@meith/web 0.16.0

package/src/server/group-identity.ts

@@ -0,0 +1,104 @@
+import 'server-only'
+
+import { cache } from 'react'
+
+import { CacheTags, cachedGlobal } from '@meith/core'
+import {
+  type GroupIdentity,
+  getDb,
+  type MemberStanding,
+  PostgresGroupIdentityRepository,
+} from '@meith/db'
+import { drivers } from '@meith/drivers'
+
+import type { MemberIdentity } from '@/view/member-identity'
+
+import { getContainer } from './container'
+import { badgeSrc } from './group-badge'
+import { currentColourScheme } from './theme'
+import { groupNameClass, renderGroupNameStyle } from './theme-style'
+
+export type { MemberIdentity }
+export { groupNameClass }
+
+function repository(): PostgresGroupIdentityRepository | null {
+  return getContainer().dataSource === 'postgres'
+    ? new PostgresGroupIdentityRepository(getDb())
+    : null
+}
+
+const TTL_SECONDS = 60
+
+function loadStyled(): Promise<readonly GroupIdentity[]> {
+  return cachedGlobal(
+    drivers().cache,
+    {
+      key: ['group-identity-styles'],
+      tags: [CacheTags.groups()],
+      revalidate: TTL_SECONDS,
+    },
+    async () => {
+      const repo = repository()
+      return repo === null ? [] : repo.styled()
+    },
+  )
+}
+
+export const getGroupStyle = cache(async (): Promise<string> => {
+  const groups = await loadStyled().catch(() => [])
+  return renderGroupNameStyle(
+    groups.map((group) => ({
+      groupId: group.groupId,
+      light: group.nameColorLight,
+      dark: group.nameColorDark,
+    })),
+  )
+})
+
+function resolveBadge(
+  group: GroupIdentity,
+  scheme: 'light' | 'dark' | 'system',
+): MemberIdentity['badge'] {
+  const light = group.badgeImageLight ?? group.badgeImageDark
+  const dark = group.badgeImageDark ?? group.badgeImageLight
+  if (light === null || dark === null) return null
+
+  const alt = group.title
+  const lightSrc = badgeSrc(group.groupId, group.badgeImageLight === null ? 'dark' : 'light', light)
+  const darkSrc = badgeSrc(group.groupId, group.badgeImageDark === null ? 'light' : 'dark', dark)
+
+  if (scheme === 'light') return { src: lightSrc, darkSrc: null, alt }
+  if (scheme === 'dark') return { src: darkSrc, darkSrc: null, alt }
+  return { src: lightSrc, darkSrc: darkSrc === lightSrc ? null : darkSrc, alt }
+}
+
+const load = cache(async (key: string): Promise<ReadonlyMap<number, MemberStanding>> => {
+  const repo = repository()
+  if (repo === null) return new Map()
+  return repo.forUsers(key.split(',').map(Number)).catch(() => new Map<number, MemberStanding>())
+})
+
+export async function identitiesFor(
+  userIds: readonly number[],
+): Promise<ReadonlyMap<number, MemberIdentity>> {
+  const ids = [...new Set(userIds)].sort((a, b) => a - b)
+  if (ids.length === 0) return new Map()
+
+  const [rows, scheme] = await Promise.all([load(ids.join(',')), currentColourScheme()])
+
+  return new Map(
+    [...rows].map(([userId, group]) => [
+      userId,
+      {
+        groupId: group.groupId,
+        title: group.title,
+        nameClass:
+          group.nameColorLight === null && group.nameColorDark === null
+            ? null
+            : groupNameClass(group.groupId),
+        badge: resolveBadge(group, scheme),
+        reputation: group.reputation,
+      },
+    ]),
+  )
+}

package/src/server/i18n-catalogs.ts

@@ -0,0 +1,42 @@
+import 'server-only'
+
+import forumConfig from '@board/config'
+
+import {
+  BOARD_CATALOG,
+  createCatalogRegistry,
+  createTranslator,
+  type Translator,
+} from '@meith/i18n'
+
+import { resolveLocale } from '@/view/locale'
+
+import { getSettings } from './settings'
+
+export const catalogs = createCatalogRegistry([
+  BOARD_CATALOG,
+  ...Object.values(forumConfig.themes).flatMap((theme) =>
+    theme.messages === undefined ? [] : [{ id: `theme:${theme.key}`, messages: theme.messages }],
+  ),
+  ...(forumConfig.plugins ?? []).flatMap((entry) =>
+    entry.enabled === false || entry.messages === undefined
+      ? []
+      : [{ id: `plugin:${entry.key}`, messages: entry.messages }],
+  ),
+  ...(forumConfig.messages === undefined ? [] : [{ id: 'board', messages: forumConfig.messages }]),
+])
+
+export async function translatorForLocale(locale: string): Promise<Translator> {
+  const settings = await getSettings()
+  const resolved = resolveLocale({
+    stored: locale,
+    accepted: null,
+    boardDefault: settings.get('display.default_locale'),
+    supported: catalogs.locales,
+  })
+
+  return createTranslator({
+    locale: resolved.locale,
+    catalog: catalogs.catalogFor(resolved.locale),
+  })
+}

package/src/server/i18n.ts

@@ -0,0 +1,69 @@
+import 'server-only'
+
+import { headers } from 'next/headers'
+import { cache } from 'react'
+
+import type { MessageResolver } from '@meith/core'
+import { createTranslator, type Translator } from '@meith/i18n'
+
+import { type ResolvedLocale, resolveLocale } from '@/view/locale'
+
+import { catalogs, translatorForLocale } from './i18n-catalogs'
+import { getSettings } from './settings'
+import { getViewerPreferences } from './viewer-preferences'
+
+export { catalogs, translatorForLocale }
+
+const acceptedLanguages = cache(async (): Promise<string | null> => {
+  try {
+    return (await headers()).get('accept-language')
+  } catch {
+    return null
+  }
+})
+
+export const getLocale = cache(async (): Promise<ResolvedLocale> => {
+  const [preferences, accepted] = await Promise.all([
+    getViewerPreferences().catch(() => null),
+    acceptedLanguages(),
+  ])
+
+  let boardDefault: string | null = null
+  try {
+    boardDefault = (await getSettings()).get('display.default_locale')
+  } catch {
+    /* ignore */
+  }
+
+  return resolveLocale({
+    stored: preferences?.locale ?? null,
+    accepted,
+    boardDefault,
+    supported: catalogs.locales,
+  })
+})
+
+export const getTranslator = cache(async (): Promise<Translator> => {
+  const [{ locale }, preferences] = await Promise.all([
+    getLocale(),
+    getViewerPreferences().catch(() => null),
+  ])
+
+  return createTranslator({
+    locale,
+    catalog: catalogs.catalogFor(locale),
+    ...(preferences === null ? {} : { timeZone: preferences.timezone }),
+  })
+})
+
+export const getMessageResolver = cache(async (): Promise<MessageResolver> => {
+  const translator = await getTranslator()
+  return (key, args) => (translator.has(key) ? translator.t(key, args) : undefined)
+})
+
+export async function tr(
+  key: string,
+  args?: Readonly<Record<string, string | number>>,
+): Promise<string> {
+  return (await getTranslator()).t(key, args)
+}

package/src/server/image-upload.ts

@@ -0,0 +1,109 @@
+import { msg } from '@meith/i18n'
+import 'server-only'
+
+import { ValidationError } from '@meith/core'
+import { drivers } from '@meith/drivers'
+
+export const IMAGE_SCHEMES = ['light', 'dark'] as const
+export type ImageScheme = (typeof IMAGE_SCHEMES)[number]
+
+export function isImageScheme(value: unknown): value is ImageScheme {
+  return IMAGE_SCHEMES.includes(value as ImageScheme)
+}
+
+export const MAX_IMAGE_BYTES = 512 * 1024
+
+export interface ImageFormat {
+  readonly extension: string
+  readonly contentType: string
+}
+
+export const CONTENT_TYPE_BY_EXTENSION: Readonly<Record<string, string>> = {
+  png: 'image/png',
+  jpg: 'image/jpeg',
+  webp: 'image/webp',
+  svg: 'image/svg+xml',
+}
+
+export const IMAGE_ACCEPT = 'image/png,image/jpeg,image/webp,image/svg+xml'
+
+function startsAt(bytes: Uint8Array, offset: number, ...signature: number[]): boolean {
+  return signature.every((byte, index) => bytes[offset + index] === byte)
+}
+
+export function sniff(bytes: Uint8Array): ImageFormat | null {
+  if (startsAt(bytes, 0, 0x89, 0x50, 0x4e, 0x47)) {
+    return { extension: 'png', contentType: 'image/png' }
+  }
+  if (startsAt(bytes, 0, 0xff, 0xd8, 0xff)) {
+    return { extension: 'jpg', contentType: 'image/jpeg' }
+  }
+  if (startsAt(bytes, 0, 0x52, 0x49, 0x46, 0x46) && startsAt(bytes, 8, 0x57, 0x45, 0x42, 0x50)) {
+    return { extension: 'webp', contentType: 'image/webp' }
+  }
+  if (isSvg(bytes)) return { extension: 'svg', contentType: 'image/svg+xml' }
+
+  return null
+}
+
+function isSvg(bytes: Uint8Array): boolean {
+  const decoder = new TextDecoder('utf-8', { fatal: false })
+  const head = decoder
+    .decode(bytes.slice(0, 4096))
+    .replace(/^\uFEFF/, '')
+    .trimStart()
+
+  const looksSvg = head.startsWith('<svg') || /^<\?xml[\s\S]{0,512}?<svg/i.test(head)
+  if (!looksSvg) return false
+
+  if (/<script|<foreignObject|\son\w+\s*=|javascript:/i.test(decoder.decode(bytes))) {
+    throw new ValidationError(msg('error.app.svg-contains-script-event-handler'))
+  }
+  return true
+}
+
+export async function storeImage(prefix: string, name: string, file: File): Promise<string> {
+  if (file.size === 0) throw new ValidationError(msg('error.app.choose-image-first'))
+  if (file.size > MAX_IMAGE_BYTES) {
+    throw new ValidationError(
+      `That image is ${Math.ceil(file.size / 1024)} KiB. The limit is ` +
+        `${MAX_IMAGE_BYTES / 1024} KiB — it is displayed a few dozen pixels tall, ` +
+        'so it does not need to be large.',
+    )
+  }
+
+  const bytes = new Uint8Array(await file.arrayBuffer())
+  const format = sniff(bytes)
+  if (format === null) {
+    throw new ValidationError(msg('error.app.file-png-jpeg-webp-svg'))
+  }
+
+  const key = `${prefix}/${name}-${crypto.randomUUID()}.${format.extension}`
+  await drivers().files.put(key, bytes, {
+    contentType: format.contentType,
+    visibility: 'public',
+  })
+
+  return key
+}
+
+export async function forgetImage(key: string | null): Promise<void> {
+  if (key === null || key === '') return
+  await drivers()
+    .files.delete(key)
+    .catch(() => {})
+}
+
+export function contentTypeFor(key: string): string {
+  return CONTENT_TYPE_BY_EXTENSION[key.split('.').pop() ?? ''] ?? 'application/octet-stream'
+}
+
+export function imageHeaders(key: string, byteLength: number): HeadersInit {
+  return {
+    'Content-Type': contentTypeFor(key),
+    'Content-Length': String(byteLength),
+    'X-Content-Type-Options': 'nosniff',
+    'Content-Security-Policy': "default-src 'none'; sandbox",
+    'Cache-Control': 'public, max-age=31536000, immutable',
+  }
+}

package/src/server/inline-moderation-actions.ts

@@ -0,0 +1,129 @@
+'use server'
+
+import { redirect } from 'next/navigation'
+
+import { type Action, type Actor, hasAnyModeratorRight } from '@meith/authorization'
+import { ForbiddenError, ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+import {
+  INLINE_TOOL_ACTIONS,
+  InlineModeration,
+  type InlineOutcome,
+  type InlineRights,
+  type InlineTool,
+  parseInlineTool,
+  parseSelection,
+} from '@meith/moderation'
+
+import type { FormState } from './auth-form-state'
+import { getContainer } from './container'
+import { getActor } from './context'
+import { formStateReporter } from './form-state-reporter'
+import { positiveInt } from './form-values'
+import { tr } from './i18n'
+import { emitEvent } from './plugin-view'
+import { isSafeLocalPath } from './safe-path'
+
+const toFormState = formStateReporter('inline-moderation', 'unexpected error in inline moderation')
+
+function safeReturn(form: FormData): string {
+  const raw = form.get('returnTo')
+  if (typeof raw === 'string' && isSafeLocalPath(raw)) return raw
+  return '/'
+}
+
+function outcomeQuery(outcome: InlineOutcome): string {
+  const parts = [`did=${outcome.tool}`, `n=${outcome.applied}`]
+  if (outcome.refused > 0) parts.push(`refused=${outcome.refused}`)
+  if (outcome.missing > 0) parts.push(`gone=${outcome.missing}`)
+  if (outcome.skipped > 0) parts.push(`skipped=${outcome.skipped}`)
+  return parts.join('&')
+}
+
+export async function inlineModerateAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const tool = parseInlineTool(
+    typeof form.get('tool') === 'string' ? (form.get('tool') as string) : undefined,
+  )
+  if (tool === null) return { error: await tr('notice.app.choose-what-with-selected-items') }
+
+  const { inlineModeration } = getContainer()
+  if (inlineModeration === null) {
+    return {
+      error: await tr('notice.app.board-running-in-memory-sample-data-4'),
+    }
+  }
+
+  const toForumId = positiveInt(form, 'toForumId')
+  const returnTo = safeReturn(form)
+
+  let outcome: InlineOutcome
+  try {
+    const actor = await getActor()
+    if (actor.userId === null) throw new ForbiddenError(msg('error.app.must-logged-moderate'))
+
+    const selection = parseSelection(
+      form.getAll('item').filter((v): v is string => typeof v === 'string'),
+    )
+    if (selection.length === 0) throw new ValidationError(msg('error.app.select-at-least-one-item'))
+
+    const scopeForumIds = await scopeFor(tool, actor)
+    if (scopeForumIds.length === 0) {
+      throw new ForbiddenError(msg('error.app.moderate-anything-here'))
+    }
+
+    outcome = await new InlineModeration({ inline: inlineModeration }).apply({
+      selection,
+      tool,
+      ...(toForumId === null ? {} : { toForumId }),
+      scopeForumIds,
+      rights: { rightsIn: (forumId) => rightsIn(actor, forumId) },
+      actorUserId: actor.userId,
+    })
+
+    if (outcome.applied > 0) {
+      await emitEvent(
+        'moderation.logged',
+        { action: `inline.${outcome.tool}`, targetId: null },
+        { moderatorId: actor.userId, reason: null },
+      )
+    }
+  } catch (err) {
+    return toFormState(err)
+  }
+
+  const separator = returnTo.includes('?') ? '&' : '?'
+  redirect(`${returnTo}${separator}${outcomeQuery(outcome)}`)
+}
+
+async function scopeFor(tool: InlineTool, actor: Actor): Promise<number[]> {
+  const { authorizer } = getContainer()
+  const sets = await Promise.all(
+    INLINE_TOOL_ACTIONS[tool].map((action) => authorizer.forumIdsWhere(actor, action as Action)),
+  )
+  return [...new Set(sets.flat())]
+}
+
+async function rightsIn(actor: Actor, forumId: number): Promise<InlineRights> {
+  const { authorizer } = getContainer()
+  const [forum, moderatorRights] = await Promise.all([
+    authorizer.forumMatrix(actor, forumId),
+    authorizer.moderatorRightsIn(actor, forumId),
+  ])
+  const target = {
+    forumId,
+    forum,
+    moderatorRights,
+    isForumModerator: hasAnyModeratorRight(moderatorRights),
+  }
+
+  return {
+    approve: authorizer.can(actor, 'content.approve', target),
+    lock: authorizer.can(actor, 'thread.lock', target),
+    stick: authorizer.can(actor, 'thread.stick', target),
+    move: authorizer.can(actor, 'thread.move', target),
+    deleteThreads: authorizer.can(actor, 'thread.delete', target),
+    deletePosts: authorizer.can(actor, 'post.softDelete', target),
+    restoreThreads: authorizer.can(actor, 'thread.restore', target),
+    restorePosts: authorizer.can(actor, 'post.restore', target),
+  }
+}

package/src/server/install-actions.ts

@@ -0,0 +1,124 @@
+'use server'
+
+import { redirect } from 'next/navigation'
+
+import { env } from '@meith/core'
+import {
+  canProceed,
+  ECHOED_FIELDS,
+  fieldErrorsFromReport,
+  firstFailure,
+  installInputFromForm,
+  MAIL_SKIP,
+  mailConfigFromInstallInput,
+  parseInstallInput,
+  type StepOutcome,
+  stepTitleKey,
+  withEnvironmentAnswers,
+} from '@meith/install'
+import { mailConfigFromEnvironment } from '@meith/settings'
+
+import { getTranslator } from './i18n'
+import { gatherPreflight, installerIsSealed, runInstall } from './install'
+import { sendTestMail } from './mail-test'
+
+export interface InstallFormState {
+  readonly errors?: Record<string, string>
+  readonly failedStep?: {
+    readonly id: string
+    readonly title: string
+    readonly error: string
+  }
+  readonly report?: readonly StepOutcome[]
+  readonly values?: Record<string, string>
+}
+
+export async function installAction(
+  _previous: InstallFormState,
+  form: FormData,
+): Promise<InstallFormState> {
+  const submitted = withEnvironmentAnswers(installInputFromForm(form), {
+    boardUrl: env.APP_URL ?? null,
+    mailIsFromEnvironment: mailConfigFromEnvironment(env) !== null,
+  })
+
+  const values = Object.fromEntries(
+    ECHOED_FIELDS.map((name) => [name, submitted[name] ?? '']),
+  ) as Record<string, string>
+
+  if (await installerIsSealed()) {
+    redirect('/')
+  }
+
+  const parsed = parseInstallInput(submitted)
+  const t = await getTranslator()
+  if (!parsed.ok) return { errors: translatedErrors(parsed.errors, t), values }
+
+  if (!canProceed(await gatherPreflight())) {
+    return {
+      errors: {
+        form: t.t('installAction.notReady'),
+      },
+      values,
+    }
+  }
+
+  if (parsed.value.mailPreset !== MAIL_SKIP) {
+    const test = await sendTestMail({
+      config: mailConfigFromInstallInput(parsed.value),
+      to: parsed.value.email,
+      boardName: parsed.value.boardName,
+      t,
+    })
+
+    if (!test.ok) {
+      return {
+        errors: {
+          mailPreset: t.t('installAction.mailFailed', {
+            email: parsed.value.email,
+            error: test.error ?? t.t('installAction.noProviderResponse'),
+          }),
+        },
+        values,
+      }
+    }
+  }
+
+  const run = await runInstall(parsed.value)
+  if ('sealed' in run) redirect('/')
+
+  const { report } = run
+  const failure = firstFailure(report)
+
+  if (failure !== null) {
+    return {
+      failedStep: {
+        id: failure.id,
+        title: t.t(stepTitleKey(failure.id)),
+        error: translatedFailure(failure.error, t),
+      },
+      errors: translatedErrors(fieldErrorsFromReport(report), t),
+      report,
+      values,
+    }
+  }
+
+  redirect('/login?installed=1')
+}
+
+function translatedFailure(
+  error: string | undefined,
+  t: Awaited<ReturnType<typeof getTranslator>>,
+) {
+  if (error === undefined) return t.t('installAction.unknownFailure')
+  return t.has(error) ? t.t(error) : error
+}
+
+function translatedErrors(
+  errors: Record<string, string>,
+  t: Awaited<ReturnType<typeof getTranslator>>,
+) {
+  return Object.fromEntries(
+    Object.entries(errors).map(([field, error]) => [field, t.has(error) ? t.t(error) : error]),
+  )
+}