@jant/core 0.6.16 → 0.7.0

package/src/routes/auth/signin.tsx

@@ -14,6 +14,7 @@ import { SigninSchema } from "../../lib/schemas.js";
 import { buildPageTitle } from "../../lib/page-title.js";
 import { getI18n } from "../../i18n/index.js";
 import { getHostedControlPlaneSigninUrl } from "../../lib/hosted-signin.js";
+import { isCurrentSiteMember } from "../../middleware/auth.js";
 import { isSafeInternalRedirect, toPublicPath } from "../../lib/url.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
@@ -128,7 +129,10 @@ signinRoutes.get("/signin", async (c) => {
     ? rawRedirect
     : undefined;
 
-  if (c.var.isAuthenticated) {
+  // Membership, not merely a session: `requireAuth` sends non-members here, so
+  // reading `isAuthenticated` instead would send them straight back and the two
+  // would volley until the browser refused to follow another hop.
+  if (await isCurrentSiteMember(c)) {
     return c.redirect(
       toPublicPath(redirect ?? "/", c.var.appConfig.sitePathPrefix),
     );
@@ -144,14 +148,12 @@ signinRoutes.get("/signin", async (c) => {
   }
 
   const i18n = getI18n(c);
-  const isSetup = c.req.query("setup") !== undefined;
+  // No `?setup` counterpart: setup signs its new owner in on the spot and
+  // hands them straight to the next screen, so nobody arrives here from it.
   const isReset = c.req.query("reset") !== undefined;
-  let toast: { message: string } | undefined;
-  if (isSetup) {
-    toast = { message: "Account created. Sign in to get started." };
-  } else if (isReset) {
-    toast = { message: "Password reset. Sign in with your new password." };
-  }
+  const toast = isReset
+    ? { message: "Password reset. Sign in with your new password." }
+    : undefined;
 
   return c.html(
     <BaseLayout

package/src/routes/compose.tsx

@@ -89,6 +89,8 @@ composeRoutes.post("/", async (c) => {
       collectionIds: data.collectionIds,
       replyToId: data.replyToId,
       quietReply: data.quietReply,
+      language: data.language,
+      translationOfId: data.translationOfId,
       publishedAt: data.publishedAt,
     },
     data.attachments,
@@ -231,6 +233,9 @@ composeRoutes.post("/thread", async (c) => {
         collectionIds: index === 0 ? data.collectionIds : undefined,
         replyToId: index === 0 ? data.replyToId : undefined,
         quietReply: data.quietReply,
+        // Thread-level, so only the root states them; replies inherit.
+        language: index === 0 ? data.language : undefined,
+        translationOfId: index === 0 ? data.translationOfId : undefined,
         // Replies may carry their own date; when they don't, the service
         // inherits the root's rather than stamping "now".
         publishedAt: data.publishedAt,

package/src/routes/dash/__tests__/custom-urls-archive.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import { createTestApp } from "../../../__tests__/helpers/app.js";
+
+/**
+ * The archive custom URL is readable forever and creatable never.
+ *
+ * Hand-typing `format=note&title=none` into a settings text field is the
+ * problem smart collections replace. Removing it from the form is not the same
+ * as removing it — an endpoint that still accepts it has not stopped offering
+ * it — so the refusal lives in the schema and again in the service.
+ */
+describe("archive custom URLs", () => {
+  it("refuses to create one", async () => {
+    const { services } = createTestApp({ authenticated: true });
+
+    await expect(
+      services.customUrls.create({
+        path: "/notes-only",
+        targetType: "archive",
+        archiveQuery: "format=note",
+      }),
+    ).rejects.toThrow(/smart collection/i);
+  });
+
+  it("still reads, lists, and deletes one that already exists", async () => {
+    const { services } = createTestApp({ authenticated: true });
+
+    // How a real legacy row exists: written before the create path was closed.
+    const record = await services.paths.create({
+      path: "/notes-only",
+      kind: "archive",
+      archiveQuery: "format=note&title=none",
+    });
+
+    const listed = await services.customUrls.list();
+    expect(listed.map((entry) => entry.path)).toContain("notes-only");
+    expect(
+      listed.find((entry) => entry.path === "notes-only")?.targetType,
+    ).toBe("archive");
+
+    expect(await services.customUrls.delete(record.id)).toBe(true);
+    expect(await services.paths.getByPath("/notes-only")).toBeNull();
+  });
+});

package/src/routes/dash/__tests__/custom-urls-page.test.ts

@@ -0,0 +1,49 @@
+/**
+ * What the Custom URLs settings page shows for a legacy archive path.
+ *
+ * The row is the whole affordance: it prints the query the path holds, and its
+ * menu deletes. It deliberately offers no "turn into a smart collection" —
+ * that row *is* the registration of its own address, so the collection it would
+ * become could never be saved at the URL the offer was about.
+ */
+
+import { describe, expect, it } from "vitest";
+import { createTestApp } from "../../../__tests__/helpers/app.js";
+import { customUrlsRoutes } from "../custom-urls.js";
+
+function createCustomUrlsTestApp() {
+  const testApp = createTestApp({ authenticated: true });
+  const { app } = testApp;
+
+  app.use("*", async (c, next) => {
+    c.set("publicPath", c.req.path);
+    c.set("publicRequestUrl", c.req.url);
+    await next();
+  });
+
+  app.route("/settings/custom-urls", customUrlsRoutes);
+
+  return testApp;
+}
+
+describe("custom URLs settings page", () => {
+  it("shows a legacy archive path and offers only deletion", async () => {
+    const { app, services } = createCustomUrlsTestApp();
+
+    // How a real legacy row exists: written before the create path was closed.
+    await services.paths.create({
+      path: "/notes-only",
+      kind: "archive",
+      archiveQuery: "format=note&title=none",
+    });
+
+    const res = await app.request("/settings/custom-urls");
+    expect(res.status).toBe(200);
+
+    const html = await res.text();
+    expect(html).toContain("/notes-only");
+    expect(html).toContain("/archive?format=note&title=none");
+    expect(html).toContain('data-custom-url-action="delete"');
+    expect(html).not.toContain('data-custom-url-action="upgrade"');
+  });
+});

package/src/routes/dash/__tests__/delete-account.test.ts

@@ -0,0 +1,106 @@
+/**
+ * Tests for POST /settings/account/delete-account.
+ *
+ * The route is a POST returning a Datastar redirect, so it can be exercised
+ * end to end without the SSR setup the settings pages need.
+ */
+
+import { describe, expect, it, vi } from "vitest";
+import { Hono } from "hono";
+import { createI18n } from "../../../i18n/index.js";
+import { settingsRoutes } from "../settings.js";
+import type { Bindings } from "../../../types.js";
+import type { AppVariables } from "../../../types/app-context.js";
+
+type Env = { Bindings: Bindings; Variables: AppVariables };
+
+const CLEARED_SESSION_COOKIE =
+  "better-auth.session_token=; Path=/; Max-Age=0; HttpOnly";
+
+function createDeleteAccountTestApp() {
+  const calls: string[] = [];
+
+  const signOut = vi.fn(async () => {
+    calls.push("signOut");
+    return new Response(null, {
+      headers: { "Set-Cookie": CLEARED_SESSION_COOKIE },
+    });
+  });
+  const deleteAllData = vi.fn(async () => {
+    calls.push("deleteAllData");
+  });
+
+  const app = new Hono<Env>();
+  app.use("*", async (c, next) => {
+    c.env = {} as Bindings;
+    c.set("auth", { api: { signOut } } as unknown as AppVariables["auth"]);
+    c.set("services", {
+      auth: {
+        validateDeleteCsrfToken: async (_token: string, sessionId: string) =>
+          sessionId === "ses_test",
+        deleteAllData,
+      },
+    } as unknown as AppVariables["services"]);
+    c.set("storage", null);
+    c.set("session", {
+      session: { id: "ses_test" },
+      user: { id: "usr_test" },
+    } as AppVariables["session"]);
+    c.set("isAuthenticated", true);
+    c.set("currentSite", {
+      createdAt: 0,
+      id: "sit_test",
+      key: "default",
+      status: "active",
+      updatedAt: 0,
+    });
+    c.set("appConfig", {
+      siteName: "Jant",
+      sitePathPrefix: "",
+    } as AppVariables["appConfig"]);
+    c.set("lang", "en");
+    c.set("i18n", createI18n("en"));
+    await next();
+  });
+  app.route("/settings", settingsRoutes);
+
+  return { app, calls, signOut, deleteAllData };
+}
+
+function requestDelete(app: Hono<Env>) {
+  return app.request("/settings/account/delete-account", {
+    method: "POST",
+    headers: { "x-csrf-token": "valid-token" },
+  });
+}
+
+describe("POST /settings/account/delete-account", () => {
+  it("clears the session cookie so the browser keeps no ticket to the deleted site", async () => {
+    const { app } = createDeleteAccountTestApp();
+
+    const res = await requestDelete(app);
+
+    expect(res.status).toBe(200);
+    expect(res.headers.getSetCookie()).toContain(CLEARED_SESSION_COOKIE);
+    await expect(res.text()).resolves.toContain("/setup");
+  });
+
+  it("signs out before the wipe, while the session row still exists", async () => {
+    const { app, calls } = createDeleteAccountTestApp();
+
+    await requestDelete(app);
+
+    expect(calls).toEqual(["signOut", "deleteAllData"]);
+  });
+
+  it("still wipes the site when signing out fails", async () => {
+    const { app, calls, signOut, deleteAllData } = createDeleteAccountTestApp();
+    signOut.mockRejectedValueOnce(new Error("no session"));
+
+    const res = await requestDelete(app);
+
+    expect(res.status).toBe(200);
+    expect(calls).toEqual(["deleteAllData"]);
+    expect(deleteAllData).toHaveBeenCalledOnce();
+  });
+});

package/src/routes/dash/__tests__/settings-discover.test.ts

@@ -0,0 +1,213 @@
+/**
+ * Tests for the Jant Discover settings routes.
+ *
+ * Both are POSTs with no SSR, so `settingsRoutes` can be mounted and driven
+ * directly. What they are really guarding is the contract with
+ * `client/settings-bridge.ts`: it sends `Accept: application/json` and parses
+ * the body with `readJsonObject`, which throws on anything else — so a route
+ * that answers with a Datastar toast reads to the owner as a failed save no
+ * matter what the server did.
+ */
+
+import { describe, expect, it, vi } from "vitest";
+import { Hono } from "hono";
+import { createI18n } from "../../../i18n/index.js";
+import { settingsRoutes } from "../settings.js";
+import type { Bindings } from "../../../types.js";
+import type { AppVariables } from "../../../types/app-context.js";
+
+type Env = { Bindings: Bindings; Variables: AppVariables };
+
+function createDiscoverTestApp(
+  overrides: {
+    env?: Partial<Bindings>;
+    storedDiscover?: string;
+    demoMode?: boolean;
+    rssFeedsEnabled?: boolean;
+  } = {},
+) {
+  const announceToDiscover = vi.fn(async () => ({
+    at: 0,
+    ok: true,
+    feedUrl: "https://blog.example/latest/feed",
+  }));
+  const updateDiscoverSetting = vi.fn(async () => ({ shouldAnnounce: true }));
+
+  const app = new Hono<Env>();
+  app.use("*", async (c, next) => {
+    c.env = (overrides.env ?? {}) as Bindings;
+    c.set("services", {
+      settings: { announceToDiscover, updateDiscoverSetting },
+    } as unknown as AppVariables["services"]);
+    c.set("allSettings", {
+      ...(overrides.storedDiscover === undefined
+        ? {}
+        : { DISCOVER: overrides.storedDiscover }),
+    });
+    c.set("isAuthenticated", true);
+    c.set("appConfig", {
+      demoMode: overrides.demoMode ?? false,
+      noindex: false,
+      rssFeedsEnabled: overrides.rssFeedsEnabled ?? true,
+      siteUrl: "https://blog.example",
+      sitePathPrefix: "",
+    } as AppVariables["appConfig"]);
+    c.set("lang", "en");
+    c.set("i18n", createI18n("en"));
+    await next();
+  });
+  app.route("/settings", settingsRoutes);
+
+  return { app, announceToDiscover, updateDiscoverSetting };
+}
+
+function postJson(app: Hono<Env>, path: string, body: unknown = {}) {
+  return app.request(path, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      // Exactly what `settings-bridge.ts` sends.
+      Accept: "application/json",
+    },
+    body: JSON.stringify(body),
+  });
+}
+
+describe("POST /settings/general/discover/announce", () => {
+  it("answers JSON, so the bridge does not read a success as a failure", async () => {
+    const { app, announceToDiscover } = createDiscoverTestApp({
+      storedDiscover: "latest",
+    });
+
+    const res = await postJson(app, "/settings/general/discover/announce");
+
+    expect(res.status).toBe(200);
+    // The assertion that matters: a parseable body. A Datastar toast is
+    // `text/html`, and `readJsonObject` throws on it.
+    await expect(res.json()).resolves.toMatchObject({
+      status: "ok",
+      toast: expect.stringContaining("Announcing your site"),
+    });
+    expect(announceToDiscover).toHaveBeenCalledOnce();
+  });
+
+  it("says so in JSON when there is nothing to announce to", async () => {
+    const { app, announceToDiscover } = createDiscoverTestApp({
+      storedDiscover: "latest",
+      env: { DISCOVER_PING_URL: "" },
+    });
+
+    const res = await postJson(app, "/settings/general/discover/announce");
+
+    await expect(res.json()).resolves.toMatchObject({
+      status: "ok",
+      toast: expect.stringContaining("no directory"),
+    });
+    expect(announceToDiscover).not.toHaveBeenCalled();
+  });
+
+  it("never announces a demo site", async () => {
+    const { app, announceToDiscover } = createDiscoverTestApp({
+      storedDiscover: "latest",
+      demoMode: true,
+    });
+
+    await postJson(app, "/settings/general/discover/announce");
+
+    expect(announceToDiscover).not.toHaveBeenCalled();
+  });
+
+  it("does not announce a feed address that would answer 404", async () => {
+    // Feeds are off, so `/latest/feed` does not exist to be polled.
+    const { app, announceToDiscover } = createDiscoverTestApp({
+      storedDiscover: "latest",
+      rssFeedsEnabled: false,
+    });
+
+    await postJson(app, "/settings/general/discover/announce");
+
+    expect(announceToDiscover).not.toHaveBeenCalled();
+  });
+
+  it("still answers a Datastar toast when JSON was not asked for", async () => {
+    const { app } = createDiscoverTestApp({ storedDiscover: "latest" });
+
+    const res = await app.request("/settings/general/discover/announce", {
+      method: "POST",
+    });
+
+    expect(res.headers.get("Content-Type")).toContain("text/html");
+  });
+});
+
+describe("POST /settings/general/discover", () => {
+  it("announces the feed the newly saved mode names, not the stored one", async () => {
+    // `allSettings` is the snapshot taken before the request ran, so it still
+    // holds the previous answer on the save that triggers the announcement.
+    // `featured` is what older releases stored, and it names a different feed
+    // from the `latest` the control now writes.
+    const { app, announceToDiscover } = createDiscoverTestApp({
+      storedDiscover: "featured",
+    });
+
+    await postJson(app, "/settings/general/discover", {
+      discover: "latest",
+    });
+
+    expect(announceToDiscover).toHaveBeenCalledWith(
+      expect.objectContaining({
+        feedUrl: "https://blog.example/latest/feed",
+      }),
+    );
+  });
+
+  /**
+   * A ping means "read me now", and the moment a blog leaves is the moment
+   * that matters most: without it the directory keeps the blog until its next
+   * scheduled read, and the owner watches something they just removed sit
+   * there for another hour.
+   */
+  it("pings the always-served feed when the owner switches Discover off", async () => {
+    const { app, announceToDiscover } = createDiscoverTestApp({
+      storedDiscover: "featured",
+    });
+
+    await postJson(app, "/settings/general/discover", { discover: "off" });
+
+    // `/featured/feed` is not it: the mode that named it is gone, and the
+    // declaration a directory has to read sits in every feed.
+    expect(announceToDiscover).toHaveBeenCalledWith(
+      expect.objectContaining({
+        feedUrl: "https://blog.example/latest/feed",
+      }),
+    );
+  });
+
+  // The other ways a site resolves to `none` are not an owner saying stop, and
+  // the address they would name answers 404.
+  it("sends no stop ping from a site whose feeds are off", async () => {
+    const { app, announceToDiscover } = createDiscoverTestApp({
+      storedDiscover: "latest",
+      rssFeedsEnabled: false,
+    });
+
+    await postJson(app, "/settings/general/discover", { discover: "off" });
+
+    expect(announceToDiscover).not.toHaveBeenCalled();
+  });
+
+  it("does not announce when the save was not an opt-in", async () => {
+    const { app, announceToDiscover, updateDiscoverSetting } =
+      createDiscoverTestApp({ storedDiscover: "latest" });
+    updateDiscoverSetting.mockResolvedValueOnce({ shouldAnnounce: false });
+
+    await postJson(app, "/settings/general/discover", {
+      discover: "latest",
+    });
+
+    // A request the schema rejects never reaches the service, and would pass
+    // the assertion below for the wrong reason.
+    expect(updateDiscoverSetting).toHaveBeenCalledOnce();
+    expect(announceToDiscover).not.toHaveBeenCalled();
+  });
+});

package/src/routes/dash/custom-urls.tsx

@@ -272,6 +272,7 @@ function CustomUrlsListContent({
                         class="custom-url-menu"
                         role="menu"
                         data-custom-url-menu
+                        popover="manual"
                         hidden
                       >
                         <button
@@ -434,15 +435,6 @@ function NewCustomUrlContent({
                 }),
               )}
             </option>
-            <option value="archive">
-              {i18n._(
-                msg({
-                  message: "Archive",
-                  comment:
-                    "@context: Custom URL type option for filtered archive view",
-                }),
-              )}
-            </option>
           </select>
         </div>
 
@@ -494,33 +486,6 @@ function NewCustomUrlContent({
           </div>
         </div>
 
-        <div data-show="$targetType === 'archive'" class="field">
-          <label class="label">
-            {i18n._(
-              msg({
-                message: "Query Parameters",
-                comment: "@context: Archive custom URL query params field",
-              }),
-            )}
-          </label>
-          <input
-            type="text"
-            data-bind="archiveQuery"
-            class="input"
-            placeholder="format=note&title=none&visibility=public&view=list"
-          />
-          <p class="text-xs text-muted-foreground mt-1">
-            {i18n._(
-              msg({
-                message:
-                  "Archive filter parameters (e.g. format=note&view=list)",
-                comment:
-                  "@context: Help text for archive custom URL query params",
-              }),
-            )}
-          </p>
-        </div>
-
         <div
           data-show="$targetType === 'post' || $targetType === 'collection'"
           class="field"
@@ -705,7 +670,6 @@ customUrlsRoutes.post("/", async (c) => {
     targetId,
     toPath: body.toPath,
     redirectType,
-    archiveQuery: body.archiveQuery,
   });
 
   return dsRedirect(