@meith/web 0.16.0

package/src/server/admin-actions.ts

@@ -0,0 +1,171 @@
+'use server'
+
+import { redirect } from 'next/navigation'
+
+import { generateToken, hashToken, verifyPassword } from '@meith/accounts'
+import { ipAllowed } from '@meith/admin'
+import { ForbiddenError, logger, ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+
+import { adminAllowlist, adminService, recordAdminAction, resolveAdmin } from './admin'
+import { boardAuthConfig } from './auth-config'
+import type { FormState } from './auth-form-state'
+import { getContainer } from './container'
+import { getActor } from './context'
+import { formStateReporter } from './form-state-reporter'
+import { text } from './form-values'
+import { remoteAddress, retainedIpPrefix } from './request-fingerprint'
+import { isSafeLocalPath } from './safe-path'
+import { clearAdminCookie, readAdminToken, setAdminCookie } from './session-cookies'
+import { twoFactorRequiredForStaff, twoFactorService } from './two-factor'
+
+const toFormState = formStateReporter('admin-actions', 'unexpected error in an admin action')
+
+export async function adminSignInAction(_prev: FormState, form: FormData): Promise<FormState> {
+  let target: string
+
+  try {
+    if (!ipAllowed(await remoteAddress(), await adminAllowlist())) {
+      throw new ForbiddenError(msg('error.app.control-panel-available-from-address'))
+    }
+
+    const service = adminService()
+    if (service === null) {
+      throw new ForbiddenError(msg('error.app.board-running-in-memory-sample-data-25'))
+    }
+
+    const actor = await getActor()
+    const { authorizer, accountStore } = getContainer()
+    if (actor.userId === null || !authorizer.can(actor, 'admincp.access')) {
+      throw new ForbiddenError(msg('error.app.reach-control-panel'))
+    }
+
+    const account = await accountStore.accounts.findById(actor.userId)
+    if (account === null) throw new ForbiddenError(msg('error.app.reach-control-panel'))
+
+    const config = await boardAuthConfig()
+    const attemptBucket = await adminReauthenticationBucket(actor.userId)
+    const attemptSince = new Date(Date.now() - config.lockoutMinutes * 60_000)
+    if (
+      config.maxLoginAttempts > 0 &&
+      (await accountStore.loginAttempts.countFailuresSince(attemptBucket, attemptSince)) >=
+        config.maxLoginAttempts
+    ) {
+      throw new ForbiddenError(msg('error.accounts.too-many-failed-attempts-please'))
+    }
+
+    const failAttempt = async (): Promise<void> => {
+      await accountStore.loginAttempts.record(attemptBucket, false, new Date())
+      await recordAdminAction({ action: 'admin.signin_failed' })
+    }
+
+    const password = text(form, 'password')
+    if (password === '') {
+      await failAttempt()
+      throw new ValidationError(msg('error.app.enter-password'))
+    }
+
+    const ok = await verifyPassword(password, account.passwordHash)
+    if (!ok) {
+      await failAttempt()
+      throw new ForbiddenError(msg('error.app.password-right'))
+    }
+
+    try {
+      await assertSecondFactorGiven({ userId: actor.userId, form })
+    } catch (err) {
+      await failAttempt()
+      throw err
+    }
+
+    await accountStore.loginAttempts.clear(attemptBucket)
+
+    const existing = await resolveAdmin()
+    if ('context' in existing) {
+      await service.markReauthenticated(existing.context.session.id)
+      await recordAdminAction({ action: 'admin.reauthenticated' })
+    } else {
+      const token = generateToken()
+      const session = await service.start({
+        userId: actor.userId,
+        tokenHash: await hashToken(token),
+        ipPrefix: await retainedIpPrefix(),
+      })
+      await setAdminCookie(token, session.expiresAt)
+      await recordAdminAction({ action: 'admin.signed_in' })
+    }
+
+    target = safeAdminReturn(text(form, 'next'))
+  } catch (err) {
+    return toFormState(err)
+  }
+
+  redirect(target)
+}
+
+/**
+ * The panel's door asks for the second factor as well as the password. The
+ * panel can rewrite the whole board, so re-proving only the thing most likely
+ * to have leaked would be re-proving the wrong one.
+ */
+async function adminReauthenticationBucket(userId: number): Promise<string> {
+  const prefix = await retainedIpPrefix()
+  return prefix === null ? `admin-reauth:${userId}` : `admin-reauth:${userId}@${prefix}`
+}
+
+async function assertSecondFactorGiven(input: {
+  readonly userId: number
+  readonly form: FormData
+}): Promise<void> {
+  const service = twoFactorService()
+  if (service === null) return
+
+  const enrolled = await service.isEnrolled(input.userId)
+
+  if (!enrolled) {
+    if (await twoFactorRequiredForStaff()) {
+      throw new ForbiddenError(msg('adminAction.twoFactorRequired'))
+    }
+    return
+  }
+
+  const code = text(input.form, 'code')
+  if (code === '') {
+    throw new ValidationError(msg('error.app.enter-code-from-authenticator-app'))
+  }
+
+  const outcome = await service.verify({ userId: input.userId, code })
+  if (outcome.status !== 'ok') {
+    if (outcome.status === 'replayed') {
+      throw new ForbiddenError(msg('adminAction.codeReplayed'))
+    }
+    throw new ForbiddenError(msg('adminAction.codeWrong'))
+  }
+}
+
+export async function adminSignOutAction(): Promise<void> {
+  try {
+    const token = await readAdminToken()
+    const service = adminService()
+
+    if (token !== null && token !== '' && service !== null) {
+      const resolved = await resolveAdmin()
+      if ('context' in resolved) {
+        await recordAdminAction({ action: 'admin.signed_out' })
+        await service.end(resolved.context.session.id)
+      }
+    }
+  } catch (err) {
+    logger({ module: 'admin-actions' }).warn({ err }, 'admin sign-out could not revoke')
+  }
+
+  await clearAdminCookie()
+  redirect('/')
+}
+
+function safeAdminReturn(raw: string): string {
+  const trimmed = raw.trim()
+  if (!isSafeLocalPath(trimmed) || !trimmed.startsWith('/admin')) return '/admin'
+  if (/^\/admin[^/?#]/.test(trimmed)) return '/admin'
+  return trimmed
+}

package/src/server/admin-settings-actions.ts

@@ -0,0 +1,83 @@
+'use server'
+
+import { revalidatePath } from 'next/cache'
+
+import { CacheTags, isAppError, logger, ValidationError } from '@meith/core'
+import { getDb, PostgresSettingsRepository } from '@meith/db'
+import { drivers } from '@meith/drivers'
+import { msg } from '@meith/i18n'
+import {
+  coerceFormValue,
+  SETTING_DEFINITIONS,
+  type SettingDefinition,
+  saveSettings,
+  secretClearField,
+} from '@meith/settings'
+
+import { recordAdminAction, requireAdmin } from './admin'
+import type { FormState } from './auth-form-state'
+import { tr } from './i18n'
+import { emitEvent } from './plugin-view'
+import { getSettings } from './settings'
+
+function submittedKeys(form: FormData): readonly SettingDefinition[] {
+  const declared = new Set(
+    (form.get('keys') ?? '')
+      .toString()
+      .split(',')
+      .map((key) => key.trim())
+      .filter((key) => key !== ''),
+  )
+
+  return SETTING_DEFINITIONS.filter((definition) => declared.has(definition.key))
+}
+
+export async function saveAdminSettingsAction(
+  _prev: FormState,
+  form: FormData,
+): Promise<FormState> {
+  try {
+    const admin = await requireAdmin()
+
+    const definitions = submittedKeys(form)
+    if (definitions.length === 0) {
+      throw new ValidationError(msg('error.app.form-submitted-settings'))
+    }
+
+    const updates: Record<string, unknown> = {}
+    for (const definition of definitions) {
+      const raw = form.get(definition.key)
+      const value = coerceFormValue(definition, typeof raw === 'string' ? raw : undefined, {
+        clear: form.get(secretClearField(definition.key)) === '1',
+      })
+      if (value !== undefined) updates[definition.key] = value
+    }
+
+    const result = await saveSettings(
+      new PostgresSettingsRepository(getDb()),
+      updates,
+      await getSettings(),
+    )
+
+    if (result.changed.length > 0) {
+      const tags = [CacheTags.settings(), ...result.invalidates]
+      await drivers().cache.invalidateTags(tags)
+      for (const tag of tags) await emitEvent('cache.invalidated', { tag }, {})
+
+      revalidatePath('/admin/settings')
+
+      await emitEvent('settings.saved', { keys: result.changed }, { adminId: admin.session.userId })
+
+      await recordAdminAction({
+        action: 'settings.changed',
+        detail: { keys: result.changed },
+      })
+    }
+
+    return { notice: result.changed.length === 0 ? 'unchanged' : 'saved' }
+  } catch (err) {
+    if (isAppError(err)) return { error: err.message }
+    logger({ module: 'admin-settings' }).error({ err }, 'failed to save settings')
+    return { error: await tr('notice.app.something-went-wrong-please-try') }
+  }
+}

package/src/server/admin-undo-actions.ts

@@ -0,0 +1,70 @@
+'use server'
+
+import { refresh, revalidatePath } from 'next/cache'
+
+import { ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+
+import { recordAdminAction, requireAdmin } from './admin'
+import { claimAdminUndo } from './admin-undo'
+import type { FormState } from './auth-form-state'
+import { formStateReporter } from './form-state-reporter'
+import { trimmedText } from './form-values'
+import { banService, requireUserAdmin } from './user-admin'
+
+const toFormState = formStateReporter('admin-undo', 'admin undo failed')
+
+function positive(value: unknown): number {
+  const parsed = Number(value)
+  if (!Number.isSafeInteger(parsed) || parsed <= 0)
+    throw new ValidationError(msg('admin.undoInvalid'))
+  return parsed
+}
+
+function numbers(value: unknown): number[] {
+  if (!Array.isArray(value)) throw new ValidationError(msg('admin.undoInvalid'))
+  return value.map(positive)
+}
+
+export async function undoAdminAction(_prev: FormState, form: FormData): Promise<FormState> {
+  try {
+    const context = await requireAdmin()
+    const claimed = await claimAdminUndo({
+      token: trimmedText(form, 'undoToken'),
+      actorUserId: context.session.userId,
+    })
+    const snapshot = claimed.snapshot
+
+    if (claimed.operation === 'user.state') {
+      const state = snapshot.state
+      if (state !== 'active' && state !== 'awaiting_activation') {
+        throw new ValidationError(msg('admin.undoInvalid'))
+      }
+      await requireUserAdmin().setState(positive(snapshot.userId), state)
+    } else if (claimed.operation === 'user.groups') {
+      await requireUserAdmin().setSecondaryGroups(
+        positive(snapshot.userId),
+        numbers(snapshot.memberships),
+        context.session.userId,
+      )
+    } else if (claimed.operation === 'user.ban' || claimed.operation === 'user.bulk_ban') {
+      const ids =
+        claimed.operation === 'user.ban' ? [positive(snapshot.userId)] : numbers(snapshot.userIds)
+      for (const id of ids) await banService().lift(id)
+    } else {
+      throw new ValidationError(msg('admin.undoInvalid'))
+    }
+
+    revalidatePath('/admin')
+    revalidatePath('/admin/users')
+    revalidatePath('/admin/users/[id]', 'page')
+    refresh()
+    await recordAdminAction({
+      action: `${claimed.operation}.undone`,
+      detail: { undoOperationId: claimed.id },
+    })
+    return { notice: 'undone' }
+  } catch (err) {
+    return toFormState(err)
+  }
+}

package/src/server/admin-undo.ts

@@ -0,0 +1,75 @@
+import 'server-only'
+
+import { randomUUID } from 'node:crypto'
+
+import { hashToken } from '@meith/accounts'
+import { ForbiddenError, ValidationError } from '@meith/core'
+import { getDb, PostgresAdminUndoRepository } from '@meith/db'
+import { msg } from '@meith/i18n'
+
+import type { UndoState } from './auth-form-state'
+import { getContainer } from './container'
+
+export const ADMIN_UNDO_WINDOW_MS = 10 * 60_000
+
+function repository(): PostgresAdminUndoRepository {
+  if (getContainer().dataSource !== 'postgres') {
+    throw new ForbiddenError(msg('admin.undoUnavailable'))
+  }
+  return new PostgresAdminUndoRepository(getDb())
+}
+
+export async function issueAdminUndo(input: {
+  readonly actorUserId: number
+  readonly operation: string
+  readonly snapshot: Readonly<Record<string, unknown>>
+  readonly now?: Date
+}): Promise<UndoState | undefined> {
+  if (getContainer().dataSource !== 'postgres') return undefined
+
+  const now = input.now ?? new Date()
+  const expiresAt = new Date(now.getTime() + ADMIN_UNDO_WINDOW_MS)
+  const token = randomUUID()
+
+  await repository().create({
+    tokenHash: await hashToken(token),
+    actorUserId: input.actorUserId,
+    operation: input.operation,
+    snapshot: input.snapshot,
+    createdAt: now,
+    expiresAt,
+  })
+
+  return { token, expiresAt: expiresAt.toISOString() }
+}
+
+export async function readAdminUndo(input: {
+  readonly token: string
+  readonly actorUserId: number
+}) {
+  const token = input.token.trim()
+  if (token === '') return null
+  return repository().findLive({
+    tokenHash: await hashToken(token),
+    actorUserId: input.actorUserId,
+    now: new Date(),
+  })
+}
+
+export async function claimAdminUndo(input: {
+  readonly token: string
+  readonly actorUserId: number
+}) {
+  const token = input.token.trim()
+  if (token === '') throw new ValidationError(msg('admin.undoInvalid'))
+
+  const operation = await repository().claim({
+    tokenHash: await hashToken(token),
+    actorUserId: input.actorUserId,
+    now: new Date(),
+  })
+  if (operation === null) {
+    throw new ValidationError(msg('admin.undoExpired'))
+  }
+  return operation
+}

package/src/server/admin.ts

@@ -0,0 +1,112 @@
+import { msg } from '@meith/i18n'
+import 'server-only'
+
+import { notFound } from 'next/navigation'
+import { cache } from 'react'
+
+import { hashToken } from '@meith/accounts'
+import { type AdminContext, AdminService, ipAllowed, parseAllowlist } from '@meith/admin'
+import { env, ForbiddenError } from '@meith/core'
+
+import { getContainer } from './container'
+import { getActor } from './context'
+import { remoteAddress, retainedIpPrefix } from './request-fingerprint'
+import { readAdminToken } from './session-cookies'
+
+export type AdminDenial = 'address' | 'permission' | 'signin' | 'expired' | 'unavailable'
+
+export function adminService(): AdminService | null {
+  const { adminSessions } = getContainer()
+  return adminSessions === null ? null : new AdminService({ sessions: adminSessions })
+}
+
+export const adminAllowlist = cache(
+  async (): Promise<readonly string[]> => parseAllowlist(env.ADMIN_IP_ALLOWLIST),
+)
+
+export const resolveAdmin = cache(
+  async (): Promise<{ context: AdminContext } | { denied: AdminDenial }> => {
+    const allowlist = await adminAllowlist()
+    if (!ipAllowed(await remoteAddress(), allowlist)) return { denied: 'address' }
+
+    const service = adminService()
+    if (service === null) return { denied: 'unavailable' }
+
+    const actor = await getActor()
+    const { authorizer } = getContainer()
+    if (actor.userId === null || !authorizer.can(actor, 'admincp.access')) {
+      return { denied: 'permission' }
+    }
+
+    const token = await readAdminToken()
+    if (token === null || token === '') return { denied: 'signin' }
+
+    const context = await service.resolve(await hashToken(token))
+    if (context === null) return { denied: 'expired' }
+
+    if (context.userId !== actor.userId) return { denied: 'expired' }
+
+    return { context }
+  },
+)
+
+export async function requireAdmin(): Promise<AdminContext> {
+  const resolved = await resolveAdmin()
+  if ('context' in resolved) return resolved.context
+
+  throw new ForbiddenError(
+    resolved.denied === 'address'
+      ? msg('error.app.control-panel-available-from-address')
+      : resolved.denied === 'unavailable'
+        ? msg('error.app.board-running-in-memory-sample-data-25')
+        : resolved.denied === 'permission'
+          ? msg('error.app.reach-control-panel')
+          : msg('error.app.control-panel-sign-in'),
+  )
+}
+
+export function askForPassword(denied: AdminDenial): boolean {
+  return denied === 'signin' || denied === 'expired'
+}
+
+export async function adminPageContext(): Promise<AdminContext | null> {
+  const resolved = await resolveAdmin()
+  if ('context' in resolved) return resolved.context
+  if (askForPassword(resolved.denied)) return null
+
+  notFound()
+}
+
+export async function requireFreshAdmin(): Promise<AdminContext> {
+  const context = await requireAdmin()
+  const service = adminService()
+  if (service === null) throw new ForbiddenError(msg('error.app.control-panel-board'))
+
+  service.requireFreshProof(context)
+  return context
+}
+
+export async function recordAdminAction(input: {
+  readonly action: string
+  readonly detail?: Readonly<Record<string, unknown>>
+}): Promise<void> {
+  const { adminLog } = getContainer()
+  if (adminLog === null) return
+
+  try {
+    const actor = await getActor()
+    const { assertLogAction } = await import('@meith/admin')
+    assertLogAction(input.action)
+
+    await adminLog.record({
+      userId: actor.userId,
+      action: input.action,
+      detail: input.detail ?? {},
+      ipPrefix: await retainedIpPrefix(),
+      at: new Date(),
+    })
+  } catch (err) {
+    const { logger } = await import('@meith/core')
+    logger({ module: 'admin' }).error({ err, action: input.action }, 'admin log write failed')
+  }
+}

package/src/server/announcements.ts

@@ -0,0 +1,82 @@
+import 'server-only'
+
+import { env, logger } from '@meith/core'
+import { type AnnouncementRow, getDb, PostgresAnnouncementRepository } from '@meith/db'
+import type { Translator } from '@meith/i18n'
+import { type BoardVocabulary, renderMarkdown, vocabularyOptions } from '@meith/markdown'
+import type { AnnouncementModel } from '@meith/theme-kit'
+
+import { forumHref } from '../view/board-index'
+import { distinctUserIds, type MemberIdentity, nameClassOf } from '../view/member-identity'
+import { formatTime } from '../view/time'
+import { activeVocabulary } from './content-admin'
+import { identitiesFor } from './group-identity'
+
+export function announcementRepository(): PostgresAnnouncementRepository | null {
+  return env.DATA_SOURCE === 'postgres' ? new PostgresAnnouncementRepository(getDb()) : null
+}
+
+export async function liveAnnouncements(input: {
+  readonly visibleForumIds: readonly number[]
+  readonly scope?: number | null
+  readonly now: Date
+  readonly t?: Translator | undefined
+}): Promise<readonly AnnouncementModel[]> {
+  const repository = announcementRepository()
+  if (repository === null) return []
+
+  try {
+    const [rows, vocabulary] = await Promise.all([
+      repository.live({
+        now: input.now,
+        visibleForumIds: input.visibleForumIds,
+        scope: input.scope ?? null,
+      }),
+      activeVocabulary(),
+    ])
+
+    const identities = await identitiesFor(distinctUserIds(rows.map((row) => row.authorUserId)))
+
+    return rows.map((row) => toModel(row, input.now, input.t, vocabulary, identities))
+  } catch (error) {
+    logger().warn({ err: String(error) }, 'could not read announcements')
+    return []
+  }
+}
+
+function toModel(
+  row: AnnouncementRow,
+  now: Date,
+  translator: Translator | undefined,
+  vocabulary: BoardVocabulary | undefined,
+  identities: ReadonlyMap<number, MemberIdentity>,
+): AnnouncementModel {
+  return {
+    title: row.title,
+    bodyHtml: renderMarkdown(row.message, {
+      ...vocabularyOptions(vocabulary),
+      ...(translator === undefined
+        ? {}
+        : {
+            quoteAttribution: (author) => translator.t('markdown.quote.attribution', { author }),
+          }),
+    }).html,
+    postedBy:
+      row.authorUsername === ''
+        ? null
+        : {
+            userId: row.authorUserId,
+            username: row.authorUsername,
+            profileHref: row.authorUserId === null ? null : `/member/${row.authorUserId}`,
+            nameClass: nameClassOf(identities, row.authorUserId),
+          },
+    postedAt: formatTime(row.startsAt, now, translator),
+    forum:
+      row.forumId === null || row.forumTitle === null || row.forumSlug === null
+        ? null
+        : {
+            label: row.forumTitle,
+            href: forumHref({ id: row.forumId, slug: row.forumSlug }),
+          },
+  }
+}