@itsmrtr/bunkoshelf 1.12.1 → 1.13.0

package/dist/src/actions/clubs.ts

@@ -0,0 +1,238 @@
+"use server";
+
+import bcrypt from "bcryptjs";
+import jwt from "jsonwebtoken";
+import { createHash } from "node:crypto";
+import { cookies } from "next/headers";
+import { revalidatePath } from "next/cache";
+import { createId } from "@paralleldrive/cuid2";
+import { verifySession } from "@/lib/auth/verifySession";
+import { createUserRecord, usernameExists } from "@/lib/db/users";
+import { execute, queryOne } from "@/lib/db/query";
+import {
+  addCandidateRecord,
+  addMilestoneRecord,
+  archiveClubRecord,
+  canAccessClub,
+  canManageClub,
+  castVoteRecord,
+  createClubRecord,
+  createCycleRecord,
+  createInviteRecord,
+  deleteClubRecord,
+  findClubBySlug,
+  findInviteByTokenHash,
+  getMembership,
+  removeCandidateRecord,
+  replaceCycleCandidates,
+  requestMembership,
+  reviewMembership,
+  selectCycleWork,
+  type ClubSourceType,
+} from "@/lib/db/clubs";
+
+type Result = { success: true } | { success: false; error: string };
+
+function slugify(value: string) {
+  return value.toLowerCase().trim().normalize("NFD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48);
+}
+
+function inviteHash(token: string) {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+async function manager(slug: string) {
+  const user = await verifySession();
+  const club = await findClubBySlug(slug);
+  if (!user || !club || !(await canManageClub(club, user.id, user.isAdmin))) return null;
+  return { user, club };
+}
+
+async function belongsToClub(cycleId: string, clubId: string) {
+  return !!(await queryOne<{ id: string }>("SELECT id FROM reading_club_cycles WHERE id=$1 AND club_id=$2", [cycleId, clubId]));
+}
+
+export async function createClub(input: { name: string; description?: string }): Promise<Result & { slug?: string }> {
+  const user = await verifySession();
+  const name = input.name.trim();
+  if (!user || user.role === "GUEST") return { success: false, error: "Unauthorized" };
+  if (name.length < 2 || name.length > 100) return { success: false, error: "Invalid club name" };
+  const slug = `${slugify(name) || "club"}-${createId().slice(-6)}`;
+  const club = await createClubRecord({ slug, name, description: input.description?.trim(), ownerId: user.id });
+  await requestMembership(club.id, user.id);
+  const membership = await getMembership(club.id, user.id);
+  if (membership) await reviewMembership(membership.id, "APPROVED");
+  revalidatePath("/", "layout");
+  return { success: true, slug };
+}
+
+export async function createClubInvite(slug: string): Promise<Result & { token?: string }> {
+  const context = await manager(slug);
+  if (!context || context.club.status !== "ACTIVE") return { success: false, error: "Unauthorized" };
+  const token = crypto.randomUUID().replace(/-/g, "") + crypto.randomUUID().replace(/-/g, "");
+  await createInviteRecord(context.club.id, inviteHash(token), context.user.id);
+  return { success: true, token };
+}
+
+export async function joinClubWithSession(token: string): Promise<Result & { slug?: string }> {
+  const user = await verifySession();
+  const invite = await findInviteByTokenHash(inviteHash(token));
+  if (!user || !invite || invite.club_status !== "ACTIVE") return { success: false, error: "Invalid invitation" };
+  if (user.role === "GUEST") return { success: false, error: "Guest accounts are limited to their club" };
+  await requestMembership(invite.club_id, user.id);
+  return { success: true, slug: invite.club_slug };
+}
+
+export async function joinClubAsGuest(input: { token: string; username: string; password: string }): Promise<Result & { slug?: string }> {
+  const invite = await findInviteByTokenHash(inviteHash(input.token));
+  const username = input.username.trim();
+  if (!invite || invite.club_status !== "ACTIVE") return { success: false, error: "Invalid invitation" };
+  if (!/^[a-zA-Z0-9_-]{3,32}$/.test(username) || input.password.length < 8) return { success: false, error: "Use a name of 3–32 characters and a password of at least 8 characters" };
+  if (await usernameExists(username)) return { success: false, error: "That name is already in use" };
+  const user = await createUserRecord({ username, password: await bcrypt.hash(input.password, 10), role: "GUEST", name: username });
+  await execute("INSERT INTO reading_club_guest_accounts (user_id,club_id) VALUES ($1,$2)", [user.id, invite.club_id]);
+  await requestMembership(invite.club_id, user.id);
+  const token = jwt.sign({ id: user.id, username: user.username, isAdmin: false, role: user.role }, process.env.JWT_SECRET!, { expiresIn: "180d", algorithm: "HS256" });
+  const cookieStore = await cookies();
+  cookieStore.set("yomimono_key", token, { httpOnly: true, secure: process.env.NODE_ENV === "production", sameSite: "lax", path: "/", maxAge: 180 * 24 * 60 * 60 });
+  return { success: true, slug: invite.club_slug };
+}
+
+export async function reviewClubMember(slug: string, memberId: string, status: "APPROVED" | "REJECTED" | "REVOKED"): Promise<Result> {
+  const context = await manager(slug);
+  if (!context) return { success: false, error: "Unauthorized" };
+  const member = await queryOne<{ id: string }>("SELECT id FROM reading_club_members WHERE id=$1 AND club_id=$2", [memberId, context.club.id]);
+  if (!member) return { success: false, error: "Member not found" };
+  await reviewMembership(memberId, status);
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
+  return { success: true };
+}
+
+export async function removeClubMember(slug: string, memberId: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context) return { success: false, error: "Unauthorized" };
+  const member = await queryOne<{ user_id: string; role: string }>("SELECT m.user_id,u.role FROM reading_club_members m INNER JOIN users u ON u.id=m.user_id WHERE m.id=$1 AND m.club_id=$2", [memberId, context.club.id]);
+  if (!member || member.user_id === context.club.ownerId) return { success: false, error: "Unauthorized" };
+  await reviewMembership(memberId, "REVOKED");
+  if (member.role === "GUEST") await execute("UPDATE users SET disabled_at=NOW() WHERE id=$1", [member.user_id]);
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
+  return { success: true };
+}
+
+export async function createClubCycle(slug: string, input: { title: string; voteClosesAt?: string }): Promise<Result & { cycleId?: string }> {
+  const context = await manager(slug);
+  const title = input.title.trim();
+  if (!context || context.club.status !== "ACTIVE" || !title) return { success: false, error: "Invalid cycle" };
+  const pendingCycle = await queryOne<{ id: string }>("SELECT id FROM reading_club_cycles WHERE club_id=$1 AND status IN ('DRAFT','VOTING') LIMIT 1", [context.club.id]);
+  if (pendingCycle) return { success: false, error: "A cycle is already being prepared" };
+  const date = input.voteClosesAt ? new Date(`${input.voteClosesAt}T23:59:59.999`) : null;
+  if (date && (Number.isNaN(date.getTime()) || date <= new Date())) return { success: false, error: "Choose a future voting deadline" };
+  const cycle = await createCycleRecord(context.club.id, title, date);
+  return { success: true, cycleId: cycle.id };
+}
+
+export async function confirmClubCandidates(slug: string, cycleId: string, candidates: Array<{ sourceType: ClubSourceType; sourceId: string }>): Promise<Result> {
+  const context = await manager(slug);
+  const uniqueCandidates = Array.from(new Map(candidates.filter((candidate) => candidate.sourceId && (candidate.sourceType === "LIBRARY_SERIES" || candidate.sourceType === "BOOK_SERIES")).map((candidate) => [`${candidate.sourceType}:${candidate.sourceId}`, candidate])).values());
+  if (!context || context.club.status !== "ACTIVE" || !(await belongsToClub(cycleId, context.club.id)) || !uniqueCandidates.length) return { success: false, error: "Choose at least one work" };
+  const cycle = await queryOne<{ status: string; vote_closes_at: Date | null }>("SELECT status,vote_closes_at FROM reading_club_cycles WHERE id=$1", [cycleId]);
+  if (!cycle || cycle.status !== "DRAFT") return { success: false, error: "This cycle cannot be changed" };
+  if (uniqueCandidates.length === 1) {
+    await execute("UPDATE reading_club_cycles SET status='COMPLETED', completed_at=NOW(), updated_at=NOW() WHERE club_id=$1 AND status='READING' AND id<>$2", [context.club.id, cycleId]);
+    await selectCycleWork(cycleId, uniqueCandidates[0].sourceType, uniqueCandidates[0].sourceId);
+  } else {
+    if (!cycle.vote_closes_at || cycle.vote_closes_at <= new Date()) return { success: false, error: "Choose a future voting deadline" };
+    await replaceCycleCandidates(cycleId, uniqueCandidates);
+    await execute("UPDATE reading_club_cycles SET status='VOTING', updated_at=NOW() WHERE id=$1", [cycleId]);
+  }
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
+  return { success: true };
+}
+
+export async function removeClubCandidate(slug: string, cycleId: string, candidateId: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context || context.club.status !== "ACTIVE" || !(await belongsToClub(cycleId, context.club.id))) return { success: false, error: "Unauthorized" };
+  const cycle = await queryOne<{ status: string }>("SELECT status FROM reading_club_cycles WHERE id=$1", [cycleId]);
+  if (!cycle || cycle.status !== "VOTING") return { success: false, error: "Candidates can only be removed from an open vote" };
+  await removeCandidateRecord(candidateId, cycleId);
+  const remaining = await queryOne<{ count: string }>("SELECT COUNT(*)::text AS count FROM reading_club_candidates WHERE cycle_id=$1", [cycleId]);
+  if (Number(remaining?.count ?? 0) < 2) {
+    await replaceCycleCandidates(cycleId, []);
+    await execute("UPDATE reading_club_cycles SET status='DRAFT', updated_at=NOW() WHERE id=$1", [cycleId]);
+  }
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
+  return { success: true };
+}
+
+export async function addClubCandidate(slug: string, cycleId: string, sourceType: ClubSourceType, sourceId: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context || context.club.status !== "ACTIVE" || !sourceId || !(await belongsToClub(cycleId, context.club.id))) return { success: false, error: "Unauthorized" };
+  const cycle = await queryOne<{ status: string; vote_closes_at: Date | null }>("SELECT status,vote_closes_at FROM reading_club_cycles WHERE id=$1", [cycleId]);
+  if (cycle?.status !== "VOTING" || (cycle.vote_closes_at && cycle.vote_closes_at <= new Date())) return { success: false, error: "Candidates can only be added to an open vote" };
+  await addCandidateRecord(cycleId, sourceType, sourceId);
+  return { success: true };
+}
+
+export async function selectClubWork(slug: string, cycleId: string, sourceType: ClubSourceType, sourceId: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context || context.club.status !== "ACTIVE" || !sourceId || !(await belongsToClub(cycleId, context.club.id))) return { success: false, error: "Unauthorized" };
+  const cycle = await queryOne<{ status: string; vote_closes_at: Date | null }>("SELECT status,vote_closes_at FROM reading_club_cycles WHERE id=$1", [cycleId]);
+  if (!cycle || (cycle.status === "VOTING" && (!cycle.vote_closes_at || cycle.vote_closes_at > new Date()))) return { success: false, error: "Voting must be closed before choosing a work" };
+  if (cycle.status === "VOTING") {
+    const candidate = await queryOne<{ id: string }>("SELECT id FROM reading_club_candidates WHERE cycle_id=$1 AND source_type=$2 AND source_id=$3", [cycleId, sourceType, sourceId]);
+    if (!candidate) return { success: false, error: "Choose one of the voting candidates" };
+  }
+  await execute("UPDATE reading_club_cycles SET status='COMPLETED', completed_at=NOW(), updated_at=NOW() WHERE club_id=$1 AND status='READING' AND id<>$2", [context.club.id, cycleId]);
+  await selectCycleWork(cycleId, sourceType, sourceId);
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
+  return { success: true };
+}
+
+export async function addClubMilestone(slug: string, cycleId: string, input: { label: string; position: number; targetDate: string }): Promise<Result> {
+  const context = await manager(slug);
+  if (!context || context.club.status !== "ACTIVE" || !(await belongsToClub(cycleId, context.club.id)) || !input.label.trim() || input.position < 1 || input.position > 100) return { success: false, error: "Invalid milestone" };
+  await addMilestoneRecord(cycleId, input.position, input.label.trim(), input.targetDate);
+  return { success: true };
+}
+
+export async function completeClubCycle(slug: string, cycleId: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context || context.club.status !== "ACTIVE" || !(await belongsToClub(cycleId, context.club.id))) return { success: false, error: "Unauthorized" };
+  await execute("UPDATE reading_club_cycles SET status='COMPLETED', completed_at=NOW(), updated_at=NOW() WHERE id=$1 AND status='READING'", [cycleId]);
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
+  return { success: true };
+}
+
+export async function voteForClubCandidate(slug: string, cycleId: string, candidateId: string): Promise<Result> {
+  const user = await verifySession();
+  const club = await findClubBySlug(slug);
+  if (!user || !club || !(await canAccessClub(club, user.id, user.isAdmin))) return { success: false, error: "Unauthorized" };
+  const member = await getMembership(club.id, user.id);
+  if (!member || member.status !== "APPROVED") return { success: false, error: "Membership pending" };
+  const cycle = await queryOne<{ status: string; vote_closes_at: Date | null; club_id: string }>("SELECT status,vote_closes_at,club_id FROM reading_club_cycles WHERE id=$1", [cycleId]);
+  if (!cycle || cycle.club_id !== club.id || cycle.status !== "VOTING" || (cycle.vote_closes_at && cycle.vote_closes_at <= new Date())) return { success: false, error: "Voting is closed" };
+  await castVoteRecord(cycleId, candidateId, member.id);
+  return { success: true };
+}
+
+export async function archiveClub(slug: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context) return { success: false, error: "Unauthorized" };
+  await archiveClubRecord(context.club.id);
+  revalidatePath("/", "layout");
+  return { success: true };
+}
+
+export async function deleteClub(slug: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context) return { success: false, error: "Unauthorized" };
+  await deleteClubRecord(context.club.id);
+  revalidatePath("/", "layout");
+  return { success: true };
+}

package/dist/src/actions/favorites.ts

@@ -5,6 +5,7 @@ import {
   upsertSeriesFavorite,
   upsertVolumeProgress,
 } from "@/lib/db/reading";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
 
 interface ToggleSeriesFavoriteParams {
   seriesId: string | number | null | undefined;
@@ -31,6 +32,7 @@ export async function toggleSeriesFavorite({ seriesId, favorite }: ToggleSeriesF
         ? ""
         : String(seriesId);
     const normalizedFavorite = favorite === true || String(favorite) === "true";
+    if (user.role === "GUEST") return { error: "Forbidden", status: 403 };
 
     if (
       typeof normalizedSeriesId !== "string" ||
@@ -76,6 +78,7 @@ export async function toggleVolumeFavorite({ volumeId, favorite }: ToggleVolumeF
     ) {
       return { error: "Invalid payload", status: 400 };
     }
+    if (!(await canAccessLibraryVolume(user, normalizedVolumeId))) return { error: "Forbidden", status: 403 };
 
     await upsertVolumeProgress(user.id, normalizedVolumeId, {
       isFavorite: normalizedFavorite,

package/dist/src/actions/progress.ts

@@ -9,6 +9,8 @@ import {
   upsertVolumeProgress,
 } from "@/lib/db/reading";
 import { findVolumeBySlug } from "@/lib/db/library";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
+import { recordClubProgressActivities } from "@/lib/db/clubs";
 
 interface SyncProgressParams {
   volumeSlug: string;
@@ -43,6 +45,7 @@ export async function syncReadingProgress({
     if (!volume) {
       return { error: "Volume not found", status: 404 };
     }
+    if (!(await canAccessLibraryVolume(user, volume.id))) return { error: "Forbidden", status: 403 };
 
     const userId = user.id;
     const volumeId = volume.id;
@@ -55,6 +58,7 @@ export async function syncReadingProgress({
       lastReadAt: new Date(lastReadAt),
       isRead: isNowRead,
     });
+    await recordClubProgressActivities(userId, "LIBRARY_SERIES", volume.seriesId);
 
     if (isNowRead) {
       await createReadingEntryRecord(userId, volumeId, date);

package/dist/src/actions/read.ts

@@ -7,6 +7,9 @@ import {
   upsertVolumeProgress,
 } from "@/lib/db/reading";
 import { syncFirstRead } from "@/actions/readingHistory";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
+import { queryOne } from "@/lib/db/query";
+import { recordClubProgressActivities } from "@/lib/db/clubs";
 
 interface UpdateReadStateParams {
   volumeId: string;
@@ -57,6 +60,7 @@ export async function updateReadState({
       totalPages: normalizedTotalPages,
       lastReadAt: normalizedRead ? new Date(lastReadAt || Date.now()) : null,
     };
+    if (!(await canAccessLibraryVolume(user, normalizedVolumeId))) return { error: "Forbidden", status: 403 };
 
     await upsertVolumeProgress(user.id, normalizedVolumeId, {
       isRead: updatePayload.isRead,
@@ -64,6 +68,8 @@ export async function updateReadState({
       totalPages: updatePayload.totalPages,
       lastReadAt: updatePayload.lastReadAt,
     });
+    const volume = await queryOne<{ series_id: string }>("SELECT series_id FROM library_volumes WHERE id=$1", [normalizedVolumeId]);
+    if (volume) await recordClubProgressActivities(user.id, "LIBRARY_SERIES", volume.series_id);
 
     if (normalizedRead && typeof firstRead === "string") {
       await createReadingEntryRecord(user.id, normalizedVolumeId, firstRead);

package/dist/src/actions/reader.ts

@@ -14,6 +14,7 @@ import { queryOne } from "@/lib/db/query";
 import { extractImagesCbz } from "@/lib/reader/manga/cbz";
 import { extractImagesCbr } from "@/lib/reader/manga/cbr";
 import type { StorageProvider } from "@/lib/types";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
 
 type Extractor = (
   volume: LibraryVolume,
@@ -57,6 +58,7 @@ export async function getMangaImages({ slug }: { slug: string }) {
     if (!volume) {
       return { error: "Volume not found", status: 404 };
     }
+    if (!(await canAccessLibraryVolume(user, volume.id))) return { error: "Forbidden", status: 403 };
 
     const extractor = getExtractorForFile(volume.fullPath);
 
@@ -100,6 +102,7 @@ export async function getReadingProgress({ slug }: { slug: string }) {
     if (!volume) {
       return { error: "Volume not found", status: 404 };
     }
+    if (!(await canAccessLibraryVolume(user, volume.id))) return { error: "Forbidden", status: 403 };
 
     const progress = await findVolumeProgress(user.id, volume.id);
 

package/dist/src/app/[lang]/clubs/[slug]/page.tsx

@@ -0,0 +1,25 @@
+import { notFound, redirect } from "next/navigation";
+import ClubDashboard from "@/components/clubs/ClubDashboard";
+import { verifySession } from "@/lib/auth/verifySession";
+import { canAccessClub, canManageClub, findClubBySlug, getClubDashboard, listClubWorks, listCycleCandidates, listCycleMilestones, listSelectedCycleVolumes } from "@/lib/db/clubs";
+import { getDictionary } from "@/lib/i18n/Dictionary";
+import type { Locale } from "@/lib/types";
+
+export default async function ClubPage({ params }: { params: Promise<{ lang: string; slug: string }> }) {
+  const { lang, slug } = await params;
+  const user = await verifySession();
+  if (!user) redirect(`/${lang}/login`);
+  const club = await findClubBySlug(slug);
+  if (!club) notFound();
+  if (!(await canAccessClub(club, user.id, user.isAdmin))) redirect(`/${lang}/clubs`);
+  const [dashboard, isManager, intl] = await Promise.all([getClubDashboard(club, user.id), canManageClub(club, user.id, user.isAdmin), getDictionary(lang as Locale)]);
+  const active = dashboard.cycles.find((cycle) => cycle.status === "READING");
+  const voting = dashboard.cycles.find((cycle) => cycle.status === "VOTING");
+  const [works, activeCandidates, milestones, readingVolumes] = await Promise.all([
+    isManager ? listClubWorks() : Promise.resolve([]),
+    voting ? listCycleCandidates(voting.id) : Promise.resolve([]),
+    active ? listCycleMilestones(active.id) : Promise.resolve([]),
+    listSelectedCycleVolumes(active ?? null),
+  ]);
+  return <ClubDashboard club={club} cycles={dashboard.cycles} members={dashboard.members} activities={dashboard.activities} activeCandidates={activeCandidates} milestones={milestones} works={works} readingVolumes={readingVolumes} isManager={isManager} lang={lang} intl={intl} />;
+}

package/dist/src/app/[lang]/clubs/[slug]/read/[kind]/[volume]/page.tsx

@@ -0,0 +1,30 @@
+import { notFound, redirect } from "next/navigation";
+import ClubReader from "@/components/clubs/ClubReader";
+import { verifySession } from "@/lib/auth/verifySession";
+import { canAccessClub, findClubBySlug, getClubDashboard, listSelectedCycleVolumes } from "@/lib/db/clubs";
+import { findVolumeBySlug } from "@/lib/db/library";
+import { findBookVolumeBySlug } from "@/lib/db/books/library";
+import { getDictionary } from "@/lib/i18n/Dictionary";
+import type { Locale } from "@/lib/types";
+
+export default async function ClubReaderPage({ params }: { params: Promise<{ lang: string; slug: string; kind: string; volume: string }> }) {
+  const { lang, slug, kind, volume: volumeSlug } = await params;
+  if (kind !== "manga" && kind !== "books") notFound();
+  const user = await verifySession();
+  if (!user) redirect(`/${lang}/login`);
+  const club = await findClubBySlug(slug);
+  if (!club || !(await canAccessClub(club, user.id, user.isAdmin))) notFound();
+  const dashboard = await getClubDashboard(club, user.id);
+  const active = dashboard.cycles.find((cycle) => cycle.status === "READING");
+  const allowed = await listSelectedCycleVolumes(active ?? null);
+  if (!allowed.some((item) => item.slug === volumeSlug && item.kind === kind)) notFound();
+  const intl = await getDictionary(lang as Locale);
+  if (kind === "manga") {
+    const item = await findVolumeBySlug({ slug: volumeSlug });
+    if (!item) notFound();
+    return <ClubReader kind="manga" volume={{ id: item.id, slug: item.slug, title: item.title, mangaStyle: item.metadataObj?.mangaStyle }} intl={intl} />;
+  }
+  const item = await findBookVolumeBySlug(volumeSlug);
+  if (!item) notFound();
+  return <ClubReader kind="books" volume={{ id: item.id, slug: item.slug, title: item.title, layout: item.metadata.renditionLayout }} intl={intl} />;
+}

package/dist/src/app/[lang]/clubs/join/[token]/page.tsx

@@ -0,0 +1,15 @@
+import { notFound } from "next/navigation";
+import ClubInvite from "@/components/clubs/ClubInvite";
+import { verifySession } from "@/lib/auth/verifySession";
+import { findInviteByTokenHash } from "@/lib/db/clubs";
+import { createHash } from "node:crypto";
+import { getDictionary } from "@/lib/i18n/Dictionary";
+import type { Locale } from "@/lib/types";
+
+export default async function ClubInvitePage({ params }: { params: Promise<{ lang: string; token: string }> }) {
+  const { lang, token } = await params;
+  const invite = await findInviteByTokenHash(createHash("sha256").update(token).digest("hex"));
+  if (!invite || invite.club_status !== "ACTIVE") notFound();
+  const [user, intl] = await Promise.all([verifySession(), getDictionary(lang as Locale)]);
+  return <ClubInvite token={token} clubName={invite.club_name} lang={lang} signedIn={!!user} intl={intl} />;
+}

package/dist/src/app/[lang]/clubs/page.tsx

@@ -0,0 +1,14 @@
+import { redirect } from "next/navigation";
+import ClubList from "@/components/clubs/ClubList";
+import { verifySession } from "@/lib/auth/verifySession";
+import { listClubsForUser } from "@/lib/db/clubs";
+import { getDictionary } from "@/lib/i18n/Dictionary";
+import type { Locale } from "@/lib/types";
+
+export default async function ClubsPage({ params }: { params: Promise<{ lang: string }> }) {
+  const { lang } = await params;
+  const user = await verifySession();
+  if (!user) redirect(`/${lang}/login`);
+  const [clubs, intl] = await Promise.all([listClubsForUser(user.id), getDictionary(lang as Locale)]);
+  return <ClubList clubs={clubs} lang={lang} canCreate={user.role !== "GUEST"} intl={intl} />;
+}

package/dist/src/app/api/library/books/cover/[...slug]/route.ts

@@ -2,6 +2,8 @@ import { NextResponse } from "next/server";
 import { findBookVolumeBySlug } from "@/lib/db/books/library";
 import { getEpubEntry } from "@/lib/books/epubParser";
 import { readBookFile } from "@/lib/books/storage";
+import { verifySession } from "@/lib/auth/verifySession";
+import { canAccessBookVolume } from "@/lib/clubs/access";
 
 export async function GET(_request: Request, { params }: { params: Promise<{ slug: string[] }> }) {
   const { slug: parts } = await params;
@@ -9,6 +11,8 @@ export async function GET(_request: Request, { params }: { params: Promise<{ slu
   if (!slug) return NextResponse.json({ error: "Missing book" }, { status: 400 });
   const volume = await findBookVolumeBySlug(slug);
   if (!volume?.metadata.coverPath) return NextResponse.json({ error: "Cover not found" }, { status: 404 });
+  const user = await verifySession();
+  if (!user || !(await canAccessBookVolume(user, volume.id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   const cover = getEpubEntry(await readBookFile(volume.fullPath), volume.metadata.coverPath);
   if (!cover) return NextResponse.json({ error: "Cover not found" }, { status: 404 });
   const extension = volume.metadata.coverPath.split(".").pop()?.toLowerCase();

package/dist/src/app/api/library/manga/cover/[...slug]/route.ts

@@ -4,6 +4,8 @@ import { GetObjectCommand } from "@aws-sdk/client-s3";
 import r2Client, { R2_BUCKET } from "@/lib/r2";
 import type { NextRequest } from "next/server";
 import { findVolumeBySlugBasic } from "@/lib/db/ingestion";
+import { verifySession } from "@/lib/auth/verifySession";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
 
 const LIB_PROVIDER = process.env.LIB_PROVIDER || "local";
 
@@ -25,6 +27,8 @@ export async function GET(
   if (!volume || !volume.coverImage || !volume.seriesPath) {
     return servePlaceholder();
   }
+  const user = await verifySession();
+  if (!user || !(await canAccessLibraryVolume(user, volume.id))) return new Response("Forbidden", { status: 403 });
 
   try {
     if (LIB_PROVIDER === "cloud") {

package/dist/src/app/api/offline/library/[section]/series/[slug]/route.ts

@@ -4,6 +4,7 @@ import { listVolumeProgressByIds } from "@/lib/db/library";
 import { listVolumes, findSeriesBySlugBasic } from "@/lib/db/library";
 import { getLibrarySection, getLibraryScope, type LibrarySection } from "@/lib/librarySection";
 import { getMangaCoverUrl } from "@/lib/mangaCover";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
 
 export async function GET(
   _request: Request,
@@ -22,6 +23,7 @@ export async function GET(
   if (!volumes.length || getLibrarySection(volumes[0].series.librarySection) !== section) {
     return NextResponse.json({ error: "Series not found" }, { status: 404 });
   }
+  if (!(await canAccessLibraryVolume(user, volumes[0].id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   const progressById = await listVolumeProgressByIds(user.id, volumes.map((volume) => volume.id));
 
   return NextResponse.json({

package/dist/src/app/api/offline/library/[section]/volume/[slug]/route.ts

@@ -4,6 +4,7 @@ import { findVolumeProgress } from "@/lib/db/reading";
 import { findVolumeBySlug } from "@/lib/db/library";
 import { getLibrarySection, type LibrarySection } from "@/lib/librarySection";
 import { getMangaCoverUrl } from "@/lib/mangaCover";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
 
 function metadata(value: Awaited<ReturnType<typeof findVolumeBySlug>>) {
   const source = value?.metadataObj;
@@ -27,6 +28,7 @@ export async function GET(
   if (!volume || getLibrarySection(volume.series.librarySection) !== section) {
     return NextResponse.json({ error: "Volume not found" }, { status: 404 });
   }
+  if (!(await canAccessLibraryVolume(user, volume.id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   const progress = await findVolumeProgress(user.id, volume.id);
   const resolvedSection = section as LibrarySection;
 

package/dist/src/app/api/reader/books/[slug]/annotations/route.ts

@@ -2,12 +2,14 @@ import { NextResponse } from "next/server";
 import { verifySession } from "@/lib/auth/verifySession";
 import { findBookVolumeBySlug } from "@/lib/db/books/library";
 import { createBookAnnotation, deleteBookAnnotation, listBookAnnotations, updateBookAnnotationNote } from "@/lib/db/books/reading";
+import { canAccessBookVolume } from "@/lib/clubs/access";
 
 export async function GET(_request: Request, { params }: { params: Promise<{ slug: string }> }) {
   const user = await verifySession();
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const volume = await findBookVolumeBySlug((await params).slug);
   if (!volume) return NextResponse.json({ error: "Book not found" }, { status: 404 });
+  if (!(await canAccessBookVolume(user, volume.id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   return NextResponse.json(await listBookAnnotations(user.id, volume.id));
 }
 
@@ -17,6 +19,7 @@ export async function POST(request: Request, { params }: { params: Promise<{ slu
   const volume = await findBookVolumeBySlug((await params).slug);
   const body = await request.json() as { cfiRange?: string; excerpt?: string; note?: string; color?: string };
   if (!volume || !body.cfiRange) return NextResponse.json({ error: "Invalid annotation" }, { status: 400 });
+  if (!(await canAccessBookVolume(user, volume.id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   return NextResponse.json(await createBookAnnotation(user.id, volume.id, {
     cfiRange: body.cfiRange, excerpt: body.excerpt ?? null, note: body.note ?? null,
     color: ["lilah", "yellow", "green", "blue", "pink"].includes(body.color ?? "") ? body.color! : "lilah",

package/dist/src/app/api/reader/books/[slug]/bookmarks/route.ts

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { verifySession } from "@/lib/auth/verifySession";
 import { findBookVolumeBySlug } from "@/lib/db/books/library";
 import { createBookBookmark, deleteBookBookmark, listBookBookmarks } from "@/lib/db/books/reading";
+import { canAccessBookVolume } from "@/lib/clubs/access";
 
 async function getVolume(slug: string) { return findBookVolumeBySlug(slug); }
 
@@ -10,6 +11,7 @@ export async function GET(_request: Request, { params }: { params: Promise<{ slu
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const volume = await getVolume((await params).slug);
   if (!volume) return NextResponse.json({ error: "Book not found" }, { status: 404 });
+  if (!(await canAccessBookVolume(user, volume.id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   return NextResponse.json(await listBookBookmarks(user.id, volume.id));
 }
 
@@ -19,6 +21,7 @@ export async function POST(request: Request, { params }: { params: Promise<{ slu
   const volume = await getVolume((await params).slug);
   const body = await request.json() as { cfi?: string; label?: string; chapterLabel?: string };
   if (!volume || !body.cfi) return NextResponse.json({ error: "Invalid bookmark" }, { status: 400 });
+  if (!(await canAccessBookVolume(user, volume.id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   return NextResponse.json(await createBookBookmark(user.id, volume.id, { cfi: body.cfi, label: body.label ?? null, chapterLabel: body.chapterLabel ?? null }));
 }
 

package/dist/src/app/api/reader/books/[slug]/file/route.ts

@@ -1,14 +1,16 @@
 import { NextResponse } from "next/server";
 import { verifySession } from "@/lib/auth/verifySession";
-import { findBookFileBySlug } from "@/lib/db/books/library";
+import { findBookVolumeBySlug } from "@/lib/db/books/library";
 import { readBookFile } from "@/lib/books/storage";
+import { canAccessBookVolume } from "@/lib/clubs/access";
 
 export async function GET(_request: Request, { params }: { params: Promise<{ slug: string }> }) {
   const user = await verifySession();
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const { slug } = await params;
-  const volume = await findBookFileBySlug(slug);
+  const volume = await findBookVolumeBySlug(slug);
   if (!volume) return NextResponse.json({ error: "Book not found" }, { status: 404 });
+  if (!(await canAccessBookVolume(user, volume.id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   const file = await readBookFile(volume.fullPath);
   return new NextResponse(new Uint8Array(file), {
     headers: {

package/dist/src/app/api/reader/books/[slug]/progress/route.ts

@@ -2,12 +2,15 @@ import { NextResponse } from "next/server";
 import { verifySession } from "@/lib/auth/verifySession";
 import { findBookVolumeBySlug } from "@/lib/db/books/library";
 import { findBookProgress, upsertBookProgress } from "@/lib/db/books/reading";
+import { canAccessBookVolume } from "@/lib/clubs/access";
+import { recordClubProgressActivities } from "@/lib/db/clubs";
 
 export async function GET(_request: Request, { params }: { params: Promise<{ slug: string }> }) {
   const user = await verifySession();
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const volume = await findBookVolumeBySlug((await params).slug);
   if (!volume) return NextResponse.json({ error: "Book not found" }, { status: 404 });
+  if (!(await canAccessBookVolume(user, volume.id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   return NextResponse.json(await findBookProgress(user.id, volume.id));
 }
 
@@ -16,6 +19,7 @@ export async function PUT(request: Request, { params }: { params: Promise<{ slug
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const volume = await findBookVolumeBySlug((await params).slug);
   if (!volume) return NextResponse.json({ error: "Book not found" }, { status: 404 });
+  if (!(await canAccessBookVolume(user, volume.id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   const body = await request.json() as Record<string, unknown>;
   const progression = typeof body.progression === "number" ? Math.min(1, Math.max(0, body.progression)) : undefined;
   const readingDate = typeof body.readingDate === "string" && /^\d{4}-\d{2}-\d{2}$/.test(body.readingDate)
@@ -34,5 +38,6 @@ export async function PUT(request: Request, { params }: { params: Promise<{ slug
     lastReadAt: hasReadingLocation || isRead === true ? new Date() : undefined,
     readingDate,
   });
+  await recordClubProgressActivities(user.id, "BOOK_SERIES", volume.series.id);
   return NextResponse.json(result);
 }

package/dist/src/app/api/reader/books/[slug]/state/route.ts

@@ -6,6 +6,7 @@ import {
   listBookAnnotations,
   listBookBookmarks,
 } from "@/lib/db/books/reading";
+import { canAccessBookVolume } from "@/lib/clubs/access";
 
 export async function GET(_request: Request, { params }: { params: Promise<{ slug: string }> }) {
   const user = await verifySession();
@@ -13,6 +14,7 @@ export async function GET(_request: Request, { params }: { params: Promise<{ slu
 
   const volume = await findBookVolumeBySlug((await params).slug);
   if (!volume) return NextResponse.json({ error: "Book not found" }, { status: 404 });
+  if (!(await canAccessBookVolume(user, volume.id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
 
   const [progress, bookmarks, annotations] = await Promise.all([
     findBookProgress(user.id, volume.id),