@meith/web 0.16.0

package/src/server/thread-core.ts

@@ -0,0 +1,207 @@
+import 'server-only'
+
+import type { Actor } from '@meith/authorization'
+import { ForbiddenError, type ForumPermissions, ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+import { restrictsPosting } from '@meith/moderation'
+import { type AuthorRestriction, type ForumPostingTarget, ThreadComposer } from '@meith/threads'
+
+import {
+  dailyLimitMessage,
+  holdsNewMember,
+  limitMessage,
+  spendDailyLimit,
+  spendLimit,
+} from './antispam'
+import type { AttachmentScope } from './attachments'
+import { getContainer } from './container'
+import { emitEvent, filterView, viewerRef } from './plugin-view'
+import { notifyPostAudience } from './post-notifications'
+import { getSettings } from './settings'
+
+export interface ResolvedThreadTarget {
+  readonly forum: ForumPostingTarget
+  readonly matrix: ForumPermissions
+  readonly scope: AttachmentScope
+}
+
+export async function resolveThreadTarget(
+  actor: Actor,
+  forumId: number,
+): Promise<ResolvedThreadTarget> {
+  const { authorizer, threadWrites } = getContainer()
+
+  if (threadWrites === null) {
+    throw new ValidationError(msg('error.app.board-running-in-memory-sample-data-8'))
+  }
+
+  const forum = await threadWrites.postingRules(forumId)
+  if (!forum) throw new ValidationError(msg('error.app.forum-exist'))
+
+  const matrix = await authorizer.forumMatrix(actor, forumId)
+  if (!authorizer.can(actor, 'thread.view', { forumId, forum: matrix })) {
+    throw new ValidationError(msg('error.app.forum-exist'))
+  }
+  authorizer.require(actor, 'thread.post', { forumId, forum: matrix })
+
+  if (actor.userId === null) throw new ForbiddenError(msg('error.app.must-logged-post'))
+
+  return {
+    forum,
+    matrix,
+    scope: { forumId, forum: matrix, allowsAttachments: forum.allowAttachments },
+  }
+}
+
+export interface SubmitThreadInput {
+  readonly title: string
+  readonly message: string
+  readonly prefixId?: number | null
+  readonly subscribe?: boolean
+  readonly poll?:
+    | {
+        readonly question: string
+        readonly options: readonly string[]
+        readonly maxOptions?: number
+        readonly allowRevote?: boolean
+        readonly publicVotes?: boolean
+      }
+    | undefined
+}
+
+export async function submitThread(
+  actor: Actor,
+  resolved: ResolvedThreadTarget,
+  input: SubmitThreadInput,
+): Promise<Awaited<ReturnType<ThreadComposer['create']>>> {
+  const { authorizer, threadWrites, memberProfiles, warnings } = getContainer()
+  if (threadWrites === null) {
+    throw new ValidationError(msg('error.app.board-running-in-memory-sample-data-8'))
+  }
+
+  const userId = actor.userId
+  if (userId === null) throw new ForbiddenError(msg('error.app.must-logged-post'))
+
+  const settings = await getSettings()
+  const { forum, matrix, scope } = resolved
+  const target = { forumId: forum.id, forum: matrix }
+
+  const limited = await spendLimit({ scope: 'post', actor, settings })
+  if (limited !== null && !limited.allowed) throw new ValidationError(limitMessage(limited))
+
+  const daily = await spendDailyLimit({ scope: 'post_day', actor })
+  if (daily !== null && !daily.allowed) {
+    throw new ValidationError(dailyLimitMessage('post_day', daily))
+  }
+
+  const profile = await memberProfiles.findPublicById(userId)
+  if (!profile) throw new ForbiddenError(msg('error.app.account-longer-post'))
+
+  const draft = await filterView(
+    'thread.create.before',
+    {
+      subject: input.title,
+      body: input.message,
+      prefixId: input.prefixId ?? null,
+      forumId: forum.id,
+      authorId: userId,
+    },
+    viewerRef(actor),
+  )
+
+  const objections = await filterView('thread.create.validate', [], { draft })
+  if (objections.length > 0) throw new ValidationError(objections[0]!)
+
+  const composer = new ThreadComposer({
+    threads: threadWrites,
+    config: {
+      floodSeconds: settings.get('posting.flood_seconds'),
+      maxLength: settings.get('posting.max_length'),
+    },
+  })
+
+  const created = await composer.create(
+    {
+      title: draft.subject ?? input.title,
+      message: draft.body,
+      prefixId: draft.prefixId,
+      subscribe: input.subscribe ?? false,
+      heldAsNewMember: await holdsNewMember({ actor, postCount: profile.postCount, settings }),
+      requiresApproval: scope.forum.requiresThreadApproval === true,
+      ...(input.poll === undefined
+        ? {}
+        : {
+            poll: {
+              question: input.poll.question,
+              options: input.poll.options,
+              closesAt: null,
+              ...(input.poll.maxOptions === undefined ? {} : { maxOptions: input.poll.maxOptions }),
+              ...(input.poll.allowRevote === undefined
+                ? {}
+                : { allowRevote: input.poll.allowRevote }),
+              ...(input.poll.publicVotes === undefined
+                ? {}
+                : { publicVotes: input.poll.publicVotes }),
+            },
+          }),
+      mayPostPoll: authorizer.can(actor, 'poll.post', target),
+      bypassesModeration: authorizer.can(actor, 'content.viewUnapproved', target),
+      bypassesFlood: authorizer.can(actor, 'flood.bypass'),
+      restriction: await authorRestriction(warnings, userId),
+    },
+    { userId, username: profile.username },
+    forum,
+  )
+
+  if (created.visibility === 'unapproved') {
+    await emitEvent('approval.queued', { kind: 'thread', id: created.threadId }, viewerRef(actor))
+  }
+
+  if (input.poll !== undefined) {
+    const { polls } = getContainer()
+    const poll = polls === null ? null : await polls.find(created.threadId, null)
+    if (poll !== null) {
+      await emitEvent(
+        'poll.created',
+        {
+          threadId: created.threadId,
+          forumId: forum.id,
+          pollId: poll.id,
+          optionCount: poll.options.length,
+        },
+        viewerRef(actor),
+      )
+    }
+  }
+
+  await emitEvent(
+    'thread.created',
+    {
+      threadId: created.threadId,
+      forumId: forum.id,
+      authorId: userId,
+      subject: draft.subject ?? input.title,
+    },
+    viewerRef(actor),
+  )
+
+  await notifyPostAudience({
+    postId: created.postId,
+    threadId: created.threadId,
+    threadSlug: created.slug,
+    threadTitle: draft.subject ?? input.title,
+    message: draft.body,
+    authorUsername: profile.username,
+    visibility: created.visibility,
+  })
+
+  return created
+}
+
+async function authorRestriction(
+  warnings: ReturnType<typeof getContainer>['warnings'],
+  userId: number,
+): Promise<AuthorRestriction> {
+  if (warnings === null) return { suspended: false, moderated: false }
+  return restrictsPosting(await warnings.readRestriction(userId), new Date())
+}

package/src/server/thread-rating-actions.ts

@@ -0,0 +1,55 @@
+'use server'
+
+import { redirect } from 'next/navigation'
+
+import { ForbiddenError, ValidationError } from '@meith/core'
+import { canHoldThreads } from '@meith/forums'
+import { msg } from '@meith/i18n'
+import { ThreadRatingService } from '@meith/polls'
+
+import { getContainer } from './container'
+import { getActor } from './context'
+import { emitEvent, viewerRef } from './plugin-view'
+import { getSettings } from './settings'
+
+const number = (form: FormData, name: string) => {
+  const value = Number(form.get(name))
+  if (!Number.isSafeInteger(value) || value <= 0)
+    throw new ValidationError(msg('error.app.thread-exist'))
+  return value
+}
+
+export async function rateThreadAction(form: FormData): Promise<void> {
+  const threadId = number(form, 'threadId')
+  const rating = Number(form.get('rating'))
+  const actor = await getActor()
+  const { authorizer, forums, polls, threads } = getContainer()
+  if (actor.userId === null || polls === null)
+    throw new ForbiddenError(msg('error.app.must-logged-rate-thread'))
+  const located = await threads.locate(threadId)
+  const forumId = located?.forumId ?? null
+  const forum = forumId === null ? null : await forums.findById(forumId)
+  if (forumId === null || forum === null || !canHoldThreads(forum.type))
+    throw new ValidationError(msg('error.app.thread-exist'))
+  const target = {
+    forumId,
+    forum: await authorizer.forumMatrix(actor, forumId),
+    threadAuthorId: located?.authorUserId ?? null,
+  }
+  if (!authorizer.can(actor, 'thread.view', target))
+    throw new ValidationError(msg('error.app.thread-exist'))
+  const recorded = await new ThreadRatingService(polls).rate({
+    threadId,
+    userId: actor.userId,
+    rating,
+    enabled:
+      (await getSettings()).get('posting.thread_ratings_enabled') &&
+      authorizer.can(actor, 'thread.rate', target),
+  })
+  await emitEvent(
+    'rating.recorded',
+    { threadId, rating, average: recorded.average },
+    viewerRef(actor),
+  )
+  redirect(`/thread/${threadId}`)
+}

package/src/server/thread-tool-actions.ts

@@ -0,0 +1,154 @@
+'use server'
+
+import { redirect } from 'next/navigation'
+
+import type { Action } from '@meith/authorization'
+import { ForbiddenError, ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+import { parseThreadTool, type ThreadToolRights, ThreadTools } from '@meith/moderation'
+
+import type { FormState } from './auth-form-state'
+import { getContainer } from './container'
+import { getActor } from './context'
+import { formStateReporter } from './form-state-reporter'
+import { positiveInt } from './form-values'
+import { tr } from './i18n'
+import { emitEvent } from './plugin-view'
+
+const toFormState = formStateReporter('thread-tool-actions', 'unexpected error in thread tools')
+
+const TOOL_ACTIONS: Readonly<Record<keyof ThreadToolRights, Action>> = {
+  lock: 'thread.lock',
+  stick: 'thread.stick',
+  move: 'thread.move',
+  delete: 'thread.delete',
+  restore: 'thread.restore',
+}
+
+export async function threadToolAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const threadId = positiveInt(form, 'threadId')
+  const tool = parseThreadTool(
+    typeof form.get('tool') === 'string' ? (form.get('tool') as string) : undefined,
+  )
+  const toForumId = positiveInt(form, 'toForumId')
+
+  if (threadId === null || tool === null) {
+    return { error: await tr('notice.app.thread-exist') }
+  }
+
+  const { authorizer, threadTools, threads } = getContainer()
+  if (threadTools === null) {
+    return {
+      error: await tr('notice.app.board-running-in-memory-sample-data-3'),
+    }
+  }
+
+  let outcome: Awaited<ReturnType<ThreadTools['apply']>>
+  try {
+    const actor = await getActor()
+    if (actor.userId === null) throw new ForbiddenError(msg('error.app.must-logged'))
+
+    const target = await threadTools.find(threadId)
+    if (target === null) throw new ValidationError(msg('error.app.thread-exist'))
+
+    const matrix = await authorizer.forumMatrix(actor, target.forumId)
+    if (!authorizer.can(actor, 'thread.view', { forumId: target.forumId, forum: matrix })) {
+      throw new ValidationError(msg('error.app.thread-exist'))
+    }
+
+    const threadAuthorId = (await threads.locate(threadId))?.authorUserId ?? null
+    const rights = await resolveRights(target.forumId, threadAuthorId)
+    const destinationRights =
+      (tool === 'move' || tool === 'copy') && toForumId !== null
+        ? await resolveRights(toForumId, threadAuthorId)
+        : undefined
+
+    outcome = await new ThreadTools({ threads: threadTools }).apply({
+      threadId,
+      tool,
+      ...(toForumId === null ? {} : { toForumId }),
+      actorUserId: actor.userId,
+      rights,
+      ...(destinationRights === undefined ? {} : { destinationRights }),
+    })
+
+    if (outcome.changed) {
+      await announceTool(outcome.tool, {
+        threadId,
+        fromForumId: target.forumId,
+        toForumId,
+        moderatorId: actor.userId,
+      })
+    }
+  } catch (err) {
+    return toFormState(err)
+  }
+
+  if (outcome.tool === 'copy') {
+    redirect(`/thread/${outcome.threadId}-${outcome.slug}?tool=copy`)
+  }
+  if (outcome.tool === 'delete') {
+    redirect(`/${(await threadTools.find(threadId))?.forumId ?? ''}?thread=deleted`)
+  }
+  redirect(`/thread/${outcome.threadId}-${outcome.slug}?tool=${outcome.tool}`)
+}
+
+async function announceTool(
+  tool: Awaited<ReturnType<ThreadTools['apply']>>['tool'],
+  input: {
+    readonly threadId: number
+    readonly fromForumId: number
+    readonly toForumId: number | null
+    readonly moderatorId: number
+  },
+): Promise<void> {
+  const moderation = { moderatorId: input.moderatorId, reason: null }
+  const thread = { threadId: input.threadId, forumId: input.fromForumId }
+
+  await emitEvent(
+    'moderation.logged',
+    { action: `thread.${tool}`, targetId: input.threadId },
+    moderation,
+  )
+
+  if (tool === 'lock' || tool === 'unlock') {
+    await emitEvent('thread.locked', { ...thread, isLocked: tool === 'lock' }, moderation)
+    return
+  }
+  if (tool === 'stick' || tool === 'unstick') {
+    await emitEvent('thread.stickied', { ...thread, isSticky: tool === 'stick' }, moderation)
+    return
+  }
+  if (tool === 'move' && input.toForumId !== null) {
+    await emitEvent(
+      'thread.moved',
+      {
+        threadId: input.threadId,
+        fromForumId: input.fromForumId,
+        toForumId: input.toForumId,
+      },
+      moderation,
+    )
+  }
+}
+
+async function resolveRights(
+  forumId: number,
+  threadAuthorId: number | null,
+): Promise<ThreadToolRights> {
+  const actor = await getActor()
+  const { authorizer } = getContainer()
+  const [forum, moderatorRights] = await Promise.all([
+    authorizer.forumMatrix(actor, forumId),
+    authorizer.moderatorRightsIn(actor, forumId),
+  ])
+  const target = { forumId, forum, moderatorRights, threadAuthorId }
+
+  return {
+    lock: authorizer.can(actor, TOOL_ACTIONS.lock, target),
+    stick: authorizer.can(actor, TOOL_ACTIONS.stick, target),
+    move: authorizer.can(actor, TOOL_ACTIONS.move, target),
+    delete: authorizer.can(actor, TOOL_ACTIONS.delete, target),
+    restore: authorizer.can(actor, TOOL_ACTIONS.restore, target),
+  }
+}

package/src/server/two-factor-actions.ts

@@ -0,0 +1,178 @@
+'use server'
+
+import { redirect } from 'next/navigation'
+
+import { verifyPassword } from '@meith/accounts'
+import { ForbiddenError, ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+
+import { RECOVERY_CODES_FIELD } from '@/view/two-factor'
+
+import { recordAuthEvent } from './auth-events'
+import type { FormState } from './auth-form-state'
+import { getContainer } from './container'
+import { getActor } from './context'
+import { assertDemoAccountChangeable } from './demo'
+import { formStateReporter } from './form-state-reporter'
+import { text } from './form-values'
+import { getSettingsUncached } from './settings'
+import { secondFactorPosture, twoFactorOffered, twoFactorService } from './two-factor'
+
+const toFormState = formStateReporter(
+  'two-factor-actions',
+  'unexpected error while changing two-factor authentication',
+)
+
+interface Owner {
+  readonly userId: number
+  readonly hasPassword: boolean
+}
+
+async function ownAccount(): Promise<Owner> {
+  const actor = await getActor()
+  if (actor.userId === null) throw new ForbiddenError(msg('error.app.must-logged'))
+
+  await assertDemoAccountChangeable(actor.userId, 'sign-in method')
+
+  const account = await getContainer().accountStore.accounts.findById(actor.userId)
+  if (account === null) throw new ForbiddenError(msg('error.app.account-longer-exists'))
+
+  return { userId: actor.userId, hasPassword: account.passwordHash !== null }
+}
+
+async function requireOwnAccount(): Promise<Owner> {
+  if (!(await twoFactorOffered())) {
+    throw new ForbiddenError(msg('error.app.board-offer-two-factor-authentication'))
+  }
+
+  return ownAccount()
+}
+
+async function requireOwnFactor(): Promise<Owner> {
+  const owner = await ownAccount()
+  if (await twoFactorOffered()) return owner
+
+  const service = twoFactorService()
+  if (service !== null && (await service.isEnrolled(owner.userId))) return owner
+
+  throw new ForbiddenError(msg('error.app.board-offer-two-factor-authentication'))
+}
+
+export async function beginTwoFactorAction(_prev: FormState, _form: FormData): Promise<FormState> {
+  try {
+    const { userId } = await requireOwnAccount()
+
+    const service = twoFactorService()
+    if (service === null) throw new ForbiddenError(msg('error.app.board-seal-secret'))
+
+    const name = (await getSettingsUncached()).get('board.name')
+    await service.beginEnrolment(userId, name.trim() === '' ? 'Meith' : name)
+  } catch (err) {
+    return toFormState(err)
+  }
+
+  redirect('/usercp/security?factor=setup')
+}
+
+export async function abandonTwoFactorAction(
+  _prev: FormState,
+  _form: FormData,
+): Promise<FormState> {
+  try {
+    const { userId } = await requireOwnAccount()
+
+    const service = twoFactorService()
+    if (service !== null) await service.abandonEnrolment(userId)
+  } catch (err) {
+    return toFormState(err)
+  }
+
+  redirect('/usercp/security')
+}
+
+export async function confirmTwoFactorAction(_prev: FormState, form: FormData): Promise<FormState> {
+  try {
+    const { userId } = await requireOwnAccount()
+
+    const service = twoFactorService()
+    if (service === null) throw new ForbiddenError(msg('error.app.board-seal-secret'))
+
+    const codes = await service.confirmEnrolment({ userId, code: text(form, 'code') })
+    await recordAuthEvent({ userId, kind: 'second_factor_enabled' })
+
+    return { notice: 'saved', values: { [RECOVERY_CODES_FIELD]: codes.join('\n') } }
+  } catch (err) {
+    return toFormState(err)
+  }
+}
+
+export async function replaceRecoveryCodesAction(
+  _prev: FormState,
+  form: FormData,
+): Promise<FormState> {
+  try {
+    const { userId, hasPassword } = await requireOwnFactor()
+
+    const service = twoFactorService()
+    if (service === null) throw new ForbiddenError(msg('error.app.board-seal-secret'))
+
+    await assertStillThem({ userId, hasPassword, form, service })
+
+    const codes = await service.replaceRecoveryCodes(userId)
+    await recordAuthEvent({ userId, kind: 'recovery_codes_replaced' })
+
+    return { notice: 'saved', values: { [RECOVERY_CODES_FIELD]: codes.join('\n') } }
+  } catch (err) {
+    return toFormState(err)
+  }
+}
+
+export async function disableTwoFactorAction(_prev: FormState, form: FormData): Promise<FormState> {
+  try {
+    const { userId, hasPassword } = await requireOwnFactor()
+
+    const service = twoFactorService()
+    if (service === null) throw new ForbiddenError(msg('error.app.board-seal-secret'))
+
+    await assertStillThem({ userId, hasPassword, form, service })
+
+    const posture = await secondFactorPosture(userId)
+    await service.disable({ userId, required: posture.required })
+    await recordAuthEvent({ userId, kind: 'second_factor_disabled' })
+  } catch (err) {
+    return toFormState(err)
+  }
+
+  redirect('/usercp/security?factor=off')
+}
+
+/**
+ * Weakening an account asks for the thing being weakened. An account with a
+ * password gives it; one without — signed in by a provider or a passkey —
+ * gives a current code instead, which proves the same possession.
+ */
+async function assertStillThem(input: {
+  readonly userId: number
+  readonly hasPassword: boolean
+  readonly form: FormData
+  readonly service: NonNullable<ReturnType<typeof twoFactorService>>
+}): Promise<void> {
+  if (input.hasPassword) {
+    const account = await getContainer().accountStore.accounts.findById(input.userId)
+    const password = text(input.form, 'password')
+
+    if (password === '' || !(await verifyPassword(password, account?.passwordHash))) {
+      throw new ValidationError(msg('error.app.current-password'))
+    }
+    return
+  }
+
+  const outcome = await input.service.verify({
+    userId: input.userId,
+    code: text(input.form, 'code'),
+  })
+
+  if (outcome.status !== 'ok') {
+    throw new ValidationError(msg('error.app.enter-current-code-from-authenticator'))
+  }
+}

package/src/server/two-factor.ts

@@ -0,0 +1,86 @@
+import 'server-only'
+
+import {
+  clearSecondFactor,
+  type Enrolment,
+  holdsSecondFactor,
+  TwoFactorService,
+  type TwoFactorState,
+} from '@meith/accounts'
+import { env } from '@meith/core'
+
+import { getContainer } from './container'
+import { getActor } from './context'
+import { getSettingsUncached } from './settings'
+
+export interface SecondFactorPosture {
+  readonly offered: boolean
+  readonly required: boolean
+}
+
+export function twoFactorService(): TwoFactorService | null {
+  const key = env.AUTH_SECRET
+  if (key === undefined || key.trim() === '') return null
+
+  const { accountStore } = getContainer()
+
+  return new TwoFactorService({
+    accounts: accountStore.accounts,
+    twoFactor: accountStore.twoFactor,
+    recoveryCodes: accountStore.recoveryCodes,
+    sealingKey: key,
+  })
+}
+
+/**
+ * Offered when the board says so and the board has a key to seal a secret
+ * with. Without AUTH_SECRET there is nowhere safe to put the secret, so the
+ * surface is hidden rather than half-built.
+ */
+export async function twoFactorOffered(): Promise<boolean> {
+  if (getContainer().dataSource !== 'postgres') return false
+  if (twoFactorService() === null) return false
+
+  return (await getSettingsUncached()).get('security.two_factor_enabled')
+}
+
+export async function twoFactorRequiredForStaff(): Promise<boolean> {
+  if (!(await twoFactorOffered())) return false
+  return (await getSettingsUncached()).get('security.two_factor_required_for_staff')
+}
+
+/** Whether this member must hold a second factor, and may not drop it. */
+export async function secondFactorPosture(userId: number | null): Promise<SecondFactorPosture> {
+  const offered = await twoFactorOffered()
+  if (!offered || userId === null) return { offered, required: false }
+
+  if (!(await twoFactorRequiredForStaff())) return { offered, required: false }
+
+  const actor = await getActor()
+  if (actor.userId !== userId) return { offered, required: false }
+
+  return { offered, required: getContainer().authorizer.can(actor, 'admincp.access') }
+}
+
+export async function memberHoldsSecondFactor(userId: number): Promise<boolean> {
+  return holdsSecondFactor(getContainer().accountStore.twoFactor, userId)
+}
+
+export async function clearMemberSecondFactor(userId: number): Promise<boolean> {
+  return clearSecondFactor(getContainer().accountStore, userId)
+}
+
+export async function pendingEnrolment(userId: number): Promise<Enrolment | null> {
+  const service = twoFactorService()
+  if (service === null) return null
+
+  const name = (await getSettingsUncached()).get('board.name')
+  return service.pendingEnrolment(userId, name.trim() === '' ? 'Meith' : name)
+}
+
+export async function twoFactorState(userId: number): Promise<TwoFactorState> {
+  const service = twoFactorService()
+  if (service === null) return { enrolled: false, pending: false, recoveryCodesLeft: 0 }
+
+  return service.state(userId)
+}