@itsmrtr/bunkoshelf 1.18.5 → 1.19.1

package/dist/src/actions/clubs.ts

@@ -8,6 +8,10 @@ import { createId } from "@paralleldrive/cuid2";
 import { verifySession } from "@/lib/auth/verifySession";
 import { createUserRecord, usernameExists } from "@/lib/db/users";
 import { execute, queryOne } from "@/lib/db/query";
+import { canClubMembersAccessWork, canUserAccessClubReading } from "@/lib/clubs/access";
+import { getDictionary } from "@/lib/i18n/Dictionary";
+import { sendPushToUser } from "@/lib/push";
+import type { Locale } from "@/lib/types";
 import {
   addCandidateRecord,
   addMilestoneRecord,
@@ -17,11 +21,14 @@ import {
   castVoteRecord,
   createClubRecord,
   createCycleRecord,
+  deleteGuestWithoutActiveClubs,
   deleteClubRecord,
   findClubBySlug,
   findFixedClubInvite,
   getMembership,
+  inviteMembership,
   removeCandidateRecord,
+  recordCycleMilestoneActivities,
   replaceCycleCandidates,
   requestMembership,
   reviewMembership,
@@ -35,6 +42,19 @@ function slugify(value: string) {
   return value.toLowerCase().trim().normalize("NFD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48);
 }
 
+async function getGuestUsername(name: string, lastname: string): Promise<string | null> {
+  const base = slugify(`${name}${lastname}`).slice(0, 32);
+  if (base.length < 3) return null;
+
+  for (let suffixNumber = 1; suffixNumber <= 100; suffixNumber += 1) {
+    const suffix = suffixNumber === 1 ? "" : String(suffixNumber);
+    const username = `${base.slice(0, 32 - suffix.length)}${suffix}`;
+    if (!(await usernameExists(username))) return username;
+  }
+
+  return null;
+}
+
 async function manager(slug: string) {
   const user = await verifySession();
   const club = await findClubBySlug(slug);
@@ -64,7 +84,6 @@ export async function joinClubWithSession(token: string): Promise<Result & { slu
   const user = await verifySession();
   const invite = await findFixedClubInvite(token);
   if (!user || !invite || invite.club_status !== "ACTIVE") return { success: false, error: "Invalid invitation" };
-  if (user.role === "GUEST") return { success: false, error: "Guest accounts are limited to their club" };
   await requestMembership(invite.club_id, user.id);
   return { success: true, slug: invite.club_slug };
 }
@@ -79,27 +98,43 @@ export async function requestToJoinClub(slug: string): Promise<Result> {
   return { success: true };
 }
 
-export async function joinClubAsGuest(input: { token: string; username: string; password: string }): Promise<Result & { slug?: string }> {
+export async function joinClubAsGuest(input: { token: string; name: string; lastname: string; password: string }): Promise<Result & { slug?: string }> {
   const invite = await findFixedClubInvite(input.token);
-  const username = input.username.trim().toLowerCase().replace(/\s+/g, "");
+  const name = input.name.trim();
+  const lastname = input.lastname.trim();
   if (!invite || invite.club_status !== "ACTIVE") return { success: false, error: "Invalid invitation" };
-  if (!/^[a-zA-Z0-9_-]{3,32}$/.test(username) || input.password.length < 8) return { success: false, error: "Use a name of 3–32 characters and a password of at least 8 characters" };
-  if (await usernameExists(username)) return { success: false, error: "That name is already in use" };
-  const user = await createUserRecord({ username, password: await bcrypt.hash(input.password, 10), role: "GUEST", name: username });
-  await execute("INSERT INTO reading_club_guest_accounts (user_id,club_id) VALUES ($1,$2)", [user.id, invite.club_id]);
+  if (!name || !lastname) return { success: false, error: "guestNameRequired" };
+  if (input.password.length < 8) return { success: false, error: "guestPasswordTooShort" };
+  const username = await getGuestUsername(name, lastname);
+  if (!username) return { success: false, error: "guestUsernameInvalid" };
+  const user = await createUserRecord({ username, password: await bcrypt.hash(input.password, 10), role: "GUEST", name, lastname });
   await requestMembership(invite.club_id, user.id);
   const token = jwt.sign({ id: user.id, username: user.username, isAdmin: false, role: user.role }, process.env.JWT_SECRET!, { expiresIn: "180d", algorithm: "HS256" });
   const cookieStore = await cookies();
   cookieStore.set("yomimono_key", token, { httpOnly: true, secure: process.env.NODE_ENV === "production", sameSite: "lax", path: "/", maxAge: 180 * 24 * 60 * 60 });
+  revalidatePath("/es/settings");
+  revalidatePath("/en/settings");
+  revalidatePath("/", "layout");
   return { success: true, slug: invite.club_slug };
 }
 
 export async function reviewClubMember(slug: string, memberId: string, status: "APPROVED" | "REJECTED" | "REVOKED"): Promise<Result> {
   const context = await manager(slug);
   if (!context) return { success: false, error: "Unauthorized" };
-  const member = await queryOne<{ id: string }>("SELECT id FROM reading_club_members WHERE id=$1 AND club_id=$2", [memberId, context.club.id]);
+  const member = await queryOne<{ id: string; user_id: string; role: string }>(`SELECT m.id,m.user_id,u.role
+    FROM reading_club_members m
+    INNER JOIN users u ON u.id=m.user_id
+    WHERE m.id=$1 AND m.club_id=$2`, [memberId, context.club.id]);
   if (!member) return { success: false, error: "Member not found" };
+  if (status === "APPROVED" && !(await canUserAccessClubReading(member.user_id, context.club.id))) {
+    return { success: false, error: "clubReadingRestricted" };
+  }
   await reviewMembership(memberId, status);
+  if (status === "APPROVED") {
+    const activeCycle = await queryOne<{ id: string }>("SELECT id FROM reading_club_cycles WHERE club_id=$1 AND status='READING'", [context.club.id]);
+    if (activeCycle) await recordCycleMilestoneActivities(activeCycle.id);
+  }
+  if (member.role === "GUEST") await deleteGuestWithoutActiveClubs(member.user_id);
   revalidatePath(`/es/clubs/${slug}`);
   revalidatePath(`/en/clubs/${slug}`);
   return { success: true };
@@ -111,12 +146,51 @@ export async function removeClubMember(slug: string, memberId: string): Promise<
   const member = await queryOne<{ user_id: string; role: string }>("SELECT m.user_id,u.role FROM reading_club_members m INNER JOIN users u ON u.id=m.user_id WHERE m.id=$1 AND m.club_id=$2", [memberId, context.club.id]);
   if (!member || member.user_id === context.club.ownerId) return { success: false, error: "Unauthorized" };
   await reviewMembership(memberId, "REVOKED");
-  if (member.role === "GUEST") await execute("UPDATE users SET disabled_at=NOW() WHERE id=$1", [member.user_id]);
+  if (member.role === "GUEST") await deleteGuestWithoutActiveClubs(member.user_id);
   revalidatePath(`/es/clubs/${slug}`);
   revalidatePath(`/en/clubs/${slug}`);
   return { success: true };
 }
 
+export async function inviteClubMember(slug: string, userId: string, lang: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context || context.club.status !== "ACTIVE" || !userId) return { success: false, error: "Unauthorized" };
+  const user = await queryOne<{ id: string; role: string }>("SELECT id,role FROM users WHERE id=$1 AND disabled_at IS NULL", [userId]);
+  if (!user || user.role === "GUEST") return { success: false, error: "User not found" };
+  if (!(await canUserAccessClubReading(user.id, context.club.id))) {
+    return { success: false, error: "clubReadingRestricted" };
+  }
+  await inviteMembership(context.club.id, user.id, context.user.id);
+  const locale: Locale = lang === "en" ? "en" : "es";
+  const labels = (await getDictionary(locale)).clubs as Record<string, string>;
+  try {
+    await sendPushToUser(user.id, {
+      title: labels.clubInvitationPushTitle,
+      body: labels.clubInvitationPushBody.replace("{club}", context.club.name),
+      url: `/${locale}/clubs`,
+    });
+  } catch (error) {
+    console.error("Error sending club invitation push:", error);
+  }
+  revalidatePath(`/${locale}/clubs`);
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
+  return { success: true };
+}
+
+export async function acceptClubInvitation(slug: string): Promise<Result> {
+  const user = await verifySession();
+  const club = await findClubBySlug(slug);
+  if (!user || user.role === "GUEST" || !club || club.status !== "ACTIVE") return { success: false, error: "Unauthorized" };
+  const membership = await getMembership(club.id, user.id);
+  if (!membership || membership.status !== "PENDING" || !membership.invited_by_user_id) return { success: false, error: "Unauthorized" };
+  if (!(await canUserAccessClubReading(user.id, club.id))) return { success: false, error: "clubReadingRestricted" };
+  await reviewMembership(membership.id, "APPROVED");
+  revalidatePath(`/es/clubs`);
+  revalidatePath(`/en/clubs`);
+  return { success: true };
+}
+
 export async function createClubCycle(slug: string, input: { title: string; voteClosesAt?: string }): Promise<Result & { cycleId?: string }> {
   const context = await manager(slug);
   const title = input.title.trim();
@@ -135,6 +209,9 @@ export async function confirmClubCandidates(slug: string, cycleId: string, candi
   if (!context || context.club.status !== "ACTIVE" || !(await belongsToClub(cycleId, context.club.id)) || !uniqueCandidates.length) return { success: false, error: "Choose at least one work" };
   const cycle = await queryOne<{ status: string; vote_closes_at: Date | null }>("SELECT status,vote_closes_at FROM reading_club_cycles WHERE id=$1", [cycleId]);
   if (!cycle || cycle.status !== "DRAFT") return { success: false, error: "This cycle cannot be changed" };
+  if (!(await Promise.all(uniqueCandidates.map((candidate) => canClubMembersAccessWork(context.club.id, candidate.sourceType, candidate.sourceId)))).every(Boolean)) {
+    return { success: false, error: "clubWorkRestricted" };
+  }
   if (uniqueCandidates.length === 1) {
     await execute("UPDATE reading_club_cycles SET status='COMPLETED', completed_at=NOW(), updated_at=NOW() WHERE club_id=$1 AND status='READING' AND id<>$2", [context.club.id, cycleId]);
     await selectCycleWork(cycleId, uniqueCandidates[0].sourceType, uniqueCandidates[0].sourceId);
@@ -169,6 +246,9 @@ export async function addClubCandidate(slug: string, cycleId: string, sourceType
   if (!context || context.club.status !== "ACTIVE" || !sourceId || !(await belongsToClub(cycleId, context.club.id))) return { success: false, error: "Unauthorized" };
   const cycle = await queryOne<{ status: string; vote_closes_at: Date | null }>("SELECT status,vote_closes_at FROM reading_club_cycles WHERE id=$1", [cycleId]);
   if (cycle?.status !== "VOTING" || (cycle.vote_closes_at && cycle.vote_closes_at <= new Date())) return { success: false, error: "Candidates can only be added to an open vote" };
+  if (!(await canClubMembersAccessWork(context.club.id, sourceType, sourceId))) {
+    return { success: false, error: "clubWorkRestricted" };
+  }
   await addCandidateRecord(cycleId, sourceType, sourceId);
   return { success: true };
 }
@@ -178,6 +258,9 @@ export async function selectClubWork(slug: string, cycleId: string, sourceType:
   if (!context || context.club.status !== "ACTIVE" || !sourceId || !(await belongsToClub(cycleId, context.club.id))) return { success: false, error: "Unauthorized" };
   const cycle = await queryOne<{ status: string; vote_closes_at: Date | null }>("SELECT status,vote_closes_at FROM reading_club_cycles WHERE id=$1", [cycleId]);
   if (!cycle || (cycle.status === "VOTING" && (!cycle.vote_closes_at || cycle.vote_closes_at > new Date()))) return { success: false, error: "Voting must be closed before choosing a work" };
+  if (!(await canClubMembersAccessWork(context.club.id, sourceType, sourceId))) {
+    return { success: false, error: "clubWorkRestricted" };
+  }
   if (cycle.status === "VOTING") {
     const candidate = await queryOne<{ id: string }>("SELECT id FROM reading_club_candidates WHERE cycle_id=$1 AND source_type=$2 AND source_id=$3", [cycleId, sourceType, sourceId]);
     if (!candidate) return { success: false, error: "Choose one of the voting candidates" };
@@ -189,10 +272,27 @@ export async function selectClubWork(slug: string, cycleId: string, sourceType:
   return { success: true };
 }
 
-export async function addClubMilestone(slug: string, cycleId: string, input: { label: string; position: number; targetDate: string }): Promise<Result> {
+export async function addClubMilestone(slug: string, cycleId: string, input: { targetValue: number; targetDate: string }): Promise<Result> {
   const context = await manager(slug);
-  if (!context || context.club.status !== "ACTIVE" || !(await belongsToClub(cycleId, context.club.id)) || !input.label.trim() || input.position < 1 || input.position > 100) return { success: false, error: "Invalid milestone" };
-  await addMilestoneRecord(cycleId, input.position, input.label.trim(), input.targetDate);
+  if (!context || context.user.id !== context.club.ownerId || context.club.status !== "ACTIVE" || !(await belongsToClub(cycleId, context.club.id)) || !input.targetDate) return { success: false, error: "Invalid milestone" };
+  const cycle = await queryOne<{ status: string; selected_type: ClubSourceType | null; is_oneshot: boolean }>(`
+    SELECT c.status,c.selected_type,COALESCE(ls.is_oneshot,bs.is_oneshot,FALSE) AS is_oneshot
+    FROM reading_club_cycles c
+    LEFT JOIN library_series ls ON c.selected_type='LIBRARY_SERIES' AND ls.id=c.selected_id
+    LEFT JOIN book_series bs ON c.selected_type='BOOK_SERIES' AND bs.id=c.selected_id
+    WHERE c.id=$1`, [cycleId]);
+  if (!cycle || cycle.status !== "READING" || !cycle.selected_type || !Number.isFinite(input.targetValue) || input.targetValue < 1) return { success: false, error: "Invalid milestone" };
+  const targetKind = !cycle.is_oneshot
+    ? "VOLUME"
+    : cycle.selected_type === "BOOK_SERIES"
+      ? "PROGRESSION"
+      : "PAGE";
+  if ((targetKind === "VOLUME" || targetKind === "PAGE") && !Number.isInteger(input.targetValue)) return { success: false, error: "Invalid milestone" };
+  if (targetKind === "PROGRESSION" && input.targetValue > 100) return { success: false, error: "Invalid milestone" };
+  await addMilestoneRecord(cycleId, targetKind, input.targetValue, input.targetDate);
+  await recordCycleMilestoneActivities(cycleId);
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
   return { success: true };
 }
 

package/dist/src/actions/users.ts

@@ -107,6 +107,9 @@ export async function createUser({
     if (!isValidBirthDate(birthYear, birthMonth, birthDay, true)) {
       return { error: "Fecha de nacimiento inválida", status: 400 };
     }
+    if (role === "GUEST") {
+      return { error: "Las cuentas invitadas se crean desde los clubes", status: 400 };
+    }
 
     if (await usernameExists(username)) {
       return { error: "El nombre de usuario ya existe", status: 400 };
@@ -183,6 +186,14 @@ export async function adminUpdateUser({
       return { error: "El nombre de usuario ya existe", status: 400 };
     }
 
+    const currentUser = await findUserSessionById(id);
+    if (!currentUser) {
+      return { error: "Usuario no encontrado", status: 404 };
+    }
+    if (currentUser.role === "GUEST" || role === "GUEST") {
+      return { error: "Las cuentas invitadas se administran desde los clubes", status: 403 };
+    }
+
     const updatedUser = await updateUserRecord(id, {
       username,
       name: name || null,
@@ -252,6 +263,9 @@ export async function deleteUser({
     if (!userToDelete) {
       return { error: "Usuario no encontrado", status: 404 };
     }
+    if (userToDelete.role === "GUEST") {
+      return { error: "Las cuentas invitadas se administran desde los clubes", status: 403 };
+    }
 
     await deleteUserRecord(id);
 

package/dist/src/app/[lang]/clubs/[slug]/page.tsx

@@ -1,7 +1,7 @@
 import { notFound, redirect } from "next/navigation";
 import ClubDashboard from "@/components/clubs/ClubDashboard";
 import { verifySession } from "@/lib/auth/verifySession";
-import { canAccessClub, canManageClub, findClubBySlug, getClubDashboard, getFixedClubInviteToken, listClubWorks, listCycleCandidates, listCycleMilestones, listSelectedCycleVolumes } from "@/lib/db/clubs";
+import { canAccessClub, canManageClub, findClubBySlug, getClubDashboard, getFixedClubInviteToken, listClubUsers, listClubWorks, listCycleCandidates, listCycleMilestones, listSelectedCycleVolumes } from "@/lib/db/clubs";
 import { getDictionary } from "@/lib/i18n/Dictionary";
 import type { Locale } from "@/lib/types";
 
@@ -12,14 +12,16 @@ export default async function ClubPage({ params }: { params: Promise<{ lang: str
   const club = await findClubBySlug(slug);
   if (!club) notFound();
   if (!(await canAccessClub(club, user.id, user.isAdmin))) redirect(`/${lang}/clubs`);
+  const isOwner = club.ownerId === user.id;
   const [dashboard, isManager, intl] = await Promise.all([getClubDashboard(club, user.id), canManageClub(club, user.id, user.isAdmin), getDictionary(lang as Locale)]);
   const active = dashboard.cycles.find((cycle) => cycle.status === "READING");
   const voting = dashboard.cycles.find((cycle) => cycle.status === "VOTING");
-  const [works, activeCandidates, milestones, readingVolumes] = await Promise.all([
+  const [works, activeCandidates, milestones, readingVolumes, users] = await Promise.all([
     isManager ? listClubWorks() : Promise.resolve([]),
     voting ? listCycleCandidates(voting.id) : Promise.resolve([]),
     active ? listCycleMilestones(active.id) : Promise.resolve([]),
     listSelectedCycleVolumes(active ?? null),
+    isManager ? listClubUsers() : Promise.resolve([]),
   ]);
-  return <ClubDashboard club={club} cycles={dashboard.cycles} members={dashboard.members} activities={dashboard.activities} activeCandidates={activeCandidates} milestones={milestones} works={works} readingVolumes={readingVolumes} isManager={isManager} inviteToken={isManager ? getFixedClubInviteToken(club) : null} lang={lang} intl={intl} />;
+  return <ClubDashboard club={club} cycles={dashboard.cycles} members={dashboard.members} activities={dashboard.activities} activeCandidates={activeCandidates} milestones={milestones} works={works} readingVolumes={readingVolumes} users={users} isManager={isManager} isOwner={isOwner} inviteToken={isManager ? getFixedClubInviteToken(club) : null} lang={lang} intl={intl} />;
 }

package/dist/src/app/[lang]/clubs/[slug]/read/[kind]/[volume]/page.tsx

@@ -22,9 +22,9 @@ export default async function ClubReaderPage({ params }: { params: Promise<{ lan
   if (kind === "manga") {
     const item = await findVolumeBySlug({ slug: volumeSlug });
     if (!item) notFound();
-    return <ClubReader kind="manga" volume={{ id: item.id, slug: item.slug, title: item.title, mangaStyle: item.metadataObj?.mangaStyle }} intl={intl} />;
+    return <ClubReader kind="manga" volume={{ id: item.id, slug: item.slug, title: item.title, mangaStyle: item.metadataObj?.mangaStyle }} returnHref={`/${lang}/clubs/${slug}`} intl={intl} />;
   }
   const item = await findBookVolumeBySlug(volumeSlug);
   if (!item) notFound();
-  return <ClubReader kind="books" volume={{ id: item.id, slug: item.slug, title: item.title, layout: item.metadata.renditionLayout }} intl={intl} />;
+  return <ClubReader kind="books" volume={{ id: item.id, slug: item.slug, title: item.title, layout: item.metadata.renditionLayout }} returnHref={`/${lang}/clubs/${slug}`} intl={intl} />;
 }

package/dist/src/app/[lang]/layout.tsx

@@ -90,7 +90,8 @@ async function AppShell({
           versionData={versionData}
           libraryCounts={libraryCounts}
         />
-        <main className="min-h-0 w-full md:w-[65%] lg:w-[75%] xl:w-[79%] 2xl:w-[83%] flex flex-col overflow-y-auto overscroll-y-contain">
+        <main className="min-h-0 w-full md:w-[65%] lg:w-[75%] xl:w-[79%] 2xl:w-[83%] flex flex-col overflow-y-auto overscroll-y-none">
+          <div aria-hidden="true" className="pointer-events-none sticky top-0 z-[100] -mb-[max(1px,env(safe-area-inset-top))] h-[max(1px,env(safe-area-inset-top))] shrink-0 bg-black" />
           <PwaProvider userId={user?.id} contentVisibility={getContentVisibilityPolicy(user, appSettings.parentalControlEnabled, appSettings.parentalControlMode)}>
             <ToastProvider>
               <AlertDialogProvider
@@ -137,7 +138,7 @@ export default async function RootLayout({ children, params }: RootLayoutProps)
       </head>
 
       <body className="relative h-dvh overflow-hidden bg-black text-lg">
-        <div aria-hidden="true" className="pointer-events-none fixed top-0 right-0 left-0 z-[100] h-[env(safe-area-inset-top)] bg-black" />
+        <div aria-hidden="true" className="pointer-events-none fixed top-0 right-0 left-0 z-[100] h-[max(1px,env(safe-area-inset-top))] bg-black" />
         <div className="pointer-events-none fixed inset-0 z-0 bg-seigaiha-pattern-k opacity-50" />
 
         <Suspense

package/dist/src/app/globals.css

@@ -58,7 +58,7 @@ html {
 }
 
 body {
-  background: var(--color-background);
+  background: #000000;
   color: var(--color-sand);
   font-family: var(--font-sans);
 }