether this browser wrote it — what makes Edit and Delete appear. */
-  isMine: boolean
-  /**
-   * The absolute instant this browser's edit window closes, or null when it is not
-   * this browser's comment. Absolute rather than a remaining duration so a client
-   * with a skewed clock still hides the controls at the same moment the server
-   * starts refusing the edit.
-   */
-  canEditUntil: string | null
-}
-
-function toView(
-  row: {
-    id: string
-    authorHash: string
-    authorAlias: string
-    body: string
-    editedAt: Date | null
-    createdAt: Date
-    status?: CommentStatus | null
-    reviewerReply?: string | null
-  },
-  visitor: Visitor | null,
-): CommentView {
-  const isMine = !!visitor && row.authorHash === visitor.hash
-  return {
-    id: row.id,
-    authorName: row.authorAlias,
-    body: row.body,
-    createdAt: row.createdAt.toISOString(),
-    editedAt: row.editedAt?.toISOString() ?? null,
-    status: row.status ?? null,
-    reviewerReply: row.reviewerReply ?? null,
-    isMine,
-    canEditUntil: isMine
-      ? new Date(row.createdAt.getTime() + EDIT_WINDOW_MS).toISOString()
-      : null,
-  }
-}
-
-async function resourceIdForSlug(slug: string): Promise<string | null> {
-  const resource = await getDbClient().dbResource.findUnique({
-    where: { slug },
-    select: { id: true },
-  })
-  return resource?.id ?? null
-}
-
-/** Oldest first: a comment thread reads top to bottom. */
-export async function listComments(
-  resourceSlug: string,
-  visitor: Visitor | null,
-): Promise<CommentView[]> {
-  const resourceId = await resourceIdForSlug(resourceSlug)
-  if (!resourceId) return []
-
-  const rows = await getDbClient().dbComment.findMany({
-    where: { resourceId },
-    orderBy: { createdAt: 'asc' },
-  })
-  return rows.map((row) => toView(row, visitor))
-}
-
-export class CommentError extends Error {
-  constructor(
-    readonly reason: 'not-found' | 'not-author' | 'window-closed' | 'empty',
-    message: string,
-  ) {
-    super(message)
-  }
-}
-
-function normaliseBody(body: string): string {
-  const trimmed = body.trim()
-  if (!trimmed) throw new CommentError('empty', 'A comment cannot be empty')
-  return trimmed.slice(0, MAX_BODY_LENGTH)
-}
-
-export async function addComment(
-  resourceSlug: string,
-  body: string,
-  visitor: Visitor,
-): Promise<CommentView> {
-  const resourceId = await resourceIdForSlug(resourceSlug)
-  if (!resourceId) {
-    throw new CommentError('not-found', `Unknown resource: ${resourceSlug}`)
-  }
-
-  const row = await getDbClient().dbComment.create({
-    data: {
-      resourceId,
-      authorHash: visitor.hash,
-      authorAlias: visitor.alias,
-      body: normaliseBody(body),
-    },
-  })
-  return toView(row, visitor)
-}
-
-/**
- * Load a comment and check this visitor may still change it.
- *
- * The window is enforced here, not in the UI: the controls disappearing is a
- * courtesy, and a request that arrives a second late must still be refused.
- */
-async function loadOwn(id: string, visitor: Visitor) {
-  const row = await getDbClient().dbComment.findUnique({ where: { id } })
-  if (!row) throw new CommentError('not-found', 'Comment no longer exists')
-  if (row.authorHash !== visitor.hash) {
-    throw new CommentError('not-author', 'Only the author can change a comment')
-  }
-  if (Date.now() > row.createdAt.getTime() + EDIT_WINDOW_MS) {
-    throw new CommentError(
-      'window-closed',
-      'A comment can only be changed in the first hour',
-    )
-  }
-  return row
-}
-
-export async function editComment(
-  id: string,
-  body: string,
-  visitor: Visitor,
-): Promise<CommentView> {
-  await loadOwn(id, visitor)
-
-  const row = await getDbClient().dbComment.update({
-    where: { id },
-    data: { body: normaliseBody(body), editedAt: new Date() },
-  })
-  return toView(row, visitor)
-}
-
-export async function deleteComment(
-  id: string,
-  visitor: Visitor,
-): Promise<{ id: string }> {
-  await loadOwn(id, visitor)
-  await getDbClient().dbComment.delete({ where: { id } })
-  return { id }
-}