@meith/web 0.16.0

package/src/server/forum-admin.ts

@@ -0,0 +1,98 @@
+import { msg } from '@meith/i18n'
+import 'server-only'
+
+import {
+  buildPermissionMatrix,
+  type CopyPlan,
+  type ForumOverride,
+  type MatrixRow,
+  planCopyToDescendants,
+} from '@meith/authorization'
+import { ForbiddenError, type PermissionSet } from '@meith/core'
+import { getDb, PostgresForumAdminRepository } from '@meith/db'
+import type { ForumRow } from '@meith/forums'
+
+import { getContainer } from './container'
+
+export function forumAdminRepository(): PostgresForumAdminRepository | null {
+  return getContainer().dataSource === 'postgres' ? new PostgresForumAdminRepository(getDb()) : null
+}
+
+export function requireForumAdmin(): PostgresForumAdminRepository {
+  const repository = forumAdminRepository()
+  if (repository === null) {
+    throw new ForbiddenError(msg('error.app.board-running-in-memory-sample-data-12'))
+  }
+  return repository
+}
+
+export function ancestorChain(forum: ForumRow): readonly number[] {
+  return forum.path
+    .split('.')
+    .map((segment) => Number(segment))
+    .filter((id) => Number.isSafeInteger(id) && id > 0)
+    .reverse()
+}
+
+export interface ForumMatrixView {
+  readonly forum: ForumRow
+  readonly rows: readonly MatrixRow[]
+  readonly chain: readonly number[]
+  readonly overrides: readonly ForumOverride[]
+  readonly groups: readonly { readonly groupId: number; readonly title: string }[]
+  readonly descendants: readonly ForumRow[]
+}
+
+interface GroupRow {
+  readonly groupId: number
+  readonly title: string
+  readonly permissions: PermissionSet
+}
+
+async function allGroups(repository: PostgresForumAdminRepository): Promise<readonly GroupRow[]> {
+  const groups = await repository.listGroups()
+  const defaults = await getContainer().authorizationSource.groupDefaults(
+    groups.map((group) => group.id),
+  )
+  const byId = new Map(defaults.map((entry) => [entry.groupId, entry.permissions]))
+
+  return groups.map((group) => ({
+    groupId: group.id,
+    title: group.title,
+    permissions: byId.get(group.id) as PermissionSet,
+  }))
+}
+
+export async function buildForumMatrixView(forumId: number): Promise<ForumMatrixView | null> {
+  const repository = forumAdminRepository()
+  const { forums } = getContainer()
+  if (repository === null) return null
+
+  const all = await forums.listAll()
+  const forum = all.find((row) => row.id === forumId)
+  if (forum === undefined) return null
+
+  const chain = ancestorChain(forum)
+  const groups = await allGroups(repository)
+  const descendants = all.filter((row) => row.path.startsWith(`${forum.path}.`))
+
+  const overrides = await repository.readOverrides([...chain, ...descendants.map((row) => row.id)])
+
+  return {
+    forum,
+    chain,
+    overrides,
+    descendants,
+    groups: groups.map(({ groupId, title }) => ({ groupId, title })),
+    rows: buildPermissionMatrix({ chain, groups, overrides }),
+  }
+}
+
+export function previewCopy(view: ForumMatrixView): CopyPlan {
+  return planCopyToDescendants({
+    sourceForumId: view.forum.id,
+    descendantIds: view.descendants.map((row) => row.id),
+    groupIds: view.groups.map((group) => group.groupId),
+    overrides: view.overrides,
+  })
+}

package/src/server/group-admin-actions.ts

@@ -0,0 +1,341 @@
+'use server'
+
+import { revalidatePath } from 'next/cache'
+
+import { PERMISSION_FIELDS, ValidationError } from '@meith/core'
+import { permissionsCarryPower } from '@meith/db'
+import type { PromotionRuleInput } from '@meith/groups'
+import { msg } from '@meith/i18n'
+
+import { recordAdminAction, requireAdmin, requireFreshAdmin } from './admin'
+import type { FormState } from './auth-form-state'
+import { formStateReporter } from './form-state-reporter'
+import { checkbox, trimmedText } from './form-values'
+import { promotionService, requireGroupAdmin, requirePromotionRules } from './group-admin'
+import { assertSafeCssValue } from './theme-style'
+
+const CHUNK = 500
+
+function groupId(form: FormData, name = 'groupId'): number {
+  const id = Number(trimmedText(form, name))
+  if (!Number.isSafeInteger(id) || id <= 0) throw new ValidationError(msg('error.app.such-group'))
+  return id
+}
+
+const toFormState = formStateReporter('group-admin', 'group administration write failed')
+
+function refreshGroupScreens(): void {
+  revalidatePath('/admin/groups')
+  revalidatePath('/admin/groups/[id]', 'page')
+}
+
+function refreshPromotionScreen(): void {
+  revalidatePath('/admin/groups/promotions')
+}
+
+function ruleId(form: FormData): number {
+  const id = Number(trimmedText(form, 'id'))
+  if (!Number.isSafeInteger(id) || id <= 0)
+    throw new ValidationError(msg('error.app.such-promotion-rule'))
+  return id
+}
+
+function blankOr(form: FormData, name: string): number | null {
+  const raw = trimmedText(form, name)
+  return raw === '' ? null : Number(raw)
+}
+
+function promotionRuleInput(form: FormData): PromotionRuleInput {
+  return {
+    title: trimmedText(form, 'title'),
+    displayOrder: blankOr(form, 'displayOrder') ?? 0,
+    minPostCount: blankOr(form, 'minPostCount'),
+    minReputation: blankOr(form, 'minReputation'),
+    minDaysRegistered: blankOr(form, 'minDaysRegistered'),
+    fromPrimaryGroupId: blankOr(form, 'fromPrimaryGroupId'),
+    toPrimaryGroupId: Number(trimmedText(form, 'toPrimaryGroupId')),
+  }
+}
+
+function groupColour(form: FormData, field: string): string | null {
+  const value = trimmedText(form, field)
+  if (value === '') return null
+  assertSafeCssValue(`group colour "${field}"`, value)
+  return value
+}
+
+export async function saveGroupIdentityAction(
+  _prev: FormState,
+  form: FormData,
+): Promise<FormState> {
+  try {
+    await requireAdmin()
+    const id = groupId(form)
+
+    const title = trimmedText(form, 'title')
+    if (title === '') throw new ValidationError(msg('error.app.group-needs-title'))
+
+    const order = Number(trimmedText(form, 'displayOrder'))
+    if (!Number.isSafeInteger(order) || order < 0) {
+      throw new ValidationError(msg('error.app.display-order-must-whole-number'))
+    }
+
+    const isStaffGroup = checkbox(form, 'isStaffGroup')
+    const pluginGrantable = checkbox(form, 'pluginGrantable')
+
+    if (pluginGrantable) {
+      if (isStaffGroup) {
+        throw new ValidationError(msg('error.app.staff-group-granted-by-plugins'))
+      }
+      const repository = requireGroupAdmin()
+      const summary = (await repository.list()).find((group) => group.id === id)
+      if (summary?.isSystem === true) {
+        throw new ValidationError(msg('error.app.system-group-granted-by-plugins'))
+      }
+      const permissions = await repository.readPermissions(id)
+      if (permissions !== null && permissionsCarryPower(permissions)) {
+        throw new ValidationError(msg('error.app.group-carries-administrative-moderation-power'))
+      }
+    }
+
+    await requireGroupAdmin().updateIdentity(id, {
+      title,
+      description: trimmedText(form, 'description') || null,
+      displayOrder: order,
+      isStaffGroup,
+      pluginGrantable,
+      badgeToken: trimmedText(form, 'badgeToken') === '' ? null : trimmedText(form, 'badgeToken'),
+      nameColorLight: groupColour(form, 'nameColorLight'),
+      nameColorDark: groupColour(form, 'nameColorDark'),
+    })
+
+    refreshGroupScreens()
+    await recordAdminAction({ action: 'group.updated', detail: { groupId: id } })
+
+    return { notice: 'saved' }
+  } catch (err) {
+    return toFormState(err)
+  }
+}
+
+export async function saveGroupPermissionsAction(
+  _prev: FormState,
+  form: FormData,
+): Promise<FormState> {
+  try {
+    await requireAdmin()
+    const id = groupId(form)
+
+    const values: Record<string, boolean | number> = {}
+    for (const field of PERMISSION_FIELDS) {
+      if (field.kind === 'numeric') {
+        const raw = trimmedText(form, field.key)
+        const parsed = Number(raw)
+        if (raw !== '' && (!Number.isSafeInteger(parsed) || parsed < 0)) {
+          throw new ValidationError(`“${field.key}” must be a whole number, or blank for none.`)
+        }
+        values[field.key] = raw === '' ? field.fallback : parsed
+      } else {
+        values[field.key] = checkbox(form, field.key)
+      }
+    }
+
+    await requireGroupAdmin().savePermissions(id, values)
+
+    refreshGroupScreens()
+    await recordAdminAction({ action: 'group.permissions_changed', detail: { groupId: id } })
+
+    return { notice: 'saved' }
+  } catch (err) {
+    return toFormState(err)
+  }
+}
+
+export async function createGroupAction(_prev: FormState, form: FormData): Promise<FormState> {
+  try {
+    await requireAdmin()
+
+    const key = trimmedText(form, 'key')
+    if (!/^[a-z][a-z0-9_]*$/.test(key)) {
+      throw new ValidationError(msg('error.app.key-contain-lower-case-letters-numbers'))
+    }
+
+    const title = trimmedText(form, 'title')
+    if (title === '') throw new ValidationError(msg('error.app.group-needs-title'))
+
+    if (trimmedText(form, 'copyFromGroupId') === '') {
+      throw new ValidationError(msg('error.app.choose-group-copy-permissions-from'))
+    }
+
+    const id = await requireGroupAdmin().create({
+      key,
+      title,
+      copyFromGroupId: groupId(form, 'copyFromGroupId'),
+    })
+
+    refreshGroupScreens()
+    await recordAdminAction({ action: 'group.created', detail: { groupId: id, key } })
+
+    return { notice: 'created' }
+  } catch (err) {
+    return toFormState(err)
+  }
+}
+
+export async function deleteGroupAction(_prev: FormState, form: FormData): Promise<FormState> {
+  try {
+    await requireFreshAdmin()
+    const id = groupId(form)
+    const moveTo = groupId(form, 'moveMembersTo')
+
+    await requireGroupAdmin().remove(id, moveTo)
+
+    refreshGroupScreens()
+    await recordAdminAction({
+      action: 'group.deleted',
+      detail: { groupId: id, movedTo: moveTo },
+    })
+
+    return { notice: 'deleted' }
+  } catch (err) {
+    return toFormState(err)
+  }
+}
+
+export async function moveMembersAction(_prev: FormState, form: FormData): Promise<FormState> {
+  try {
+    await requireFreshAdmin()
+    const from = groupId(form, 'fromGroupId')
+    const to = groupId(form, 'toGroupId')
+
+    const after = Number(trimmedText(form, 'afterUserId') || '0')
+    if (!Number.isSafeInteger(after) || after < 0) {
+      throw new ValidationError(msg('error.app.lost-track-where-run-had'))
+    }
+
+    const chunk = await requireGroupAdmin().moveMembersChunk({
+      fromGroupId: from,
+      toGroupId: to,
+      afterUserId: after,
+      limit: CHUNK,
+    })
+
+    refreshGroupScreens()
+    await recordAdminAction({
+      action: 'group.members_moved',
+      detail: { fromGroupId: from, toGroupId: to, moved: chunk.moved },
+    })
+
+    const total = Number(trimmedText(form, 'movedSoFar') || '0') + chunk.moved
+
+    return {
+      notice: chunk.nextCursor === null ? 'finished' : 'more',
+      values: {
+        fromGroupId: String(from),
+        toGroupId: String(to),
+        afterUserId: String(chunk.nextCursor ?? 0),
+        movedSoFar: String(total),
+      },
+    }
+  } catch (err) {
+    return toFormState(err)
+  }
+}
+
+export async function createPromotionRuleAction(
+  _prev: FormState,
+  form: FormData,
+): Promise<FormState> {
+  try {
+    await requireAdmin()
+
+    const id = await requirePromotionRules().createRule(promotionRuleInput(form))
+
+    refreshPromotionScreen()
+    await recordAdminAction({ action: 'group.promotion_rule_added', detail: { ruleId: id } })
+
+    return { notice: 'created' }
+  } catch (err) {
+    return toFormState(err)
+  }
+}
+
+export async function updatePromotionRuleAction(
+  _prev: FormState,
+  form: FormData,
+): Promise<FormState> {
+  try {
+    await requireAdmin()
+    const id = ruleId(form)
+
+    await requirePromotionRules().updateRule(id, promotionRuleInput(form))
+
+    refreshPromotionScreen()
+    await recordAdminAction({ action: 'group.promotion_rule_changed', detail: { ruleId: id } })
+
+    return { notice: 'saved' }
+  } catch (err) {
+    return toFormState(err)
+  }
+}
+
+export async function setPromotionRuleEnabledAction(
+  _prev: FormState,
+  form: FormData,
+): Promise<FormState> {
+  try {
+    await requireAdmin()
+    const id = ruleId(form)
+    const enabled = checkbox(form, 'enabled')
+
+    await requirePromotionRules().setRuleEnabled(id, enabled)
+
+    refreshPromotionScreen()
+    await recordAdminAction({
+      action: 'group.promotion_rule_toggled',
+      detail: { ruleId: id, enabled },
+    })
+
+    return { notice: enabled ? 'enabled' : 'disabled' }
+  } catch (err) {
+    return toFormState(err)
+  }
+}
+
+export async function deletePromotionRuleAction(
+  _prev: FormState,
+  form: FormData,
+): Promise<FormState> {
+  try {
+    await requireFreshAdmin()
+    const id = ruleId(form)
+
+    await requirePromotionRules().deleteRule(id)
+
+    refreshPromotionScreen()
+    await recordAdminAction({ action: 'group.promotion_rule_removed', detail: { ruleId: id } })
+
+    return { notice: 'deleted' }
+  } catch (err) {
+    return toFormState(err)
+  }
+}
+
+export async function applyPromotionsAction(_prev: FormState, _form: FormData): Promise<FormState> {
+  try {
+    await requireFreshAdmin()
+
+    const result = await promotionService().apply()
+
+    refreshGroupScreens()
+    refreshPromotionScreen()
+    await recordAdminAction({
+      action: 'group.promotions_applied',
+      detail: { promoted: result.outcomes.length, examined: result.examined },
+    })
+
+    return { notice: `promoted:${result.outcomes.length}` }
+  } catch (err) {
+    return toFormState(err)
+  }
+}

package/src/server/group-admin.ts

@@ -0,0 +1,98 @@
+import { msg } from '@meith/i18n'
+import 'server-only'
+
+import type { PermissionField, PermissionSet } from '@meith/core'
+import { ForbiddenError, PERMISSION_FIELDS } from '@meith/core'
+import {
+  type GroupSummaryRow,
+  getDb,
+  PostgresGroupAdminRepository,
+  PostgresPromotionRepository,
+} from '@meith/db'
+import { type PromotionRunResult, PromotionService } from '@meith/groups'
+import { defaultPromotionGuards } from '@meith/runtime'
+
+import { getContainer } from './container'
+
+export function groupAdminRepository(): PostgresGroupAdminRepository | null {
+  return getContainer().dataSource === 'postgres' ? new PostgresGroupAdminRepository(getDb()) : null
+}
+
+export function requireGroupAdmin(): PostgresGroupAdminRepository {
+  const repository = groupAdminRepository()
+  if (repository === null) {
+    throw new ForbiddenError(msg('error.app.board-running-in-memory-sample-data-18'))
+  }
+  return repository
+}
+
+export interface GroupPermissionCell {
+  readonly key: string
+  readonly description: string
+  readonly kind: PermissionField['kind']
+  readonly scope: PermissionField['scope']
+  readonly value: boolean | number
+}
+
+export interface GroupPermissionView {
+  readonly group: GroupSummaryRow
+  readonly cells: readonly GroupPermissionCell[]
+}
+
+export async function buildGroupPermissionView(
+  groupId: number,
+): Promise<GroupPermissionView | null> {
+  const repository = groupAdminRepository()
+  if (repository === null) return null
+
+  const group = (await repository.list()).find((row) => row.id === groupId)
+  if (group === undefined) return null
+
+  const permissions = await repository.readPermissions(groupId)
+  if (permissions === null) return null
+
+  return { group, cells: permissionCells(permissions) }
+}
+
+function permissionCells(permissions: PermissionSet): readonly GroupPermissionCell[] {
+  return PERMISSION_FIELDS.map((field) => ({
+    key: field.key,
+    description: field.description,
+    kind: field.kind,
+    scope: field.scope,
+    value:
+      (permissions as unknown as Record<string, boolean | number>)[field.key] ?? field.fallback,
+  }))
+}
+
+export function promotionRuleRepository(): PostgresPromotionRepository | null {
+  return getContainer().dataSource === 'postgres' ? new PostgresPromotionRepository(getDb()) : null
+}
+
+export function requirePromotionRules(): PostgresPromotionRepository {
+  const repository = promotionRuleRepository()
+  if (repository === null) {
+    throw new ForbiddenError(msg('error.app.board-running-in-memory-sample-data-19'))
+  }
+  return repository
+}
+
+export async function previewPromotions(limit = 500): Promise<PromotionRunResult | null> {
+  if (getContainer().dataSource !== 'postgres') return null
+
+  const service = new PromotionService({
+    promotions: new PostgresPromotionRepository(getDb()),
+    guards: defaultPromotionGuards(),
+  })
+  return service.preview(limit)
+}
+
+export function promotionService(): PromotionService {
+  if (getContainer().dataSource !== 'postgres') {
+    throw new ForbiddenError(msg('error.app.board-running-in-memory-sample-data-20'))
+  }
+  return new PromotionService({
+    promotions: new PostgresPromotionRepository(getDb()),
+    guards: defaultPromotionGuards(),
+  })
+}

package/src/server/group-badge-actions.ts

@@ -0,0 +1,61 @@
+'use server'
+
+import { ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+
+import { recordAdminAction, requireAdmin } from './admin'
+import type { FormState } from './auth-form-state'
+import { formStateReporter } from './form-state-reporter'
+import { BADGE_FIELD, removeBadge, saveBadge } from './group-badge'
+import { type ImageScheme, isImageScheme } from './image-upload'
+
+const toFormState = formStateReporter('group-badge', 'badge write failed')
+
+function target(form: FormData): { groupId: number; scheme: ImageScheme } {
+  const raw = form.get('groupId')
+  const groupId = typeof raw === 'string' ? Number(raw) : Number.NaN
+  if (!Number.isSafeInteger(groupId) || groupId <= 0) {
+    throw new ValidationError(msg('error.app.such-group'))
+  }
+
+  const scheme = form.get('scheme')
+  if (!isImageScheme(scheme)) throw new ValidationError(msg('error.app.such-badge'))
+
+  return { groupId, scheme }
+}
+
+export async function saveBadgeAction(_prev: FormState, form: FormData): Promise<FormState> {
+  try {
+    await requireAdmin()
+    const { groupId, scheme } = target(form)
+
+    const file = form.get(BADGE_FIELD)
+    if (!(file instanceof File) || file.size === 0) {
+      throw new ValidationError(msg('error.app.choose-image-first'))
+    }
+
+    await saveBadge(groupId, scheme, file)
+    await recordAdminAction({
+      action: 'group.badge_saved',
+      detail: { groupId, scheme, bytes: file.size },
+    })
+
+    return { notice: 'saved' }
+  } catch (err) {
+    return toFormState(err)
+  }
+}
+
+export async function removeBadgeAction(_prev: FormState, form: FormData): Promise<FormState> {
+  try {
+    await requireAdmin()
+    const { groupId, scheme } = target(form)
+
+    await removeBadge(groupId, scheme)
+    await recordAdminAction({ action: 'group.badge_removed', detail: { groupId, scheme } })
+
+    return { notice: 'removed' }
+  } catch (err) {
+    return toFormState(err)
+  }
+}

package/src/server/group-badge.ts

@@ -0,0 +1,62 @@
+import 'server-only'
+
+import { cache } from 'react'
+
+import { CacheTags } from '@meith/core'
+import { getDb, PostgresGroupAdminRepository } from '@meith/db'
+import { drivers } from '@meith/drivers'
+
+import { getContainer } from './container'
+import { forgetImage, type ImageScheme, storeImage } from './image-upload'
+
+export const BADGE_FIELD = 'badge'
+
+const KEY_SHAPE = /^group\/(\d+)\/badge-(light|dark)-[a-f0-9-]{36}\.(png|jpg|webp|svg)$/
+
+function repository(): PostgresGroupAdminRepository | null {
+  return getContainer().dataSource === 'postgres' ? new PostgresGroupAdminRepository(getDb()) : null
+}
+
+export function badgeSrc(groupId: number, scheme: ImageScheme, key: string): string {
+  return `/group/${groupId}/badge/${scheme}?v=${key.slice(-16, -4)}`
+}
+
+export const badgeKey = cache(
+  async (groupId: number, scheme: ImageScheme): Promise<string | null> => {
+    const repo = repository()
+    if (repo === null) return null
+
+    const group = (await repo.list().catch(() => [])).find((row) => row.id === groupId)
+    const key = scheme === 'dark' ? group?.badgeImageDark : group?.badgeImageLight
+    if (typeof key !== 'string' || !KEY_SHAPE.test(key)) return null
+
+    return KEY_SHAPE.exec(key)?.[1] === String(groupId) ? key : null
+  },
+)
+
+export async function saveBadge(groupId: number, scheme: ImageScheme, file: File): Promise<void> {
+  const repo = requireGroups()
+  const key = await storeImage(`group/${groupId}`, `badge-${scheme}`, file)
+
+  const previous = await repo.setBadge(groupId, scheme, key)
+  await invalidate()
+  if (previous !== key) await forgetImage(previous)
+}
+
+export async function removeBadge(groupId: number, scheme: ImageScheme): Promise<void> {
+  const previous = await requireGroups().setBadge(groupId, scheme, null)
+  await invalidate()
+  await forgetImage(previous)
+}
+
+function requireGroups(): PostgresGroupAdminRepository {
+  const repo = repository()
+  if (repo === null) {
+    throw new Error('This board is running on in-memory sample data, so groups cannot be edited.')
+  }
+  return repo
+}
+
+async function invalidate(): Promise<void> {
+  await drivers().cache.invalidateTags([CacheTags.groups()])
+}