@meith/web 0.16.0

package/src/server/relation-actions.ts

@@ -0,0 +1,89 @@
+'use server'
+
+import { redirect } from 'next/navigation'
+
+import { ForbiddenError, ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+import { parseRelationKind } from '@meith/relations'
+
+import type { FormState } from './auth-form-state'
+import { getActor } from './context'
+import { formStateReporter } from './form-state-reporter'
+import { trimmedText } from './form-values'
+import { isStaff, relationService } from './relations'
+import { isSafeLocalPath } from './safe-path'
+
+const toFormState = formStateReporter('relation-actions', 'unexpected error in a relation action')
+
+function positiveInt(form: FormData, name: string): number | null {
+  const value = Number(trimmedText(form, name))
+  return Number.isInteger(value) && value > 0 ? value : null
+}
+
+async function requireLists(): Promise<{
+  service: NonNullable<ReturnType<typeof relationService>>
+  userId: number
+}> {
+  const actor = await getActor()
+  if (actor.userId === null) throw new ForbiddenError(msg('error.app.must-logged'))
+
+  const service = relationService()
+  if (service === null) {
+    throw new ForbiddenError(msg('error.app.board-running-in-memory-sample-data-15'))
+  }
+
+  return { service, userId: actor.userId }
+}
+
+function safeReturn(form: FormData): string {
+  const raw = trimmedText(form, 'returnTo')
+  return isSafeLocalPath(raw) ? raw : '/usercp/contacts'
+}
+
+export async function setRelationAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const returnTo = safeReturn(form)
+  let query: string
+
+  try {
+    const { service, userId } = await requireLists()
+
+    const otherUserId = positiveInt(form, 'userId')
+    const username = trimmedText(form, 'username')
+    const kind = parseRelationKind(trimmedText(form, 'kind'))
+
+    if (otherUserId === null) throw new ValidationError(msg('error.app.such-member'))
+    if (kind === null) throw new ValidationError(msg('error.app.list'))
+
+    await service.set({
+      userId,
+      otherUserId,
+      kind,
+      ...(kind === 'ignore' ? { targetIsStaff: await isStaff(otherUserId) } : {}),
+    })
+
+    query = `${kind === 'ignore' ? 'ignored' : 'added'}=${encodeURIComponent(username)}`
+  } catch (err) {
+    return toFormState(err)
+  }
+
+  redirect(`${returnTo}${returnTo.includes('?') ? '&' : '?'}${query}`)
+}
+
+export async function removeRelationAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const returnTo = safeReturn(form)
+  let query: string
+
+  try {
+    const { service, userId } = await requireLists()
+
+    const otherUserId = positiveInt(form, 'userId')
+    if (otherUserId === null) throw new ValidationError(msg('error.app.such-member'))
+
+    await service.remove(userId, otherUserId)
+    query = `removed=${encodeURIComponent(trimmedText(form, 'username'))}`
+  } catch (err) {
+    return toFormState(err)
+  }
+
+  redirect(`${returnTo}${returnTo.includes('?') ? '&' : '?'}${query}`)
+}

package/src/server/relations.ts

@@ -0,0 +1,45 @@
+import 'server-only'
+
+import { cache } from 'react'
+
+import { RelationService } from '@meith/relations'
+
+import { getContainer } from './container'
+import { getActor } from './context'
+
+export function relationService(): RelationService | null {
+  const { relations } = getContainer()
+  return relations === null ? null : new RelationService({ relations })
+}
+
+export const viewerIgnoredIds = cache(async (): Promise<ReadonlySet<number>> => {
+  const service = relationService()
+  const actor = await getActor()
+  if (service === null || actor.userId === null) return new Set()
+
+  try {
+    return new Set(await service.ignoredIds(actor.userId))
+  } catch {
+    return new Set()
+  }
+})
+
+export async function isStaff(userId: number): Promise<boolean> {
+  const { actorSource, authorizer } = getContainer()
+  const actor = await actorSource.buildForUser(userId)
+  if (actor === null) return false
+  return authorizer.can(actor, 'modcp.access')
+}
+
+const ACTIVITY_WINDOW_SECONDS = 300
+
+export async function touchActivity(userId: number | null): Promise<void> {
+  if (userId === null) return
+
+  try {
+    const { accountStore } = getContainer()
+    await accountStore.accounts.touchLastActive(userId, new Date(), ACTIVITY_WINDOW_SECONDS)
+  } catch {
+    /* ignore */
+  }
+}

package/src/server/reply-core.ts

@@ -0,0 +1,173 @@
+import { msg } from '@meith/i18n'
+import 'server-only'
+
+import type { Actor } from '@meith/authorization'
+import { ForbiddenError, ValidationError } from '@meith/core'
+import { restrictsPosting } from '@meith/moderation'
+import { type AuthorRestriction, ReplyComposer, type ReplyTarget } from '@meith/threads'
+
+import {
+  dailyLimitMessage,
+  holdsNewMember,
+  limitMessage,
+  spendDailyLimit,
+  spendLimit,
+} from './antispam'
+import type { AttachmentScope } from './attachments'
+import { getContainer } from './container'
+import { emitEvent, filterView, viewerRef } from './plugin-view'
+import { notifyPostAudience } from './post-notifications'
+import { getSettings } from './settings'
+
+export interface ResolvedReplyTarget {
+  readonly target: ReplyTarget
+  readonly forumId: number
+  readonly scope: AttachmentScope
+}
+
+export async function resolveReplyTarget(
+  actor: Actor,
+  threadId: number,
+): Promise<ResolvedReplyTarget> {
+  const { authorizer, threadWrites } = getContainer()
+
+  if (threadWrites === null) {
+    throw new ValidationError(msg('error.app.board-running-in-memory-sample-data-8'))
+  }
+
+  const target = await threadWrites.replyTarget(threadId)
+  if (!target) throw new ValidationError(msg('error.app.thread-exist'))
+
+  const forumId = target.forum.id
+  const scope = {
+    forumId,
+    forum: await authorizer.forumMatrix(actor, forumId),
+    allowsAttachments: target.forum.allowAttachments,
+  }
+
+  if (
+    !authorizer.can(actor, 'thread.view', {
+      ...(await authorizer.moderatorTargetIn(actor, forumId, scope.forum)),
+      threadAuthorId: target.authorUserId,
+    })
+  ) {
+    throw new ValidationError(msg('error.app.thread-exist'))
+  }
+  authorizer.require(actor, 'reply.post', scope)
+
+  if (actor.userId === null) {
+    throw new ForbiddenError(msg('error.app.must-logged-post'))
+  }
+
+  return { target, forumId, scope }
+}
+
+export interface SubmitReplyInput {
+  readonly message: string
+  readonly subscribe?: boolean
+  readonly seenLastPostId?: number | null
+}
+
+export async function submitReply(
+  actor: Actor,
+  resolved: ResolvedReplyTarget,
+  input: SubmitReplyInput,
+): Promise<Awaited<ReturnType<ReplyComposer['create']>>> {
+  const { authorizer, threadWrites, memberProfiles, warnings } = getContainer()
+  if (threadWrites === null) {
+    throw new ValidationError(msg('error.app.board-accept-posts'))
+  }
+
+  const userId = actor.userId
+  if (userId === null) throw new ForbiddenError(msg('error.app.must-logged-post'))
+
+  const settings = await getSettings()
+  const { scope, target, forumId } = resolved
+
+  const limited = await spendLimit({ scope: 'post', actor, settings })
+  if (limited !== null && !limited.allowed) throw new ValidationError(limitMessage(limited))
+
+  const daily = await spendDailyLimit({ scope: 'post_day', actor })
+  if (daily !== null && !daily.allowed) {
+    throw new ValidationError(dailyLimitMessage('post_day', daily))
+  }
+
+  const composer = new ReplyComposer({
+    posts: threadWrites,
+    config: {
+      floodSeconds: settings.get('posting.flood_seconds'),
+      maxLength: settings.get('posting.max_length'),
+    },
+  })
+
+  const profile = await memberProfiles.findPublicById(userId)
+  if (!profile) throw new ForbiddenError(msg('error.app.account-longer-post'))
+
+  const draft = await filterView(
+    'post.create.before',
+    {
+      subject: null,
+      body: input.message,
+      prefixId: null,
+      forumId,
+      authorId: userId,
+    },
+    { ...viewerRef(actor), threadId: target.threadId },
+  )
+
+  const objections = await filterView('post.create.validate', [], {
+    draft,
+    threadId: target.threadId,
+  })
+  if (objections.length > 0) throw new ValidationError(objections[0]!)
+
+  const created = await composer.create(
+    {
+      message: draft.body,
+      subscribe: input.subscribe ?? false,
+      seenLastPostId: input.seenLastPostId ?? null,
+      bypassesModeration: authorizer.can(actor, 'content.viewUnapproved', scope),
+      bypassesFlood: authorizer.can(actor, 'flood.bypass'),
+      heldAsNewMember: await holdsNewMember({
+        actor,
+        postCount: profile.postCount,
+        settings,
+      }),
+      requiresApproval: scope.forum.requiresPostApproval === true,
+      bypassesLock: authorizer.can(actor, 'content.viewUnapproved', scope),
+      restriction: await authorRestriction(warnings, userId),
+    },
+    { userId, username: profile.username },
+    target,
+  )
+
+  if (created.visibility === 'unapproved') {
+    await emitEvent('approval.queued', { kind: 'post', id: created.postId }, viewerRef(actor))
+  }
+
+  await emitEvent(
+    'post.created',
+    { postId: created.postId, threadId: created.threadId, forumId, authorId: userId },
+    viewerRef(actor),
+  )
+
+  await notifyPostAudience({
+    postId: created.postId,
+    threadId: created.threadId,
+    threadSlug: created.slug,
+    threadTitle: target.title,
+    message: draft.body,
+    authorUsername: profile.username,
+    visibility: created.visibility,
+  })
+
+  return created
+}
+
+async function authorRestriction(
+  warnings: ReturnType<typeof getContainer>['warnings'],
+  userId: number,
+): Promise<AuthorRestriction> {
+  if (warnings === null) return { suspended: false, moderated: false }
+  return restrictsPosting(await warnings.readRestriction(userId), new Date())
+}

package/src/server/report-actions.ts

@@ -0,0 +1,165 @@
+'use server'
+
+import { redirect } from 'next/navigation'
+
+import { ForbiddenError, ValidationError } from '@meith/core'
+import { currentRequestId } from '@meith/core/logger'
+import { msg } from '@meith/i18n'
+import { parseTargetKind, ReportService } from '@meith/moderation'
+
+import { limitMessage, spendLimit } from './antispam'
+import type { FormState } from './auth-form-state'
+import { getContainer } from './container'
+import { getActor } from './context'
+import { formStateReporter } from './form-state-reporter'
+import { positiveIntIn } from './form-values'
+import { tr } from './i18n'
+import { reportNotifier } from './notifications'
+import { emitEvent } from './plugin-view'
+import { resolveReportScope } from './report-scope'
+
+function field(form: FormData, name: string): string {
+  const value = form.get(name)
+  return typeof value === 'string' ? value.trim() : ''
+}
+
+const toFormState = formStateReporter('report-actions', 'unexpected error in reports')
+
+export async function fileReportAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const kind = parseTargetKind(field(form, 'kind'))
+  const targetId = positiveIntIn(field(form, 'targetId'))
+  const reason = field(form, 'reason')
+  const values = { reason }
+
+  if (kind === null || targetId === null) {
+    return { error: await tr('notice.app.exist'), values }
+  }
+
+  const { authorizer, reports } = getContainer()
+  if (reports === null) {
+    return {
+      error: await tr('notice.app.board-running-in-memory-sample-data-5'),
+      values,
+    }
+  }
+
+  let target: Awaited<ReturnType<NonNullable<typeof reports>['resolveTarget']>>
+  try {
+    const actor = await getActor()
+    if (actor.userId === null) {
+      throw new ForbiddenError(msg('error.app.must-logged-report-anything'))
+    }
+    authorizer.require(actor, 'content.report')
+
+    target = await reports.resolveTarget(kind, targetId, actor.userId)
+    if (target === null) throw new ValidationError(msg('error.app.exist'))
+
+    if (target.forumId !== null) {
+      const matrix = await authorizer.forumMatrix(actor, target.forumId)
+      const scope = {
+        ...(await authorizer.moderatorTargetIn(actor, target.forumId, matrix)),
+        threadAuthorId: target.threadAuthorUserId,
+      }
+      if (!authorizer.can(actor, 'thread.view', scope)) {
+        throw new ValidationError(msg('error.app.exist'))
+      }
+    } else if (kind === 'user') {
+      authorizer.require(actor, 'profile.view')
+    }
+
+    const limited = await spendLimit({ scope: 'report', actor })
+    if (limited !== null && !limited.allowed) {
+      return { error: limitMessage(limited), values }
+    }
+
+    const outcome = await new ReportService({ reports }).file({
+      kind,
+      targetId,
+      reason,
+      reporterUserId: actor.userId,
+    })
+
+    if (!outcome.duplicate) {
+      await emitEvent(
+        'report.created',
+        {
+          reportId: outcome.reportId,
+          target: kind === 'private_message' ? 'pm' : kind,
+          targetId,
+          reporterId: actor.userId,
+        },
+        { requestId: currentRequestId() ?? null },
+      )
+    }
+  } catch (err) {
+    return toFormState(err, values)
+  }
+
+  const back =
+    target.threadId === null
+      ? `/member/${target.id}?reported=1`
+      : `/thread/${target.threadId}?reported=1`
+  redirect(back)
+}
+
+export async function assignReportAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const reportId = positiveIntIn(field(form, 'reportId'))
+  const take = field(form, 'take') === '1'
+  if (reportId === null) return { error: await tr('notice.app.report-exist') }
+
+  const { reports } = getContainer()
+  if (reports === null) return { error: await tr('notice.app.board-reports') }
+
+  try {
+    const actor = await getActor()
+    if (actor.userId === null) throw new ForbiddenError(msg('error.app.must-logged'))
+
+    await new ReportService({ reports }).assign({
+      reportId,
+      toUserId: take ? actor.userId : null,
+      actorUserId: actor.userId,
+      scope: await resolveReportScope(),
+    })
+  } catch (err) {
+    return toFormState(err, {})
+  }
+
+  redirect('/moderation/reports')
+}
+
+export async function closeReportAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const reportId = positiveIntIn(field(form, 'reportId'))
+  const status = form.get('status')
+  const note = field(form, 'note')
+
+  if (reportId === null) return { error: await tr('notice.app.report-exist') }
+  if (status !== 'resolved' && status !== 'rejected') {
+    return { error: await tr('notice.app.choose-resolve-dismiss') }
+  }
+
+  const { reports } = getContainer()
+  if (reports === null) return { error: await tr('notice.app.board-reports') }
+
+  try {
+    const actor = await getActor()
+    if (actor.userId === null) throw new ForbiddenError(msg('error.app.must-logged'))
+
+    await new ReportService({ reports, notifier: reportNotifier() }).close({
+      reportId,
+      status,
+      note,
+      actorUserId: actor.userId,
+      scope: await resolveReportScope(),
+    })
+
+    await emitEvent(
+      'report.resolved',
+      { reportId, resolution: status === 'resolved' ? 'actioned' : 'rejected' },
+      { moderatorId: actor.userId, reason: note === '' ? null : note },
+    )
+  } catch (err) {
+    return toFormState(err, { note })
+  }
+
+  redirect(`/moderation/reports?closed=${status}`)
+}

package/src/server/report-scope.ts

@@ -0,0 +1,21 @@
+import 'server-only'
+
+import type { ReportScope } from '@meith/moderation'
+
+import { getContainer } from './container'
+import { getActor } from './context'
+
+export async function resolveReportScope(): Promise<ReportScope> {
+  const actor = await getActor()
+  const { authorizer } = getContainer()
+  if (actor.userId === null) return { forumIds: [], global: false }
+
+  return {
+    forumIds: await authorizer.moderatedForumIds(actor),
+    global: authorizer.can(actor, 'modcp.access'),
+  }
+}
+
+export function hasReportScope(scope: ReportScope): boolean {
+  return scope.forumIds.length > 0 || scope.global
+}

package/src/server/reputation-actions.ts

@@ -0,0 +1,146 @@
+'use server'
+
+import { redirect } from 'next/navigation'
+
+import { ForbiddenError, ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+import { parseRating } from '@meith/reputation'
+
+import { postLink } from '@/view/post-link'
+
+import type { FormState } from './auth-form-state'
+import { getActor } from './context'
+import { formStateReporter } from './form-state-reporter'
+import { trimmedText } from './form-values'
+import { emitEvent, viewerRef } from './plugin-view'
+import { reputationService, reputationSettings, viewerRaterLimits } from './reputation'
+import { requireRateablePost } from './reputation-target'
+import { isSafeLocalPath } from './safe-path'
+
+const toFormState = formStateReporter('reputation-actions', 'unexpected error rating somebody')
+
+function positiveInt(form: FormData, name: string): number | null {
+  const value = Number(trimmedText(form, name))
+  return Number.isInteger(value) && value > 0 ? value : null
+}
+
+function safeReturn(form: FormData, fallback: string): string {
+  const raw = trimmedText(form, 'returnTo')
+  return isSafeLocalPath(raw) ? raw : fallback
+}
+
+async function requireReputation(): Promise<{
+  service: NonNullable<ReturnType<typeof reputationService>>
+  userId: number
+}> {
+  const actor = await getActor()
+  if (actor.userId === null) throw new ForbiddenError(msg('error.app.must-logged'))
+
+  const service = reputationService()
+  if (service === null) {
+    throw new ForbiddenError(msg('error.app.board-running-in-memory-sample-data'))
+  }
+
+  return { service, userId: actor.userId }
+}
+
+async function announceReputation(
+  service: Awaited<ReturnType<typeof requireReputation>>['service'],
+  userId: number,
+  delta: number,
+): Promise<void> {
+  const summary = await service.summary(userId)
+  await emitEvent(
+    'reputation.changed',
+    { userId, delta, total: summary.total },
+    viewerRef(await getActor()),
+  )
+}
+
+export async function rateMemberAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const values = { comment: trimmedText(form, 'comment') }
+  const userId = positiveInt(form, 'userId')
+  const returnTo = safeReturn(form, userId === null ? '/' : `/member/${userId}`)
+
+  try {
+    const { service, userId: raterId } = await requireReputation()
+    if (userId === null) throw new ValidationError(msg('error.app.such-member'))
+
+    const points = parseRating(trimmedText(form, 'points'))
+    if (points === null) throw new ValidationError(msg('error.app.rating'))
+
+    const postId = positiveInt(form, 'postId')
+    await requireRateablePost(await getActor(), userId, postId)
+    const [settings, limits] = await Promise.all([reputationSettings(), viewerRaterLimits()])
+
+    await service.give({
+      userId,
+      givenByUserId: raterId,
+      postId,
+      points,
+      comment: values.comment,
+      settings,
+      limits,
+    })
+
+    await announceReputation(service, userId, points)
+  } catch (err) {
+    return toFormState(err, values)
+  }
+
+  redirect(`${returnTo}${returnTo.includes('?') ? '&' : '?'}rated=1`)
+}
+
+export async function withdrawRatingAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const userId = positiveInt(form, 'userId')
+  const returnTo = safeReturn(form, userId === null ? '/' : `/member/${userId}/reputation`)
+
+  try {
+    const { service, userId: raterId } = await requireReputation()
+
+    const ratingId = positiveInt(form, 'ratingId')
+    if (ratingId === null) throw new ValidationError(msg('error.app.such-rating'))
+
+    const withdrawn = await service.withdraw(ratingId, raterId)
+    if (withdrawn && userId !== null) await announceReputation(service, userId, 0)
+  } catch (err) {
+    return toFormState(err)
+  }
+
+  redirect(`${returnTo}${returnTo.includes('?') ? '&' : '?'}withdrawn=1`)
+}
+
+export async function thankForPostAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const userId = positiveInt(form, 'userId')
+  const postId = positiveInt(form, 'postId')
+  const returnTo = safeReturn(form, userId === null ? '/' : `/member/${userId}`)
+
+  try {
+    const { service, userId: raterId } = await requireReputation()
+    if (userId === null || postId === null) throw new ValidationError(msg('error.app.such-post'))
+    await requireRateablePost(await getActor(), userId, postId)
+
+    const held = await service.existing({ givenByUserId: raterId, userId, postId })
+
+    if (held !== null && held.points > 0) {
+      await service.withdraw(held.id, raterId)
+      await announceReputation(service, userId, -held.points)
+    } else {
+      const [settings, limits] = await Promise.all([reputationSettings(), viewerRaterLimits()])
+      await service.give({
+        userId,
+        givenByUserId: raterId,
+        postId,
+        points: 1,
+        comment: '',
+        settings,
+        limits,
+      })
+      await announceReputation(service, userId, 1)
+    }
+  } catch (err) {
+    return toFormState(err)
+  }
+
+  redirect(postLink(returnTo, postId))
+}

package/src/server/reputation-target.ts

@@ -0,0 +1,49 @@
+import 'server-only'
+
+import type { Actor } from '@meith/authorization'
+import { ValidationError } from '@meith/core'
+import { canHoldThreads } from '@meith/forums'
+import { msg } from '@meith/i18n'
+
+import { getContainer } from './container'
+
+export async function requireRateablePost(
+  actor: Actor,
+  userId: number,
+  postId: number | null,
+): Promise<void> {
+  if (postId === null) return
+
+  const { authorizer, forums, posts, threads } = getContainer()
+  const post = await posts.findRatingTarget(postId)
+  if (post === null || post.authorUserId !== userId) {
+    throw new ValidationError(msg('error.app.such-post'))
+  }
+
+  const located = await threads.locate(post.threadId)
+  if (located === null) throw new ValidationError(msg('error.app.such-post'))
+
+  const forum = await forums.findById(located.forumId)
+  if (forum === null || !canHoldThreads(forum.type)) {
+    throw new ValidationError(msg('error.app.such-post'))
+  }
+
+  const matrix = await authorizer.forumMatrix(actor, forum.id)
+  const target = await authorizer.moderatorTargetIn(actor, forum.id, matrix)
+  if (!authorizer.can(actor, 'thread.view', { ...target, threadAuthorId: located.authorUserId })) {
+    throw new ValidationError(msg('error.app.such-post'))
+  }
+
+  const thread = await threads.findById(
+    post.threadId,
+    authorizer.contentScope(actor, target),
+    authorizer.authorFilter(actor, target),
+  )
+  if (thread === null) throw new ValidationError(msg('error.app.such-post'))
+
+  const visible = await posts.locate(post.threadId, postId, {
+    scope: authorizer.contentScope(actor, target),
+    pageSize: 1,
+  })
+  if (visible === null) throw new ValidationError(msg('error.app.such-post'))
+}