@meith/web 0.16.0

package/src/server/seed-board.ts

@@ -0,0 +1,417 @@
+import type { MemberProfileRecord } from '@meith/accounts'
+import type { GroupDefaults, MemoryBoard } from '@meith/authorization'
+import { emptyPermissionSet, type ForumPermissions, type PermissionSet } from '@meith/core'
+import type { ForumListingRow } from '@meith/forums'
+import { BodyFormat } from '@meith/markdown'
+import type { PostListingRow } from '@meith/posts'
+import type { ThreadListingRow } from '@meith/threads'
+
+export const SEED_GROUP = {
+  guest: 1,
+  registered: 2,
+  administrators: 3,
+  superModerators: 4,
+  moderators: 5,
+  awaitingActivation: 6,
+  banned: 7,
+} as const
+
+export const FIXTURE_DATA_VERSION = 4
+
+export const SEED_FORUM = {
+  main: 10,
+  announcements: 100,
+  general: 200,
+  generalOffTopic: 201,
+} as const
+
+function group(over: Partial<PermissionSet>): PermissionSet {
+  return { ...emptyPermissionSet(), ...over }
+}
+
+const READ = {
+  canView: true,
+  canViewThreads: true,
+  canViewOthersThreads: true,
+  canSearch: true,
+  canViewProfiles: true,
+  canDownloadAttachments: true,
+} as const
+
+const POST = {
+  ...READ,
+  canPostThreads: true,
+  canPostReplies: true,
+  canSubscribe: true,
+  canEditOwnPosts: true,
+  canDeleteOwnPosts: true,
+  canReportContent: true,
+  canUploadAvatar: true,
+  canUsePrivateMessages: true,
+  privateMessageQuota: 100,
+  canGiveReputation: true,
+  maxReputationPerDay: 10,
+  requiresThreadApproval: false,
+  requiresPostApproval: false,
+  requiresApprovalOnEdit: false,
+} as const
+
+const GROUPS: GroupDefaults[] = [
+  { groupId: SEED_GROUP.guest, permissions: group(READ) },
+  {
+    groupId: SEED_GROUP.registered,
+    permissions: group({ ...POST, canUploadAttachments: true }),
+  },
+  {
+    groupId: SEED_GROUP.administrators,
+    permissions: group({
+      ...POST,
+      canUploadAttachments: true,
+      isAdministrator: true,
+      canAccessAdminCp: true,
+      canAccessModCp: true,
+    }),
+  },
+  {
+    groupId: SEED_GROUP.superModerators,
+    permissions: group({
+      ...POST,
+      canUploadAttachments: true,
+      isSuperModerator: true,
+      canAccessModCp: true,
+    }),
+  },
+]
+
+const ANNOUNCEMENT_READONLY: Partial<ForumPermissions> = {
+  canPostThreads: false,
+  canPostReplies: false,
+}
+
+export const SEED_BOARD: MemoryBoard = {
+  groups: GROUPS,
+  chains: {
+    [SEED_FORUM.main]: [SEED_FORUM.main],
+    [SEED_FORUM.announcements]: [SEED_FORUM.announcements, SEED_FORUM.main],
+    [SEED_FORUM.general]: [SEED_FORUM.general, SEED_FORUM.main],
+    [SEED_FORUM.generalOffTopic]: [SEED_FORUM.generalOffTopic, SEED_FORUM.general, SEED_FORUM.main],
+  },
+  overrides: [
+    {
+      forumId: SEED_FORUM.announcements,
+      groupId: SEED_GROUP.guest,
+      overrides: ANNOUNCEMENT_READONLY,
+    },
+    {
+      forumId: SEED_FORUM.announcements,
+      groupId: SEED_GROUP.registered,
+      overrides: ANNOUNCEMENT_READONLY,
+    },
+  ],
+}
+
+export const SEED_FORUM_ROWS: readonly ForumListingRow[] = [
+  {
+    id: SEED_FORUM.main,
+    type: 'category',
+    allowThreads: false,
+    title: 'Main',
+    slug: 'main',
+    description: null,
+    parentId: null,
+    path: '10',
+    depth: 0,
+    displayOrder: 1,
+    linkUrl: null,
+    threadCount: 3,
+    postCount: 6,
+    lastPost: {
+      postId: 143,
+      threadId: 22,
+      threadTitle: 'What are you reading this week?',
+      userId: null,
+      username: 'departed',
+      at: new Date('2026-07-30T08:41:00Z'),
+    },
+  },
+  {
+    id: SEED_FORUM.announcements,
+    type: 'forum',
+    allowThreads: true,
+    title: 'Announcements',
+    slug: 'announcements',
+    description: 'Board news and release notes. Staff post, everyone reads.',
+    parentId: SEED_FORUM.main,
+    path: '10.100',
+    depth: 1,
+    displayOrder: 1,
+    linkUrl: null,
+    threadCount: 1,
+    postCount: 2,
+    lastPost: {
+      postId: 11,
+      threadId: 4,
+      threadTitle: 'Version 0.1 is live',
+      userId: 1,
+      username: 'admin',
+      at: new Date('2026-07-29T14:05:00Z'),
+    },
+  },
+  {
+    id: SEED_FORUM.general,
+    type: 'forum',
+    allowThreads: true,
+    title: 'General Discussion',
+    slug: 'general',
+    description: 'Anything and everything.',
+    parentId: SEED_FORUM.main,
+    path: '10.200',
+    depth: 1,
+    displayOrder: 2,
+    linkUrl: null,
+    threadCount: 2,
+    postCount: 4,
+    lastPost: {
+      postId: 143,
+      threadId: 22,
+      threadTitle: 'What are you reading this week?',
+      userId: null,
+      username: 'departed',
+      at: new Date('2026-07-30T08:41:00Z'),
+    },
+  },
+  {
+    id: SEED_FORUM.generalOffTopic,
+    type: 'forum',
+    allowThreads: true,
+    title: 'Off Topic',
+    slug: 'off-topic',
+    description: 'Everything else.',
+    parentId: SEED_FORUM.general,
+    path: '10.200.201',
+    depth: 2,
+    displayOrder: 1,
+    linkUrl: null,
+    threadCount: 0,
+    postCount: 0,
+    lastPost: null,
+  },
+]
+
+export const SEED_THREAD_ROWS: readonly ThreadListingRow[] = [
+  {
+    id: 4,
+    forumId: SEED_FORUM.announcements,
+    title: 'Version 0.1 is live',
+    slug: 'version-0-1-is-live',
+    prefix: null,
+    authorUserId: 1,
+    authorUsername: 'admin',
+    replyCount: 1,
+    viewCount: 64,
+    ratingTotal: 0,
+    ratingCount: 0,
+    visibility: 'visible',
+    isSticky: false,
+    isLocked: false,
+    isMoved: false,
+    lastPost: {
+      postId: 11,
+      userId: 1,
+      username: 'admin',
+      at: new Date('2026-07-29T14:05:00Z'),
+    },
+    lastPostAt: new Date('2026-07-29T14:05:00Z'),
+  },
+  {
+    id: 22,
+    forumId: SEED_FORUM.general,
+    title: 'What are you reading this week?',
+    slug: 'what-are-you-reading-this-week',
+    prefix: { label: 'Weekly', token: null },
+    authorUserId: null,
+    authorUsername: 'departed',
+    replyCount: 1,
+    viewCount: 241,
+    ratingTotal: 17,
+    ratingCount: 4,
+    visibility: 'visible',
+    isSticky: true,
+    isLocked: false,
+    isMoved: false,
+    lastPost: {
+      postId: 143,
+      userId: null,
+      username: 'departed',
+      at: new Date('2026-07-30T08:41:00Z'),
+    },
+    lastPostAt: new Date('2026-07-30T08:41:00Z'),
+  },
+  {
+    id: 21,
+    forumId: SEED_FORUM.general,
+    title: 'Show us your desk setup',
+    slug: 'show-us-your-desk-setup',
+    prefix: null,
+    authorUserId: 1,
+    authorUsername: 'admin',
+    replyCount: 1,
+    viewCount: 116,
+    ratingTotal: 0,
+    ratingCount: 0,
+    visibility: 'visible',
+    isSticky: false,
+    isLocked: false,
+    isMoved: false,
+    lastPost: {
+      postId: 132,
+      userId: 1,
+      username: 'admin',
+      at: new Date('2026-07-29T17:18:00Z'),
+    },
+    lastPostAt: new Date('2026-07-29T17:18:00Z'),
+  },
+]
+
+export const SEED_POST_ROWS: readonly PostListingRow[] = [
+  {
+    id: 10,
+    threadId: 4,
+    forumId: SEED_FORUM.announcements,
+    number: 1,
+    authorUserId: 1,
+    authorUsername: 'admin',
+    authorPostCount: 5,
+    authorJoinedAt: new Date('2026-01-01T00:00:00Z'),
+    message:
+      'Welcome to the **new forum**. We are glad you are here.\n\n' +
+      'The rules live in [Announcements](/100-announcements).',
+    messageHtml: null,
+    renderVersion: 0,
+    bodyFormat: BodyFormat.Markdown,
+    editedAt: null,
+    editedByUsername: null,
+    editReason: null,
+    isFirstPost: true,
+    visibility: 'visible',
+    createdAt: new Date('2026-07-29T09:00:00Z'),
+  },
+  {
+    id: 11,
+    threadId: 4,
+    forumId: SEED_FORUM.announcements,
+    number: 2,
+    authorUserId: 1,
+    authorUsername: 'admin',
+    authorPostCount: 5,
+    authorJoinedAt: new Date('2026-01-01T00:00:00Z'),
+    message: 'Thanks for joining us for the first release.',
+    messageHtml: null,
+    renderVersion: 0,
+    bodyFormat: BodyFormat.Markdown,
+    editedAt: null,
+    editedByUsername: null,
+    editReason: null,
+    isFirstPost: false,
+    visibility: 'visible',
+    createdAt: new Date('2026-07-29T14:05:00Z'),
+  },
+  {
+    id: 121,
+    threadId: 21,
+    forumId: SEED_FORUM.general,
+    number: 1,
+    authorUserId: 1,
+    authorUsername: 'admin',
+    authorPostCount: 5,
+    authorJoinedAt: new Date('2026-01-01T00:00:00Z'),
+    message: 'Show us the place where you make things.',
+    messageHtml: null,
+    renderVersion: 0,
+    bodyFormat: BodyFormat.Markdown,
+    editedAt: null,
+    editedByUsername: null,
+    editReason: null,
+    isFirstPost: true,
+    visibility: 'visible',
+    createdAt: new Date('2026-07-29T12:00:00Z'),
+  },
+  {
+    id: 132,
+    threadId: 21,
+    forumId: SEED_FORUM.general,
+    number: 2,
+    authorUserId: 1,
+    authorUsername: 'admin',
+    authorPostCount: 5,
+    authorJoinedAt: new Date('2026-01-01T00:00:00Z'),
+    message:
+      '> **[admin](/member/by-name/admin) wrote:** ' +
+      '[View post](/thread/21-show-us-your-desk-setup?post=121)\n>\n' +
+      '> Show us the place where you make things.\n\n' +
+      'A standing desk and a notebook are all I need.',
+    messageHtml: null,
+    renderVersion: 0,
+    bodyFormat: BodyFormat.Markdown,
+    editedAt: null,
+    editedByUsername: null,
+    editReason: null,
+    isFirstPost: false,
+    visibility: 'visible',
+    createdAt: new Date('2026-07-29T17:18:00Z'),
+  },
+  {
+    id: 133,
+    threadId: 22,
+    forumId: SEED_FORUM.general,
+    number: 1,
+    authorUserId: 1,
+    authorUsername: 'admin',
+    authorPostCount: 5,
+    authorJoinedAt: new Date('2026-01-01T00:00:00Z'),
+    message: 'Tell us what you are reading this week.',
+    messageHtml: null,
+    renderVersion: 0,
+    bodyFormat: BodyFormat.Markdown,
+    editedAt: null,
+    editedByUsername: null,
+    editReason: null,
+    isFirstPost: true,
+    visibility: 'visible',
+    createdAt: new Date('2026-07-28T09:00:00Z'),
+  },
+  {
+    id: 143,
+    threadId: 22,
+    forumId: SEED_FORUM.general,
+    number: 2,
+    authorUserId: null,
+    authorUsername: 'departed',
+    authorPostCount: 0,
+    authorJoinedAt: null,
+    message: 'I just started a mystery novel.',
+    messageHtml: null,
+    renderVersion: 0,
+    bodyFormat: BodyFormat.Markdown,
+    editedAt: null,
+    editedByUsername: null,
+    editReason: null,
+    isFirstPost: false,
+    visibility: 'visible',
+    createdAt: new Date('2026-07-30T08:41:00Z'),
+  },
+]
+
+export const SEED_MEMBER_PROFILES: readonly MemberProfileRecord[] = [
+  {
+    id: 1,
+    username: 'admin',
+    title: 'Administrators',
+    postCount: 5,
+    createdAt: new Date('2026-01-01T00:00:00Z'),
+    lastActiveAt: new Date('2026-07-30T08:41:00Z'),
+    location: 'The server room',
+    website: 'https://example.test/',
+    bio: 'Runs this board. Fixture data — nothing here is durable.',
+  },
+]

package/src/server/session-actions.ts

@@ -0,0 +1,78 @@
+'use server'
+
+import { redirect } from 'next/navigation'
+
+import { ForbiddenError } from '@meith/core'
+import { msg } from '@meith/i18n'
+
+import { recordAuthEvent } from './auth-events'
+import type { FormState } from './auth-form-state'
+import { getContainer } from './container'
+import { getActor } from './context'
+import { formStateReporter } from './form-state-reporter'
+import { positiveInt } from './form-values'
+import { tr } from './i18n'
+import { readSessionToken } from './session-cookies'
+
+const toFormState = formStateReporter(
+  'session-actions',
+  'unexpected error while signing a session out',
+)
+
+async function requireViewer(): Promise<number> {
+  const actor = await getActor()
+  if (actor.userId === null) throw new ForbiddenError(msg('error.app.must-logged'))
+  return actor.userId
+}
+
+/** The row the member is reading the page on, so it can be marked and kept. */
+export async function currentSessionId(): Promise<number | null> {
+  const token = await readSessionToken()
+  if (token === undefined || token === '') return null
+
+  const located = await getContainer().identity.locateSession(token)
+  return located?.sessionId ?? null
+}
+
+export async function revokeSessionAction(_prev: FormState, form: FormData): Promise<FormState> {
+  try {
+    const userId = await requireViewer()
+    const sessionId = positiveInt(form, 'sessionId')
+    if (sessionId === null) return { error: await tr('notice.app.session-could-found') }
+
+    const { accountStore } = getContainer()
+    const revoked = await accountStore.sessions.revokeOwned(userId, sessionId, new Date())
+
+    if (!revoked) return { error: await tr('notice.app.session-had-already-ended') }
+
+    await recordAuthEvent({ userId, kind: 'session_revoked' })
+  } catch (err) {
+    return toFormState(err)
+  }
+
+  redirect('/usercp/security?sessions=revoked')
+}
+
+export async function revokeOtherSessionsAction(
+  _prev: FormState,
+  _form: FormData,
+): Promise<FormState> {
+  try {
+    const userId = await requireViewer()
+    const { accountStore } = getContainer()
+
+    const keep = await currentSessionId()
+    if (keep === null) {
+      return { error: await tr('notice.app.session-could-identified-nothing-signed') }
+    }
+
+    const revoked = await accountStore.sessions.revokeAllForUserExcept(userId, keep)
+    await accountStore.remember.revokeAllForUser(userId, 'sign_out_everywhere', new Date())
+
+    if (revoked > 0) await recordAuthEvent({ userId, kind: 'sessions_revoked' })
+  } catch (err) {
+    return toFormState(err)
+  }
+
+  redirect('/usercp/security?sessions=elsewhere')
+}

package/src/server/session-cookies.ts

@@ -0,0 +1,124 @@
+import 'server-only'
+
+import { cookies } from 'next/headers'
+
+import { env } from '@meith/core'
+
+import {
+  ADMIN_COOKIE,
+  adminCookie,
+  clearedAdminCookie,
+  clearedCookie,
+  passkeyCookie,
+  passkeyCookieName,
+  rememberCookie,
+  rememberCookieName,
+  secondFactorCookie,
+  secondFactorCookieName,
+  sessionCookie,
+  sessionCookieName,
+  ssoCookie,
+  ssoCookieName,
+} from './cookies'
+import { retireGuestPresence } from './presence'
+
+function secure(): boolean {
+  return env.NODE_ENV !== 'development'
+}
+
+export async function setSessionCookie(token: string, expiresAt: Date): Promise<void> {
+  const jar = await cookies()
+  const isSecure = secure()
+  jar.set(sessionCookieName(isSecure), token, sessionCookie(expiresAt, isSecure))
+
+  await retireGuestPresence()
+}
+
+export async function setRememberCookie(token: string, expiresAt: Date): Promise<void> {
+  const jar = await cookies()
+  const isSecure = secure()
+  jar.set(rememberCookieName(isSecure), token, rememberCookie(expiresAt, isSecure))
+}
+
+export async function setAdminCookie(token: string, expiresAt: Date): Promise<void> {
+  const jar = await cookies()
+  jar.set(ADMIN_COOKIE, token, adminCookie(expiresAt, secure()))
+}
+
+export async function clearAdminCookie(): Promise<void> {
+  const jar = await cookies()
+  jar.set(ADMIN_COOKIE, '', clearedAdminCookie(secure()))
+}
+
+export async function readAdminToken(): Promise<string | null> {
+  const jar = await cookies()
+  return jar.get(ADMIN_COOKIE)?.value ?? null
+}
+
+export async function clearSessionCookies(): Promise<void> {
+  const jar = await cookies()
+  const isSecure = secure()
+  jar.set(sessionCookieName(isSecure), '', clearedCookie(isSecure))
+  jar.set(rememberCookieName(isSecure), '', clearedCookie(isSecure))
+}
+
+export async function readRememberToken(): Promise<string | undefined> {
+  const jar = await cookies()
+  return jar.get(rememberCookieName(secure()))?.value
+}
+
+export async function readSessionToken(): Promise<string | undefined> {
+  const jar = await cookies()
+  return jar.get(sessionCookieName(secure()))?.value
+}
+
+export async function setHandshakeCookie(value: string): Promise<void> {
+  const jar = await cookies()
+  const isSecure = secure()
+  jar.set(ssoCookieName(isSecure), value, ssoCookie(isSecure))
+}
+
+export async function readHandshakeCookie(): Promise<string | undefined> {
+  const jar = await cookies()
+  return jar.get(ssoCookieName(secure()))?.value
+}
+
+export async function clearHandshakeCookie(): Promise<void> {
+  const jar = await cookies()
+  const isSecure = secure()
+  jar.set(ssoCookieName(isSecure), '', clearedCookie(isSecure))
+}
+
+export async function setSecondFactorCookie(token: string, expiresAt: Date): Promise<void> {
+  const jar = await cookies()
+  const isSecure = secure()
+  jar.set(secondFactorCookieName(isSecure), token, secondFactorCookie(expiresAt, isSecure))
+}
+
+export async function readSecondFactorToken(): Promise<string | undefined> {
+  const jar = await cookies()
+  return jar.get(secondFactorCookieName(secure()))?.value
+}
+
+export async function clearSecondFactorCookie(): Promise<void> {
+  const jar = await cookies()
+  const isSecure = secure()
+  jar.set(secondFactorCookieName(isSecure), '', clearedCookie(isSecure))
+}
+
+export async function setPasskeyChallengeCookie(value: string): Promise<void> {
+  const jar = await cookies()
+  const isSecure = secure()
+  jar.set(passkeyCookieName(isSecure), value, passkeyCookie(isSecure))
+}
+
+export async function readPasskeyChallengeCookie(): Promise<string | undefined> {
+  const jar = await cookies()
+  return jar.get(passkeyCookieName(secure()))?.value
+}
+
+export async function clearPasskeyChallengeCookie(): Promise<void> {
+  const jar = await cookies()
+  const isSecure = secure()
+  jar.set(passkeyCookieName(isSecure), '', clearedCookie(isSecure))
+}

package/src/server/session-key.ts

@@ -0,0 +1,17 @@
+import 'server-only'
+
+import { createHash } from 'node:crypto'
+
+import { cookies } from 'next/headers'
+
+import { env } from '@meith/core'
+
+import { sessionCookieName } from './cookies'
+
+export async function currentSessionKey(): Promise<string | null> {
+  const jar = await cookies()
+  const token = jar.get(sessionCookieName(env.NODE_ENV !== 'development'))?.value
+  if (token === undefined || token === '') return null
+
+  return createHash('sha256').update(token).digest('base64url').slice(0, 32)
+}

package/src/server/settings.ts

@@ -0,0 +1,47 @@
+import 'server-only'
+
+import { CacheTags, cachedGlobal, env } from '@meith/core'
+import { getDb, PostgresSettingsRepository } from '@meith/db'
+import { drivers } from '@meith/drivers'
+import { SettingsSnapshot } from '@meith/settings'
+
+const TTL_SECONDS = 60
+
+export async function getSettingOverrides(): Promise<ReadonlyMap<string, string>> {
+  if (env.DATA_SOURCE !== 'postgres') {
+    return new Map()
+  }
+
+  const overrides = await cachedGlobal<Array<[string, string]>>(
+    drivers().cache,
+    { key: ['settings', 'overrides'], tags: [CacheTags.settings()], revalidate: TTL_SECONDS },
+    async () => {
+      const stored = await new PostgresSettingsRepository(getDb()).loadAll()
+      return [...stored] as Array<[string, string]>
+    },
+  )
+
+  return new Map(overrides)
+}
+
+export async function getSettings(): Promise<SettingsSnapshot> {
+  return SettingsSnapshot.fromOverrides(new Map(await getSettingOverrides()))
+}
+
+/**
+ * The same settings, read past the cache.
+ *
+ * The cached snapshot is held per module instance, and a route handler is not
+ * always the same instance as the render that invalidated it — so a route can
+ * act on a value up to a minute out of date. That is harmless for anything the
+ * page merely displays, and wrong for a decision an operator has just changed:
+ * turning a sign-in provider on and having the button answer "that is not
+ * switched on" reads as a broken board, not as a stale cache. Sign-in happens
+ * once per member per session, so the query is cheaper than the confusion.
+ */
+export async function getSettingsUncached(): Promise<SettingsSnapshot> {
+  if (env.DATA_SOURCE !== 'postgres') return SettingsSnapshot.fromOverrides(new Map())
+
+  const stored = await new PostgresSettingsRepository(getDb()).loadAll()
+  return SettingsSnapshot.fromOverrides(new Map(stored))
+}