@meith/web 0.21.2 → 0.22.0

package/src/components/account/notification-forms.tsx

@@ -6,6 +6,7 @@ import { EMPTY_STATE } from '@/server/auth-form-state'
 import {
   markAllNotificationsReadAction,
   markNotificationReadAction,
+  saveMassMailOptInAction,
   saveNotificationPreferencesAction,
 } from '@/server/notification-actions'
 
@@ -155,3 +156,47 @@ export function NotificationPreferencesForm({
     </form>
   )
 }
+
+export function AnnouncementsOptInForm({ optedIn, copy }: { optedIn: boolean; copy: Copy }) {
+  const [state, action] = useActionState(saveMassMailOptInAction, EMPTY_STATE)
+
+  return (
+    <form
+      action={action}
+      className="flex flex-col gap-4 rounded-lg border border-border bg-card p-5"
+    >
+      <FormError message={state.error} />
+
+      <fieldset className="flex flex-col gap-3">
+        <legend className="text-sm font-medium">
+          {fromCopy(copy, 'accountForm.announcements.legend')}
+        </legend>
+
+        <label className="flex items-start gap-3 text-sm">
+          <input
+            type="checkbox"
+            name="announcements"
+            defaultChecked={optedIn}
+            className={`mt-1 ${CHECKBOX}`}
+          />
+          <span>
+            <span className="font-medium">{fromCopy(copy, 'accountForm.announcements.title')}</span>
+            <span className="block text-muted-foreground">
+              {fromCopy(copy, 'accountForm.announcements.description')}
+            </span>
+          </span>
+        </label>
+      </fieldset>
+
+      <p className="text-xs text-muted-foreground">
+        {fromCopy(copy, 'accountForm.announcements.blurb')}
+      </p>
+
+      <div>
+        <button type="submit" className={BUTTON}>
+          {fromCopy(copy, 'accountForm.announcements.submit')}
+        </button>
+      </div>
+    </form>
+  )
+}

package/src/components/admin/admin-nav.tsx

@@ -8,10 +8,6 @@ import { ADMIN_OVERVIEW, adminNavWithPlugin, pluginKeyAt } from '@/view/admin-na
 import type { PanelNav, PanelSection } from '@/view/panel-nav'
 import { pluginNavChildren } from '@/view/plugin-panel'
 
-/**
- * A plugin may reorder, drop, or add a section here. A link it adds reaches a
- * page it declared and nothing else — the panel re-checks who is asking.
- */
 async function withPluginSections(nav: PanelNav, t: Awaited<ReturnType<typeof getTranslator>>) {
   const links = await filterView(
     'admin.navigation',

package/src/components/admin/marketplace-listing.tsx

@@ -12,15 +12,6 @@ const TONE_CLASS: Readonly<Record<StatusTone, string>> = {
   destructive: 'bg-destructive/10 text-destructive',
 }
 
-/**
- * One catalog entry, plugin or theme alike — the row model already carries
- * everything both browse pages need, so this is the one place that renders
- * it. Every string here is either our own catalog copy or a value from
- * `MarketplaceListingRow`, which has already capped lengths and validated
- * URLs against the untrusted feed (see `apps/community/src/server/marketplace-admin.ts`);
- * nothing here uses `dangerouslySetInnerHTML`, so the feed's own text is
- * rendered as plain text no matter what it contains.
- */
 export function MarketplaceListingCard({
   listing,
   t,

package/src/components/auth/passkey-client.ts

@@ -105,11 +105,6 @@ export async function signInWithPasskey(next: string | undefined, copy: Copy): P
   return assertPasskey('authenticate', next, copy)
 }
 
-/**
- * The same exchange, against a sign-in that has already given its password.
- * The board scopes the challenge to that member's own credentials, so the
- * browser offers only the keys that could finish this particular sign-in.
- */
 export async function confirmWithPasskey(next: string | undefined, copy: Copy): Promise<string> {
   return assertPasskey('second-factor', next, copy)
 }

package/src/components/auth/register-form.tsx

@@ -105,6 +105,24 @@ export function RegisterForm({
         </>
       )}
 
+      <label className="flex items-start gap-2 text-sm text-muted-foreground">
+        <input
+          type="checkbox"
+          name="announcements"
+          value="1"
+          defaultChecked={state.values?.announcements === '1'}
+          className="mt-0.5 size-4 rounded border-input accent-primary"
+        />
+        <span>
+          <span className="block text-foreground">
+            {fromCopy(copy, 'authForm.register.announcements')}
+          </span>
+          <span className="block text-xs">
+            {fromCopy(copy, 'authForm.register.announcementsHint')}
+          </span>
+        </span>
+      </label>
+
       {terms !== null && (
         <label className="flex items-start gap-2 text-sm text-muted-foreground">
           <input

package/src/components/content/composer-ids.ts

@@ -1,4 +1,3 @@
-/** The default `id` a page's `EditorToolbar` and the composer's textarea agree on. */
 export const MESSAGE_TEXTAREA_ID = 'post-message'
 
 export function attachmentFieldId(textareaId: string): string {

package/src/components/content/markdown-editor.tsx

@@ -84,13 +84,6 @@ export interface MarkdownEditorProps {
   readonly hint?: React.ReactNode
   readonly scope?: PreviewScope
   readonly attachTo?: AttachmentTarget | undefined
-  /**
-   * Whether the formatting buttons render inside this component (`'inline'`,
-   * the default — every composer outside the post/reply/edit pages) or are
-   * left to the page's `EditorToolbar` slot (`'external'`), which addresses
-   * this textarea by `id` from a different part of the tree. Either way the
-   * textarea works with none of them: the buttons are the enhancement.
-   */
   readonly toolbar?: 'inline' | 'external' | undefined
 }
 

package/src/components/shell/demo-banner.tsx

@@ -2,14 +2,6 @@ import { demoBannerModel } from '@/server/demo'
 import { getTranslator } from '@/server/i18n'
 import { splitAround } from '@/view/copy'
 
-/**
- * The strip at the top of a demo board.
- *
- * Rendered from the root layout rather than through a theme slot, on purpose:
- * the slot contract is frozen, and a visiting administrator can switch themes.
- * A banner a theme could decline to render is a banner that stops telling the
- * next visitor how to log in, on the first theme that has not heard of it.
- */
 export async function DemoBanner() {
   const banner = await demoBannerModel()
   if (banner === null) return null

package/src/config.ts

@@ -1,13 +1,2 @@
-/**
- * `@meith/web/config` — the surface a board's own `community.config.ts`
- * builds against.
- *
- * A scaffolded board depends on `@meith/web` for the app itself, and imports
- * its board-time registry through this subpath rather than reaching into
- * `@meith/core` directly. That indirection is what lets `@meith/web` change
- * which package actually defines `defineForumConfig` without every board's
- * `community.config.ts` following along.
- */
-
 export type { ForumConfig, InstalledPlugin, InstalledTheme, MessageBundle } from '@meith/core'
 export { defineForumConfig } from '@meith/core'

package/src/server/admin-actions.ts

@@ -103,11 +103,6 @@ export async function adminSignInAction(_prev: FormState, form: FormData): Promi
   redirect(target)
 }
 
-/**
- * The panel's door asks for the second factor as well as the password. The
- * panel can rewrite the whole board, so re-proving only the thing most likely
- * to have leaked would be re-proving the wrong one.
- */
 async function adminReauthenticationBucket(userId: number): Promise<string> {
   const prefix = await retainedIpPrefix()
   return prefix === null ? `admin-reauth:${userId}` : `admin-reauth:${userId}@${prefix}`

package/src/server/antispam.ts

@@ -16,7 +16,7 @@ import {
   type RateLimitOutcome,
   subjectFor,
 } from '@meith/antispam'
-import type { Actor, NumericGlobalPermission } from '@meith/authorization'
+import type { Actor, NumericGlobalPermission, Target } from '@meith/authorization'
 import { env, logger } from '@meith/core'
 import { getDb, PostgresCaptchaQuestionRepository, PostgresRateLimitBucketStore } from '@meith/db'
 import type { SettingsSnapshot } from '@meith/settings'
@@ -280,29 +280,42 @@ export async function verifyChallenge(form: FormData): Promise<ChallengeVerdict>
   }
 }
 
+const FIRST_POST_UNRESOLVED = 'could not resolve first-post moderation'
+
+function bypassesModeration(actor: Actor, target: Target): boolean {
+  try {
+    return getContainer().authorizer.can(actor, 'content.viewUnapproved', target)
+  } catch (error) {
+    logger().warn({ err: String(error), stage: 'bypass', held: true }, FIRST_POST_UNRESOLVED)
+    return false
+  }
+}
+
 export async function holdsNewMember(input: {
   readonly actor: Actor
   readonly postCount: number
+  readonly target: Target
   readonly settings?: SettingsSnapshot
 }): Promise<boolean> {
+  let threshold = 0
   try {
     const settings = input.settings ?? (await getSettings())
-    const threshold = Number(settings.get('antispam.moderate_first_posts') ?? 0)
-    if (threshold <= 0) return false
-
-    const { authorizer } = getContainer()
-    return holdsForReview(
-      {
-        userId: input.actor.userId,
-        postCount: input.postCount,
-        bypassesModeration: authorizer.can(input.actor, 'content.viewUnapproved'),
-      },
-      { threshold },
-    )
+    threshold = Number(settings.get('antispam.moderate_first_posts') ?? 0)
   } catch (error) {
-    logger().warn({ err: String(error) }, 'could not resolve first-post moderation')
+    logger().warn({ err: String(error), stage: 'threshold', held: false }, FIRST_POST_UNRESOLVED)
     return false
   }
+
+  if (threshold <= 0) return false
+
+  return holdsForReview(
+    {
+      userId: input.actor.userId,
+      postCount: input.postCount,
+      bypassesModeration: bypassesModeration(input.actor, input.target),
+    },
+    { threshold },
+  )
 }
 
 export function antispamAvailable(): boolean {

package/src/server/auth-actions.ts

@@ -93,7 +93,13 @@ export async function registerAction(_prev: FormState, form: FormData): Promise<
   const email = field(form, 'email')
   const password = field(form, 'password')
   const accepted = field(form, 'terms') !== ''
-  const values = { username, email, ...(accepted ? { terms: '1' } : {}) }
+  const announcements = field(form, 'announcements') !== ''
+  const values = {
+    username,
+    email,
+    ...(accepted ? { terms: '1' } : {}),
+    ...(announcements ? { announcements: '1' } : {}),
+  }
 
   const identity = await configuredIdentity()
 
@@ -142,6 +148,11 @@ export async function registerAction(_prev: FormState, form: FormData): Promise<
 
     if (fields !== null) await fields.applyRegistration(result.account.id, fieldValues)
 
+    const { memberSettings } = getContainer()
+    if (announcements && memberSettings !== null) {
+      await memberSettings.saveMassMailOptIn({ userId: result.account.id, optIn: true })
+    }
+
     if (result.verificationToken !== undefined) {
       verification = {
         token: result.verificationToken,

package/src/server/auth-config.ts

@@ -38,17 +38,6 @@ export async function boardSessionConfig(): Promise<BoardSessionConfig> {
   }
 }
 
-/**
- * Applied last, over the stored settings, because on a demo the stored settings
- * are whatever the last visitor left behind.
- *
- * The lockout exists to make guessing a password expensive. A demo's passwords
- * are printed on the page, so there is nothing left to guess — and the counter
- * is per account, which means one visitor mistyping `admin` five times locks the
- * published login for everyone else for a quarter of an hour. Not disabled
- * outright: this is still a login form on the open internet, and something
- * hammering it should still meet a wall.
- */
 function demoOverrides(config: AuthConfig): AuthConfig {
   if (!env.DEMO_MODE) return config
 

package/src/server/auth-events.ts

@@ -8,11 +8,6 @@ import { requestFingerprint } from './request-fingerprint'
 
 export const MEMBER_ACTIVITY_LIMIT = 20
 
-/**
- * Never lets the log stop the thing it is recording. A sign-in that worked and
- * went unrecorded is a gap in an audit trail; a sign-in refused because the
- * audit trail was unwritable is an outage.
- */
 export async function recordAuthEvent(input: {
   readonly userId: number | null
   readonly kind: AuthEventKind

package/src/server/brand-assets.ts

@@ -89,15 +89,11 @@ export async function loadBrandInfo(): Promise<BrandInfo> {
     const settings = await getSettings()
     title = settings.get('board.name').trim() || BOARD_TITLE
     description = settings.get('board.description').trim()
-  } catch {
-    /* ignore */
-  }
+  } catch {}
 
   try {
     tokens = (await getBoardThemeStyle()).defaultTokens
-  } catch {
-    /* ignore */
-  }
+  } catch {}
 
   return {
     title,

package/src/server/container.ts

@@ -308,14 +308,6 @@ function buildPostgres(onBypass: (e: BypassEvent) => void): Container {
   }
 }
 
-/**
- * The reset is registered here rather than in `buildSchedulerBundle` because
- * this is the only composition root with a cache to clear afterwards. The
- * worker's `NextCacheDriver` is a different process holding a different map, so
- * a reset it ran would leave this process serving the forum tree of a board
- * that no longer exists — for up to the tree's 60-second TTL, on the one page
- * every visitor lands on.
- */
 function withDemoReset(bundle: SchedulerBundle, db: ReturnType<typeof getDb>): SchedulerBundle {
   if (!env.DEMO_MODE) return bundle
 

package/src/server/cookies.ts

@@ -3,20 +3,9 @@ export const REMEMBER_COOKIE = '__Host-fs_remember'
 export const DEV_SESSION_COOKIE = 'fs_session'
 export const DEV_REMEMBER_COOKIE = 'fs_remember'
 
-/**
- * Counts one reader once, and carries nothing else.
- *
- * An opaque random value, first-party, readable by nobody but this board. It
- * exists because "37 guests reading" is not derivable from a stateless request:
- * without something that comes back, every page view is a stranger. It is never
- * an identity — no code path turns it into an actor, and `locateSession()`
- * refuses a row with no user — so the worst it can say about the person holding
- * it is that they were here.
- */
 export const GUEST_COOKIE = '__Host-fs_guest'
 export const DEV_GUEST_COOKIE = 'fs_guest'
 
-/** Long enough that a reader is one guest across a visit, short enough to expire. */
 export const GUEST_COOKIE_DAYS = 1
 
 export const ADMIN_COOKIE = 'fs_admin'
@@ -31,7 +20,6 @@ export const DEV_PASSKEY_COOKIE = 'fs_passkey'
 export const SECOND_FACTOR_COOKIE = '__Host-fs_2fa'
 export const DEV_SECOND_FACTOR_COOKIE = 'fs_2fa'
 
-/** Long enough to read a consent screen, short enough that a stale one is gone. */
 export const HANDSHAKE_MINUTES = 10
 
 export function sessionCookieName(secure: boolean): string {
@@ -108,26 +96,14 @@ export function secondFactorCookieName(secure: boolean): string {
   return secure ? SECOND_FACTOR_COOKIE : DEV_SECOND_FACTOR_COOKIE
 }
 
-/**
- * A sign-in that has proved its password and nothing else. Strict, because
- * every step that finishes it starts on this board — and short, because it
- * stands in for a password already given.
- */
 export function secondFactorCookie(expires: Date, secure: boolean): CookieAttrs {
   return { httpOnly: true, secure, sameSite: 'strict', path: '/', expires }
 }
 
-/**
- * Lax, not Strict: the identity provider sends the member back with a top-level
- * GET, and a Strict cookie is not attached to a navigation that started on
- * another site — the handshake would arrive with nothing to check the state
- * against and every sign-in would fail.
- */
 export function ssoCookie(secure: boolean): CookieAttrs {
   return { ...base(secure), maxAge: HANDSHAKE_MINUTES * 60 }
 }
 
-/** Strict: nothing in the passkey exchange ever leaves this board. */
 export function passkeyCookie(secure: boolean): CookieAttrs {
   return {
     httpOnly: true,

package/src/server/demo-uploads.ts

@@ -4,17 +4,6 @@ import { rm } from 'node:fs/promises'
 
 import { env, logger } from '@meith/core'
 
-/**
- * Everything a visitor uploaded, thrown away with the board that referenced it.
- *
- * Only local storage is cleared. A demo pointed at an object store is not a
- * configuration this project asks anyone to run, and quietly issuing bulk
- * deletes against a bucket somebody else's board might share is a worse failure
- * than leaving files behind.
- *
- * Kept apart from the rest of the demo helpers because the container calls this
- * one, and the others call the container.
- */
 export async function clearUploadedFiles(): Promise<void> {
   if (env.FILESTORE_DRIVER !== 'local') {
     logger({ module: 'demo' }).warn(

package/src/server/demo.ts

@@ -12,13 +12,6 @@ import {
 
 import { getContainer } from './container'
 
-/**
- * Refuses a change to a published demo login's password or email.
- *
- * Checked by user id, resolved to a username here, because the demo package
- * cannot know the ids — they are handed out by Postgres at seed time and differ
- * every reset. The username is the stable thing.
- */
 export async function assertDemoAccountChangeable(
   userId: number,
   what: FrozenField,
@@ -31,13 +24,6 @@ export async function assertDemoAccountChangeable(
   assertDemoAccountIsChangeable(account.username, what)
 }
 
-/**
- * The administrator's own edit screen can rename a member, and renaming
- * `admin` is the same lockout as changing its password by a longer route — the
- * banner would go on naming a login that no longer exists. Only refused when
- * the value actually differs, so an admin can still open the demo login's
- * account screen and change its groups.
- */
 export async function assertDemoIdentityUnchanged(
   userId: number,
   submitted: { readonly username: string; readonly email: string },
@@ -55,13 +41,6 @@ export async function assertDemoIdentityUnchanged(
   }
 }
 
-/**
- * The banner's content, or `null` on any board that is not a demo.
- *
- * Failure here is deliberately quiet. The banner is an aid, and a board that
- * refuses to render because it could not work out when it next resets is worse
- * than a board that renders without the countdown.
- */
 export async function demoBannerModel(): Promise<DemoBanner | null> {
   if (!env.DEMO_MODE) return null
 

package/src/server/federation-actions.ts

@@ -26,12 +26,6 @@ const toFormState = formStateReporter(
   'unexpected error while changing a sign-in',
 )
 
-/**
- * Only a credential the board would actually accept today counts as a way back
- * in. A passkey on a board that has since switched passkeys off, or a link to a
- * provider an operator has turned off, opens nothing — counting it would let a
- * member unlink their way out of their own account in one click.
- */
 async function usableWaysIn(userId: number): Promise<{
   readonly usablePasskeys: number
   readonly usableProviders: readonly string[]

package/src/server/federation.ts

@@ -50,13 +50,6 @@ export function federationOptions(settings: SettingsSnapshot): FederationOptions
   }
 }
 
-/**
- * Every read here goes past the settings cache, because every one of them
- * decides whether a sign-in may start rather than what a page displays. The
- * cached snapshot is held per module instance, so a route handler can be a
- * minute behind the render that invalidated it — long enough for a provider an
- * operator has just switched on to answer that it is switched off.
- */
 export async function federationProvider(id: string): Promise<IdentityProvider | null> {
   if (!isProviderKind(id)) return null
   if (getContainer().dataSource !== 'postgres') return null

package/src/server/feed-routes.ts

@@ -15,11 +15,6 @@ export type FeedFormat = 'rss' | 'atom'
 
 export type FeedScope = 'board' | 'forum' | 'thread'
 
-/**
- * A plugin may reorder, drop, or add. An entry it adds keeps the board's own
- * fields where one matches by href, and is otherwise taken as given — a feed
- * is rendered as a guest, so everything in it is already public.
- */
 async function filterEntries(
   entries: readonly FeedEntry[],
   feed: FeedScope,

package/src/server/i18n.ts

@@ -31,9 +31,7 @@ export const getLocale = cache(async (): Promise<ResolvedLocale> => {
   let boardDefault: string | null = null
   try {
     boardDefault = (await getSettings()).get('display.default_locale')
-  } catch {
-    /* ignore */
-  }
+  } catch {}
 
   return resolveLocale({
     stored: preferences?.locale ?? null,

package/src/server/location-header.ts

@@ -1,37 +1,7 @@
 export const PATH_HEADER = 'x-forum-path'
 
-/**
- * The query string that came with `PATH_HEADER`, leading `?` included, or
- * absent when there was none.
- *
- * Separate from the path because the path has readers that must not see a
- * query: a presence row records where somebody is, and `/admin/settings` is one
- * place however many groups it can be filtered by. The panel rail is the reader
- * that needs both — its settings sections differ only by `?group=`, so a rail
- * given the path alone cannot say which one is open.
- */
 export const QUERY_HEADER = 'x-forum-query'
 
-/**
- * Set by the middleware when it has just minted the guest cookie, meaning the
- * client has not sent one back yet.
- *
- * It exists because the obvious test does not work: a cookie set on a
- * `NextResponse.next()` response is reflected into the request the render sees,
- * so neither `cookies()` nor the raw `Cookie` header can tell "the client kept
- * this" from "we made it up a millisecond ago". Without the distinction every
- * request from something that discards cookies wrote a presence row, which
- * measured as twelve rows from twelve crawler requests.
- *
- * The middleware sets it or deletes it on every request, so a client cannot
- * supply its own.
- */
 export const FRESH_GUEST_HEADER = 'x-forum-fresh-guest'
 
-/**
- * The per-request Content-Security-Policy nonce minted by `proxy.ts`, for the
- * handful of inline `<script>` tags the app emits itself. Next reads the nonce
- * out of the policy header on its own; this one is for our tags. See
- * `docs/operating.md`.
- */
 export const NONCE_HEADER = 'x-nonce'

package/src/server/mail-send.ts

@@ -6,12 +6,6 @@ import { drivers } from '@meith/drivers'
 
 import { emitEvent, filterView } from './plugin-view'
 
-/**
- * Every message the board sends from a request, past the plugins first. A
- * plugin may rewrite the recipient, the subject or either body, or return null
- * to drop the message — which is silent, because the member asked the board to
- * do something and the board's answer is the page, not the mail.
- */
 export async function sendBoardMail(template: string, mail: OutgoingMail): Promise<boolean> {
   const proposed = await filterView(
     'mail.send.before',

package/src/server/marketplace-actions.ts

@@ -9,12 +9,6 @@ import type { FormState } from './auth-form-state'
 import { tr } from './i18n'
 import { refreshMarketplaceNow } from './marketplace-admin'
 
-/**
- * The Browse tab's "Refresh" button. Runs the exact same fetch, validate,
- * cache, notify pass as the daily task (`refreshMarketplaceNow`, shared with
- * `packages/runtime`'s task worker) — this is the "on demand" half of that
- * one behaviour, not a second implementation of it.
- */
 export async function refreshMarketplaceAction(
   _prev: FormState,
   _form: FormData,