@meith/web 0.16.0

package/app/admin/users/prune/page.tsx

@@ -0,0 +1,186 @@
+import type { Metadata } from 'next'
+
+import { PruneForm, SelectedPruneForm } from '@/components/admin/user-forms'
+import { PANEL_CARD, PANEL_NOTE } from '@/components/shell/panel-list'
+import { PanelPage } from '@/components/shell/panel-page'
+import { adminPageContext } from '@/server/admin'
+import { readAdminUndo } from '@/server/admin-undo'
+import { getTranslator, tr } from '@/server/i18n'
+import { parsePruneCriteria, userBulkRepository } from '@/server/user-admin'
+import { userPruneCopy } from '@/view/admin-user-copy'
+
+export async function generateMetadata(): Promise<Metadata> {
+  return { title: await tr('page.prune-members') }
+}
+
+const INPUT =
+  'w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-ring'
+
+export default async function AdminPrunePage({
+  searchParams,
+}: {
+  searchParams: Promise<Record<string, string | string[] | undefined>>
+}) {
+  const context = await adminPageContext()
+  if (context === null) return null
+
+  const repository = userBulkRepository()
+  if (repository === null) {
+    return (
+      <PanelPage title={await tr('page.prune-members')}>
+        <p className="mt-2 text-sm text-muted-foreground">
+          {await tr('page.this-board-running-in-memory-sample-2')}
+        </p>
+      </PanelPage>
+    )
+  }
+
+  const params = await searchParams
+  const selection = Array.isArray(params.selection) ? params.selection[0] : params.selection
+  const selectedOperation =
+    selection === undefined
+      ? null
+      : await readAdminUndo({ token: selection, actorUserId: context.session.userId })
+  const selectedIds =
+    selectedOperation?.operation === 'user.prune_selection' &&
+    Array.isArray(selectedOperation.snapshot.userIds)
+      ? selectedOperation.snapshot.userIds.map(Number).filter(Number.isSafeInteger)
+      : []
+  const selectedPreview =
+    selectedIds.length === 0 ? null : await repository.selectedPrunePreview(selectedIds)
+  const criteria = selection === undefined ? parsePruneCriteria(params) : null
+  const preview = criteria === null ? null : await repository.prunePreview(criteria)
+  const translator = await getTranslator()
+
+  const value = (key: string): string => {
+    const raw = params[key]
+    const text = Array.isArray(raw) ? raw[0] : raw
+    return text ?? ''
+  }
+
+  return (
+    <PanelPage
+      back={{ href: '/admin/users', label: translator.t('adminUsers.allMembers') }}
+      title={await tr('page.prune-members')}
+      lede={translator.t('adminUsers.pruneLede')}
+    >
+      {selection !== undefined && selectedPreview !== null ? (
+        <section className={PANEL_CARD}>
+          <h2 className="font-heading text-lg font-semibold">
+            {translator.t('adminUsers.accountsWouldClose', { count: selectedPreview.total })}
+          </h2>
+          <ul className="flex flex-col gap-1 text-sm text-muted-foreground">
+            {selectedPreview.sample.map((row) => (
+              <li key={row.id}>
+                <a
+                  href={`/admin/users/${row.id}`}
+                  className="font-medium text-foreground underline decoration-border underline-offset-2 hover:decoration-foreground"
+                >
+                  {row.username}
+                </a>{' '}
+                {translator.t('adminUsers.pruneMemberMeta', {
+                  email: row.email,
+                  date: row.createdAt.toISOString().slice(0, 10),
+                })}
+              </li>
+            ))}
+          </ul>
+          <SelectedPruneForm
+            selection={selection}
+            copy={userPruneCopy(selectedPreview.total, translator)}
+          />
+        </section>
+      ) : selection !== undefined ? (
+        <p className={PANEL_NOTE}>{translator.t('admin.undoExpired')}</p>
+      ) : (
+        <>
+          <form method="get" className={PANEL_CARD}>
+            <label className="flex flex-col gap-1 text-sm">
+              <span className="font-medium">{await tr('page.registered-before')}</span>
+              <input type="date" name="before" defaultValue={value('before')} className={INPUT} />
+              <span className="text-xs text-muted-foreground">
+                {await tr('page.required-without-it-prune-matches')}
+              </span>
+            </label>
+
+            <label className="flex flex-col gap-1 text-sm">
+              <span className="font-medium">{await tr('page.not-seen-since')}</span>
+              <input
+                type="date"
+                name="inactive"
+                defaultValue={value('inactive')}
+                className={INPUT}
+              />
+              <span className="text-xs text-muted-foreground">
+                {await tr('page.members-who-have-never-been')}
+              </span>
+            </label>
+
+            <label className="flex items-center gap-2 text-sm">
+              <input
+                type="checkbox"
+                name="awaiting"
+                value="1"
+                defaultChecked={value('awaiting') !== ''}
+                className="size-4"
+              />
+              <span>{await tr('page.only-accounts-still-awaiting-activation')}</span>
+            </label>
+
+            <div>
+              <button
+                type="submit"
+                className="inline-flex h-10 items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground hover:opacity-90"
+              >
+                {await tr('page.show-me')}
+              </button>
+            </div>
+          </form>
+
+          {criteria === null ? (
+            <p className={PANEL_NOTE}>{await tr('page.choose-registration-date-see-what')}</p>
+          ) : preview !== null && preview.total === 0 ? (
+            <p className={PANEL_NOTE}>{translator.t('adminUsers.pruneNoMatches')}</p>
+          ) : preview !== null ? (
+            <section className={PANEL_CARD}>
+              <h2 className="font-heading text-lg font-semibold">
+                {translator.t('adminUsers.accountsWouldClose', { count: preview.total })}
+              </h2>
+
+              <ul className="flex flex-col gap-1 text-sm text-muted-foreground">
+                {preview.sample.map((row) => (
+                  <li key={row.id}>
+                    <a
+                      href={`/admin/users/${row.id}`}
+                      className="font-medium text-foreground underline decoration-border underline-offset-2 hover:decoration-foreground"
+                    >
+                      {row.username}
+                    </a>{' '}
+                    {translator.t('adminUsers.pruneMemberMeta', {
+                      email: row.email,
+                      date: row.createdAt.toISOString().slice(0, 10),
+                    })}
+                  </li>
+                ))}
+                {preview.total > preview.sample.length && (
+                  <li>
+                    {translator.t('adminUsers.andMore', {
+                      count: preview.total - preview.sample.length,
+                    })}
+                  </li>
+                )}
+              </ul>
+
+              <PruneForm
+                before={value('before')}
+                inactive={value('inactive')}
+                awaiting={value('awaiting') !== ''}
+                copy={userPruneCopy(preview.total, translator)}
+              />
+            </section>
+          ) : null}
+        </>
+      )}
+    </PanelPage>
+  )
+}

package/app/api/health/route.ts

@@ -0,0 +1,11 @@
+import { NextResponse } from 'next/server'
+
+export const dynamic = 'force-dynamic'
+export const revalidate = 0
+
+export function GET(): NextResponse {
+  return NextResponse.json(
+    { ok: true, at: new Date().toISOString() },
+    { headers: { 'cache-control': 'no-store' } },
+  )
+}

package/app/api/metrics/route.ts

@@ -0,0 +1,66 @@
+import { NextResponse } from 'next/server'
+
+import { env, logger, metrics } from '@meith/core'
+
+import { bearerSecret, secretMatches } from '@/server/secret-auth'
+import { systemHealthRepository } from '@/server/system-admin'
+
+export const dynamic = 'force-dynamic'
+export const revalidate = 0
+
+const TOKEN_HEADER = 'x-metrics-token'
+
+const CONTENT_TYPE = 'text/plain; version=0.0.4; charset=utf-8'
+
+const queueJobs = metrics.gauge(
+  'meith_queue_jobs',
+  'Jobs currently queued or dead-lettered, labelled by status.',
+)
+const dbConnectionsActive = metrics.gauge(
+  'meith_db_connections_active',
+  'Active server-side connections to this database.',
+)
+
+function authorised(request: Request): boolean {
+  const expected = env.METRICS_TOKEN
+
+  if (!expected) {
+    logger().warn(
+      'METRICS_TOKEN is not set; the metrics endpoint is unauthenticated. This is ' +
+        'permitted in development only.',
+    )
+    return true
+  }
+
+  return secretMatches(bearerSecret(request, TOKEN_HEADER), expected)
+}
+
+async function refreshDatabaseGauges(): Promise<void> {
+  const repository = systemHealthRepository()
+  if (repository === null) return
+
+  const [volumes, activeConnections] = await Promise.all([
+    repository.volumes(),
+    repository.activeConnections(),
+  ])
+
+  queueJobs.set(volumes.queuedJobs, { status: 'queued' })
+  queueJobs.set(volumes.deadLetteredJobs, { status: 'dead' })
+  dbConnectionsActive.set(activeConnections)
+}
+
+export async function GET(request: Request): Promise<NextResponse | Response> {
+  if (!env.METRICS_ENABLED || !authorised(request)) {
+    return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  }
+
+  try {
+    await refreshDatabaseGauges()
+  } catch (err) {
+    logger({ module: 'metrics' }).error({ err }, 'could not refresh the database-derived gauges')
+  }
+
+  return new Response(metrics.render(), {
+    headers: { 'content-type': CONTENT_TYPE, 'cache-control': 'no-store' },
+  })
+}

package/app/api/plugins/[key]/[...path]/route.ts

@@ -0,0 +1,27 @@
+import type { NextRequest } from 'next/server'
+
+import { dispatchPluginRoute } from '@/server/plugin-routes'
+
+export const dynamic = 'force-dynamic'
+
+async function handle(
+  request: NextRequest,
+  params: Promise<{ key: string; path: string[] }>,
+): Promise<Response> {
+  const { key, path } = await params
+  return dispatchPluginRoute(request, key, path)
+}
+
+export async function GET(
+  request: NextRequest,
+  context: { params: Promise<{ key: string; path: string[] }> },
+): Promise<Response> {
+  return handle(request, context.params)
+}
+
+export async function POST(
+  request: NextRequest,
+  context: { params: Promise<{ key: string; path: string[] }> },
+): Promise<Response> {
+  return handle(request, context.params)
+}

package/app/api/read/all/route.ts

@@ -0,0 +1,15 @@
+import { getContainer } from '@/server/container'
+import { getActor } from '@/server/context'
+import { crossOriginRefusal, isSameOrigin } from '@/server/same-origin'
+import { seeOther } from '@/server/see-other'
+
+export async function POST(request: Request) {
+  if (!isSameOrigin(request)) return crossOriginRefusal()
+
+  const actor = await getActor()
+  const { authorizer, readState } = getContainer()
+  if (actor.userId === null || readState === null) return seeOther('/')
+
+  await readState.markForumsRead(actor.userId, await authorizer.visibleForumIds(actor), new Date())
+  return seeOther('/')
+}

package/app/api/read/forum/[id]/route.ts

@@ -0,0 +1,29 @@
+import { canHoldThreads } from '@meith/forums'
+
+import { getContainer } from '@/server/container'
+import { getActor } from '@/server/context'
+import { crossOriginRefusal, isSameOrigin } from '@/server/same-origin'
+import { seeOther } from '@/server/see-other'
+
+function idFrom(value: string): number | null {
+  if (!/^[1-9]\d*$/.test(value)) return null
+  const id = Number(value)
+  return Number.isSafeInteger(id) ? id : null
+}
+
+export async function POST(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!isSameOrigin(request)) return crossOriginRefusal()
+
+  const id = idFrom((await params).id)
+  const actor = await getActor()
+  const { forums, authorizer, readState } = getContainer()
+  if (id === null || actor.userId === null || readState === null) return seeOther('/')
+
+  const forum = await forums.findById(id)
+  if (!forum || !canHoldThreads(forum.type)) return seeOther('/')
+  const matrix = await authorizer.forumMatrix(actor, id)
+  if (!authorizer.can(actor, 'forum.view', { forumId: id, forum: matrix })) return seeOther('/')
+
+  await readState.markForumsRead(actor.userId, [id], new Date())
+  return seeOther(`/${id}-${forum.slug}`)
+}

package/app/api/read/thread/[id]/route.ts

@@ -0,0 +1,40 @@
+import { ALL_THREAD_AUTHORS, PUBLIC_CONTENT } from '@meith/core'
+import { canHoldThreads } from '@meith/forums'
+
+import { getContainer } from '@/server/container'
+import { getActor } from '@/server/context'
+import { crossOriginRefusal, isSameOrigin } from '@/server/same-origin'
+import { seeOther } from '@/server/see-other'
+
+function idFrom(value: string | null): number | null {
+  if (value === null || !/^[1-9]\d*$/.test(value)) return null
+  const id = Number(value)
+  return Number.isSafeInteger(id) ? id : null
+}
+
+export async function POST(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!isSameOrigin(request)) return crossOriginRefusal()
+
+  const url = new URL(request.url)
+  const threadId = idFrom((await params).id)
+  const postId = idFrom(url.searchParams.get('post'))
+  const actor = await getActor()
+  const { forums, posts, threads, authorizer, readState } = getContainer()
+  if (threadId === null || postId === null || actor.userId === null || readState === null)
+    return seeOther('/')
+
+  const thread = await threads.findById(threadId, PUBLIC_CONTENT, ALL_THREAD_AUTHORS)
+  if (!thread) return seeOther('/')
+  const forum = await forums.findById(thread.forumId)
+  if (!forum || !canHoldThreads(forum.type)) return seeOther('/')
+  const matrix = await authorizer.forumMatrix(actor, forum.id)
+  const target = {
+    ...(await authorizer.moderatorTargetIn(actor, forum.id, matrix)),
+    threadAuthorId: thread.authorUserId,
+  }
+  if (!authorizer.can(actor, 'thread.view', target)) return seeOther('/')
+  if ((await posts.findVisibleById(threadId, postId)) === null) return seeOther('/')
+
+  await readState.markThreadRead(actor.userId, threadId, postId, new Date())
+  return seeOther(`/thread/${threadId}-${thread.slug}`)
+}

package/app/api/ready/route.ts

@@ -0,0 +1,63 @@
+import { NextResponse } from 'next/server'
+
+import { logger } from '@meith/core'
+import { assessScheduler } from '@meith/tasks'
+
+import { systemHealthRepository } from '@/server/system-admin'
+
+export const dynamic = 'force-dynamic'
+export const revalidate = 0
+
+interface ReadyBody {
+  readonly ok: boolean
+  readonly at: string
+  readonly database: { readonly ok: boolean; readonly error?: string }
+  readonly scheduler: {
+    readonly ok: boolean
+    readonly schedulerStopped: boolean
+    readonly stale: number
+    readonly failing: number
+  } | null
+}
+
+function respond(body: ReadyBody): NextResponse {
+  return NextResponse.json(body, {
+    status: body.ok ? 200 : 503,
+    headers: { 'cache-control': 'no-store' },
+  })
+}
+
+export async function GET(): Promise<NextResponse> {
+  const repository = systemHealthRepository()
+  const now = new Date()
+
+  if (repository === null) {
+    return respond({ ok: true, at: now.toISOString(), database: { ok: true }, scheduler: null })
+  }
+
+  try {
+    const tasks = await repository.taskHealth()
+    const health = assessScheduler(tasks, now)
+
+    return respond({
+      ok: !health.schedulerStopped,
+      at: now.toISOString(),
+      database: { ok: true },
+      scheduler: {
+        ok: !health.schedulerStopped,
+        schedulerStopped: health.schedulerStopped,
+        stale: health.stale,
+        failing: health.failing,
+      },
+    })
+  } catch (err) {
+    logger({ module: 'ready' }).error({ err }, 'readiness check could not reach the database')
+
+    return respond({
+      ok: false,
+      at: now.toISOString(),
+      database: { ok: false, error: 'database unreachable' },
+      scheduler: null,
+    })
+  }
+}

package/app/api/system/tick/route.ts

@@ -0,0 +1,77 @@
+import { NextResponse } from 'next/server'
+
+import { env, logger, withRequestContext } from '@meith/core'
+import { tick } from '@meith/tasks'
+
+import { getContainer } from '@/server/container'
+import { bearerSecret, secretMatches } from '@/server/secret-auth'
+
+export const dynamic = 'force-dynamic'
+export const revalidate = 0
+
+const SECRET_HEADER = 'x-tick-secret'
+
+function authorised(request: Request): boolean {
+  const expected = env.TICK_SECRET
+
+  if (!expected) {
+    logger().warn(
+      'TICK_SECRET is not set; the tick endpoint is unauthenticated. This is ' +
+        'permitted in development only.',
+    )
+    return true
+  }
+
+  if (new URL(request.url).searchParams.has('secret')) {
+    logger().warn(
+      `The tick was called with the secret in the query string, which is no longer read. Present it as "Authorization: Bearer <TICK_SECRET>" or as the "${SECRET_HEADER}" header instead.`,
+    )
+  }
+
+  return secretMatches(bearerSecret(request, SECRET_HEADER), expected)
+}
+
+async function runTick(request: Request): Promise<NextResponse> {
+  return withRequestContext({}, async () => {
+    if (!authorised(request)) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 })
+    }
+
+    const { scheduler } = getContainer()
+
+    if (!scheduler) {
+      return NextResponse.json(
+        {
+          ok: false,
+          ran: [],
+          reason:
+            'No scheduler: DATA_SOURCE is "fixture". The tick needs durable, ' +
+            'cross-instance state to guarantee a task is not run twice.',
+        },
+        { status: 503 },
+      )
+    }
+
+    const outcomes = await tick({
+      repository: scheduler.repository,
+      tasks: scheduler.tasks,
+      onError: scheduler.onTaskFailure,
+    })
+
+    const failed = outcomes.filter((o) => o.status === 'failed')
+
+    return NextResponse.json({
+      ok: failed.length === 0,
+      ran: outcomes,
+      registered: scheduler.tasks.length,
+    })
+  })
+}
+
+export async function GET(request: Request): Promise<NextResponse> {
+  return runTick(request)
+}
+
+export async function POST(request: Request): Promise<NextResponse> {
+  return runTick(request)
+}