@meith/web 0.21.2 → 0.23.0

package/src/server/api/subscriptions.ts

@@ -6,7 +6,10 @@ import { ValidationError } from '@meith/core'
 import { msg } from '@meith/i18n'
 import { parseSubscriptionTarget, SubscriptionService } from '@meith/subscriptions'
 
+import { filterWords } from '@/view/word-filter'
+
 import { getContainer } from '../container'
+import { activeWordFilter } from '../content-admin'
 import { type ApiResult, type ApiRoutes, bodyId, bodyText, notFound, requireUserId } from './http'
 
 async function mayView(
@@ -48,6 +51,7 @@ export const SUBSCRIPTION_HANDLERS: ApiRoutes = [
       const userId = requireUserId(actor)
       const visibleForumIds = await getContainer().authorizer.visibleForumIds(actor)
       const rows = await requireSubscriptions().list(userId, visibleForumIds)
+      const wordFilter = await activeWordFilter()
 
       return {
         status: 200,
@@ -55,7 +59,7 @@ export const SUBSCRIPTION_HANDLERS: ApiRoutes = [
           data: rows.map((row) => ({
             target: row.target,
             targetId: row.targetId,
-            title: row.title,
+            title: row.target === 'thread' ? filterWords(row.title, wordFilter) : row.title,
             href: row.href,
             mode: row.mode,
             createdAt: row.createdAt.toISOString(),

package/src/server/auth-actions.ts

@@ -93,7 +93,13 @@ export async function registerAction(_prev: FormState, form: FormData): Promise<
   const email = field(form, 'email')
   const password = field(form, 'password')
   const accepted = field(form, 'terms') !== ''
-  const values = { username, email, ...(accepted ? { terms: '1' } : {}) }
+  const announcements = field(form, 'announcements') !== ''
+  const values = {
+    username,
+    email,
+    ...(accepted ? { terms: '1' } : {}),
+    ...(announcements ? { announcements: '1' } : {}),
+  }
 
   const identity = await configuredIdentity()
 
@@ -142,6 +148,11 @@ export async function registerAction(_prev: FormState, form: FormData): Promise<
 
     if (fields !== null) await fields.applyRegistration(result.account.id, fieldValues)
 
+    const { memberSettings } = getContainer()
+    if (announcements && memberSettings !== null) {
+      await memberSettings.saveMassMailOptIn({ userId: result.account.id, optIn: true })
+    }
+
     if (result.verificationToken !== undefined) {
       verification = {
         token: result.verificationToken,

package/src/server/auth-config.ts

@@ -38,17 +38,6 @@ export async function boardSessionConfig(): Promise<BoardSessionConfig> {
   }
 }
 
-/**
- * Applied last, over the stored settings, because on a demo the stored settings
- * are whatever the last visitor left behind.
- *
- * The lockout exists to make guessing a password expensive. A demo's passwords
- * are printed on the page, so there is nothing left to guess — and the counter
- * is per account, which means one visitor mistyping `admin` five times locks the
- * published login for everyone else for a quarter of an hour. Not disabled
- * outright: this is still a login form on the open internet, and something
- * hammering it should still meet a wall.
- */
 function demoOverrides(config: AuthConfig): AuthConfig {
   if (!env.DEMO_MODE) return config
 

package/src/server/auth-events.ts

@@ -8,11 +8,6 @@ import { requestFingerprint } from './request-fingerprint'
 
 export const MEMBER_ACTIVITY_LIMIT = 20
 
-/**
- * Never lets the log stop the thing it is recording. A sign-in that worked and
- * went unrecorded is a gap in an audit trail; a sign-in refused because the
- * audit trail was unwritable is an outage.
- */
 export async function recordAuthEvent(input: {
   readonly userId: number | null
   readonly kind: AuthEventKind

package/src/server/ban-filter-admin-actions.ts

@@ -0,0 +1,112 @@
+'use server'
+
+import { revalidatePath } from 'next/cache'
+
+import {
+  assertUsableFilter,
+  BAN_FILTER_TYPES,
+  type BanFilterType,
+  matchBanFilter,
+} from '@meith/accounts'
+import { ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+
+import { recordAdminAction, requireAdmin } from './admin'
+import type { FormState } from './auth-form-state'
+import { boardBanFilters } from './ban-filter-admin'
+import { getContainer } from './container'
+import { formStateReporter } from './form-state-reporter'
+import { trimmedText } from './form-values'
+import { remoteAddress } from './request-fingerprint'
+
+const BAN_FILTER_SCREEN = '/admin/users/ban-filters'
+
+const toFormState = formStateReporter('ban-filter-admin', 'ban filter write failed')
+
+function refreshBanFilterScreen(): void {
+  revalidatePath(BAN_FILTER_SCREEN)
+}
+
+function filterType(form: FormData): BanFilterType {
+  const value = trimmedText(form, 'type')
+  if (!(BAN_FILTER_TYPES as readonly string[]).includes(value)) {
+    throw new ValidationError(msg('error.app.kind-ban-filter'))
+  }
+  return value as BanFilterType
+}
+
+function filterId(form: FormData): number {
+  const id = Number(trimmedText(form, 'id'))
+  if (!Number.isSafeInteger(id) || id <= 0) {
+    throw new ValidationError(msg('error.app.such-ban-filter'))
+  }
+  return id
+}
+
+async function assertItWouldNotLockYouOut(
+  userId: number,
+  type: BanFilterType,
+  pattern: string,
+): Promise<void> {
+  const account = await getContainer().accountStore.accounts.findById(userId)
+  const ip = await remoteAddress()
+
+  const matched = matchBanFilter([{ id: 0, type, pattern }], {
+    ...(account === null ? {} : { username: account.username, email: account.email }),
+    ...(ip === null ? {} : { ip }),
+  })
+
+  if (matched !== null) throw new ValidationError(msg('error.app.filter-match-you-lock-out'))
+}
+
+export async function addBanFilterAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const values = {
+    type: trimmedText(form, 'type'),
+    pattern: trimmedText(form, 'pattern'),
+    note: trimmedText(form, 'note'),
+  }
+
+  try {
+    const context = await requireAdmin()
+
+    const type = filterType(form)
+    const pattern = trimmedText(form, 'pattern')
+    const note = trimmedText(form, 'note')
+
+    assertUsableFilter(type, pattern)
+    await assertItWouldNotLockYouOut(context.userId, type, pattern)
+
+    const id = await boardBanFilters().create({
+      type,
+      pattern,
+      note: note === '' ? null : note,
+      createdByUserId: context.userId,
+    })
+
+    refreshBanFilterScreen()
+    await recordAdminAction({
+      action: 'user.ban_filter_added',
+      detail: { filterId: id, type, pattern },
+    })
+
+    return { notice: 'created' }
+  } catch (err) {
+    return toFormState(err, values)
+  }
+}
+
+export async function removeBanFilterAction(_prev: FormState, form: FormData): Promise<FormState> {
+  try {
+    await requireAdmin()
+    const id = filterId(form)
+
+    await boardBanFilters().remove(id)
+
+    refreshBanFilterScreen()
+    await recordAdminAction({ action: 'user.ban_filter_removed', detail: { filterId: id } })
+
+    return { notice: 'removed' }
+  } catch (err) {
+    return toFormState(err)
+  }
+}

package/src/server/ban-filter-admin.ts

@@ -0,0 +1,25 @@
+import 'server-only'
+
+import type { BanFilterAdminRepository, BanFilterRecord } from '@meith/accounts'
+
+import { getContainer } from './container'
+
+export function boardBanFilters(): BanFilterAdminRepository {
+  return getContainer().banFilters
+}
+
+export async function banFilterAuthors(
+  filters: readonly BanFilterRecord[],
+): Promise<ReadonlyMap<number, string>> {
+  const { accountStore } = getContainer()
+  const names = new Map<number, string>()
+
+  for (const id of new Set(filters.map((row) => row.createdByUserId))) {
+    if (id === null || names.has(id)) continue
+
+    const account = await accountStore.accounts.findById(id)
+    if (account !== null) names.set(id, account.username)
+  }
+
+  return names
+}

package/src/server/brand-assets.ts

@@ -89,15 +89,11 @@ export async function loadBrandInfo(): Promise<BrandInfo> {
     const settings = await getSettings()
     title = settings.get('board.name').trim() || BOARD_TITLE
     description = settings.get('board.description').trim()
-  } catch {
-    /* ignore */
-  }
+  } catch {}
 
   try {
     tokens = (await getBoardThemeStyle()).defaultTokens
-  } catch {
-    /* ignore */
-  }
+  } catch {}
 
   return {
     title,

package/src/server/container.ts

@@ -4,6 +4,7 @@ import forumConfig from '@board/config'
 
 import {
   type AccountStore,
+  type BanFilterAdminRepository,
   type BanLookup,
   BanService,
   createMemoryStore,
@@ -11,6 +12,7 @@ import {
   IdentityService,
   type MemberProfileRepository,
   type MemberSettingsRepository,
+  MemoryBanFilters,
   SessionService,
 } from '@meith/accounts'
 import type { AdminLogRepository, AdminSessionRepository } from '@meith/admin'
@@ -33,6 +35,7 @@ import {
   PostgresAttachmentRepository,
   PostgresAuthorizationSource,
   PostgresAvatarRepository,
+  PostgresBanFilterRepository,
   PostgresBanRepository,
   PostgresDraftRepository,
   PostgresForumRepository,
@@ -118,6 +121,7 @@ export interface Container {
   readonly identity: IdentityService
   readonly sessions: SessionService
   readonly banLookup: BanLookup | null
+  readonly banFilters: BanFilterAdminRepository
   readonly forums: ForumRepository
   readonly threads: ThreadRepository
   readonly threadWrites: (ThreadWriteRepository & ReplyWriteRepository) | null
@@ -204,7 +208,7 @@ function buildFixture(onBypass: (e: BypassEvent) => void): Container {
     posts: new FixturePostRepository(),
     memberProfiles: new FixtureMemberProfileRepository(),
     fixtureDataVersion: FIXTURE_DATA_VERSION,
-    ...identityServices(store),
+    ...identityServices(store, new MemoryBanFilters()),
     accountStore: store,
     dataSource: 'fixture',
   }
@@ -216,16 +220,19 @@ function cached(inner: ForumRepository): ForumRepository {
 
 function identityServices(
   store: AccountStore,
+  banFilters: BanFilterAdminRepository,
   bans?: BanLookup,
 ): {
   identity: IdentityService
   sessions: SessionService
   banLookup: BanLookup | null
+  banFilters: BanFilterAdminRepository
 } {
   return {
     identity: new IdentityService({
       store,
       config: AUTH_CONFIG,
+      banFilters,
       secondFactor: enrolmentLookup(store.twoFactor),
       ...(bans === undefined ? {} : { bans }),
     }),
@@ -235,6 +242,7 @@ function identityServices(
       sessionLifetimeDays: SESSION_LIFETIME_DAYS,
     }),
     banLookup: bans ?? null,
+    banFilters,
   }
 }
 
@@ -287,7 +295,7 @@ function buildPostgres(onBypass: (e: BypassEvent) => void): Container {
     threadViews,
     fixtureDataVersion: null,
     accountStore: store,
-    ...identityServices(store, new PostgresBanRepository(db)),
+    ...identityServices(store, new PostgresBanFilterRepository(db), new PostgresBanRepository(db)),
     scheduler: withDemoReset(
       buildSchedulerBundle({
         queue: drivers().queue,
@@ -308,14 +316,6 @@ function buildPostgres(onBypass: (e: BypassEvent) => void): Container {
   }
 }
 
-/**
- * The reset is registered here rather than in `buildSchedulerBundle` because
- * this is the only composition root with a cache to clear afterwards. The
- * worker's `NextCacheDriver` is a different process holding a different map, so
- * a reset it ran would leave this process serving the forum tree of a board
- * that no longer exists — for up to the tree's 60-second TTL, on the one page
- * every visitor lands on.
- */
 function withDemoReset(bundle: SchedulerBundle, db: ReturnType<typeof getDb>): SchedulerBundle {
   if (!env.DEMO_MODE) return bundle
 
@@ -367,6 +367,7 @@ export function getContainer(): Container {
     cached.adminLog === undefined ||
     cached.attachments === undefined ||
     cached.avatars === undefined ||
+    cached.banFilters === undefined ||
     typeof cached.memberProfiles?.findPublicById !== 'function' ||
     typeof cached.accountStore?.identities?.listForUser !== 'function' ||
     typeof cached.accountStore?.passkeys?.listForUser !== 'function' ||
@@ -383,10 +384,11 @@ export function getAuthorizer(): Authorizer {
 }
 
 export async function configuredIdentity(): Promise<IdentityService> {
-  const { accountStore, banLookup } = getContainer()
+  const { accountStore, banLookup, banFilters } = getContainer()
   return new IdentityService({
     store: accountStore,
     config: await boardAuthConfig(),
+    banFilters,
     secondFactor: enrolmentLookup(accountStore.twoFactor),
     ...(banLookup === null ? {} : { bans: banLookup }),
   })

package/src/server/cookies.ts

@@ -3,20 +3,9 @@ export const REMEMBER_COOKIE = '__Host-fs_remember'
 export const DEV_SESSION_COOKIE = 'fs_session'
 export const DEV_REMEMBER_COOKIE = 'fs_remember'
 
-/**
- * Counts one reader once, and carries nothing else.
- *
- * An opaque random value, first-party, readable by nobody but this board. It
- * exists because "37 guests reading" is not derivable from a stateless request:
- * without something that comes back, every page view is a stranger. It is never
- * an identity — no code path turns it into an actor, and `locateSession()`
- * refuses a row with no user — so the worst it can say about the person holding
- * it is that they were here.
- */
 export const GUEST_COOKIE = '__Host-fs_guest'
 export const DEV_GUEST_COOKIE = 'fs_guest'
 
-/** Long enough that a reader is one guest across a visit, short enough to expire. */
 export const GUEST_COOKIE_DAYS = 1
 
 export const ADMIN_COOKIE = 'fs_admin'
@@ -31,7 +20,6 @@ export const DEV_PASSKEY_COOKIE = 'fs_passkey'
 export const SECOND_FACTOR_COOKIE = '__Host-fs_2fa'
 export const DEV_SECOND_FACTOR_COOKIE = 'fs_2fa'
 
-/** Long enough to read a consent screen, short enough that a stale one is gone. */
 export const HANDSHAKE_MINUTES = 10
 
 export function sessionCookieName(secure: boolean): string {
@@ -108,26 +96,14 @@ export function secondFactorCookieName(secure: boolean): string {
   return secure ? SECOND_FACTOR_COOKIE : DEV_SECOND_FACTOR_COOKIE
 }
 
-/**
- * A sign-in that has proved its password and nothing else. Strict, because
- * every step that finishes it starts on this board — and short, because it
- * stands in for a password already given.
- */
 export function secondFactorCookie(expires: Date, secure: boolean): CookieAttrs {
   return { httpOnly: true, secure, sameSite: 'strict', path: '/', expires }
 }
 
-/**
- * Lax, not Strict: the identity provider sends the member back with a top-level
- * GET, and a Strict cookie is not attached to a navigation that started on
- * another site — the handshake would arrive with nothing to check the state
- * against and every sign-in would fail.
- */
 export function ssoCookie(secure: boolean): CookieAttrs {
   return { ...base(secure), maxAge: HANDSHAKE_MINUTES * 60 }
 }
 
-/** Strict: nothing in the passkey exchange ever leaves this board. */
 export function passkeyCookie(secure: boolean): CookieAttrs {
   return {
     httpOnly: true,

package/src/server/demo-uploads.ts

@@ -4,17 +4,6 @@ import { rm } from 'node:fs/promises'
 
 import { env, logger } from '@meith/core'
 
-/**
- * Everything a visitor uploaded, thrown away with the board that referenced it.
- *
- * Only local storage is cleared. A demo pointed at an object store is not a
- * configuration this project asks anyone to run, and quietly issuing bulk
- * deletes against a bucket somebody else's board might share is a worse failure
- * than leaving files behind.
- *
- * Kept apart from the rest of the demo helpers because the container calls this
- * one, and the others call the container.
- */
 export async function clearUploadedFiles(): Promise<void> {
   if (env.FILESTORE_DRIVER !== 'local') {
     logger({ module: 'demo' }).warn(

package/src/server/demo.ts

@@ -12,13 +12,6 @@ import {
 
 import { getContainer } from './container'
 
-/**
- * Refuses a change to a published demo login's password or email.
- *
- * Checked by user id, resolved to a username here, because the demo package
- * cannot know the ids — they are handed out by Postgres at seed time and differ
- * every reset. The username is the stable thing.
- */
 export async function assertDemoAccountChangeable(
   userId: number,
   what: FrozenField,
@@ -31,13 +24,6 @@ export async function assertDemoAccountChangeable(
   assertDemoAccountIsChangeable(account.username, what)
 }
 
-/**
- * The administrator's own edit screen can rename a member, and renaming
- * `admin` is the same lockout as changing its password by a longer route — the
- * banner would go on naming a login that no longer exists. Only refused when
- * the value actually differs, so an admin can still open the demo login's
- * account screen and change its groups.
- */
 export async function assertDemoIdentityUnchanged(
   userId: number,
   submitted: { readonly username: string; readonly email: string },
@@ -55,13 +41,6 @@ export async function assertDemoIdentityUnchanged(
   }
 }
 
-/**
- * The banner's content, or `null` on any board that is not a demo.
- *
- * Failure here is deliberately quiet. The banner is an aid, and a board that
- * refuses to render because it could not work out when it next resets is worse
- * than a board that renders without the countdown.
- */
 export async function demoBannerModel(): Promise<DemoBanner | null> {
   if (!env.DEMO_MODE) return null
 

package/src/server/federation-actions.ts

@@ -26,12 +26,6 @@ const toFormState = formStateReporter(
   'unexpected error while changing a sign-in',
 )
 
-/**
- * Only a credential the board would actually accept today counts as a way back
- * in. A passkey on a board that has since switched passkeys off, or a link to a
- * provider an operator has turned off, opens nothing — counting it would let a
- * member unlink their way out of their own account in one click.
- */
 async function usableWaysIn(userId: number): Promise<{
   readonly usablePasskeys: number
   readonly usableProviders: readonly string[]

package/src/server/federation.ts

@@ -50,13 +50,6 @@ export function federationOptions(settings: SettingsSnapshot): FederationOptions
   }
 }
 
-/**
- * Every read here goes past the settings cache, because every one of them
- * decides whether a sign-in may start rather than what a page displays. The
- * cached snapshot is held per module instance, so a route handler can be a
- * minute behind the render that invalidated it — long enough for a provider an
- * operator has just switched on to answer that it is switched off.
- */
 export async function federationProvider(id: string): Promise<IdentityProvider | null> {
   if (!isProviderKind(id)) return null
   if (getContainer().dataSource !== 'postgres') return null

package/src/server/feed-builder.ts

@@ -27,7 +27,7 @@ export function feedFor(
   function threadEntry(thread: FeedThread): FeedEntry {
     return {
       id: tagId('thread', thread.threadId),
-      title: thread.title,
+      title: filterWords(thread.title, wordFilter),
       href: absolute(`/thread/${thread.threadId}-${thread.slug}`),
       author: thread.authorUsername,
       published: thread.createdAt,
@@ -39,7 +39,7 @@ export function feedFor(
   function postEntry(post: FeedPost): FeedEntry {
     return {
       id: tagId('post', post.postId),
-      title: post.threadTitle,
+      title: filterWords(post.threadTitle, wordFilter),
       href: absolute(postLink(`/thread/${post.threadId}-${post.threadSlug}`, post.postId)),
       author: post.authorUsername,
       published: post.createdAt,

package/src/server/feed-routes.ts

@@ -15,11 +15,6 @@ export type FeedFormat = 'rss' | 'atom'
 
 export type FeedScope = 'board' | 'forum' | 'thread'
 
-/**
- * A plugin may reorder, drop, or add. An entry it adds keeps the board's own
- * fields where one matches by href, and is otherwise taken as given — a feed
- * is rendered as a guest, so everything in it is already public.
- */
 async function filterEntries(
   entries: readonly FeedEntry[],
   feed: FeedScope,

package/src/server/i18n.ts

@@ -31,9 +31,7 @@ export const getLocale = cache(async (): Promise<ResolvedLocale> => {
   let boardDefault: string | null = null
   try {
     boardDefault = (await getSettings()).get('display.default_locale')
-  } catch {
-    /* ignore */
-  }
+  } catch {}
 
   return resolveLocale({
     stored: preferences?.locale ?? null,

package/src/server/install.ts

@@ -2,6 +2,7 @@ import 'server-only'
 
 import {
   type AuthConfig,
+  BAN_FILTERS_NOT_CONSULTED,
   DEFAULT_AUTH_POLICY,
   IdentityService,
   rejectedField,
@@ -247,7 +248,11 @@ async function performInstall(input: InstallInput): Promise<readonly StepOutcome
         defaultMemberGroupId: registered.id,
       }
 
-      const identity = new IdentityService({ store: createPostgresAccountStore(db), config })
+      const identity = new IdentityService({
+        store: createPostgresAccountStore(db),
+        config,
+        banFilters: BAN_FILTERS_NOT_CONSULTED,
+      })
       const result = await identity.register({
         username: input.username,
         email: input.email,

package/src/server/location-header.ts

@@ -1,37 +1,7 @@
 export const PATH_HEADER = 'x-forum-path'
 
-/**
- * The query string that came with `PATH_HEADER`, leading `?` included, or
- * absent when there was none.
- *
- * Separate from the path because the path has readers that must not see a
- * query: a presence row records where somebody is, and `/admin/settings` is one
- * place however many groups it can be filtered by. The panel rail is the reader
- * that needs both — its settings sections differ only by `?group=`, so a rail
- * given the path alone cannot say which one is open.
- */
 export const QUERY_HEADER = 'x-forum-query'
 
-/**
- * Set by the middleware when it has just minted the guest cookie, meaning the
- * client has not sent one back yet.
- *
- * It exists because the obvious test does not work: a cookie set on a
- * `NextResponse.next()` response is reflected into the request the render sees,
- * so neither `cookies()` nor the raw `Cookie` header can tell "the client kept
- * this" from "we made it up a millisecond ago". Without the distinction every
- * request from something that discards cookies wrote a presence row, which
- * measured as twelve rows from twelve crawler requests.
- *
- * The middleware sets it or deletes it on every request, so a client cannot
- * supply its own.
- */
 export const FRESH_GUEST_HEADER = 'x-forum-fresh-guest'
 
-/**
- * The per-request Content-Security-Policy nonce minted by `proxy.ts`, for the
- * handful of inline `<script>` tags the app emits itself. Next reads the nonce
- * out of the policy header on its own; this one is for our tags. See
- * `docs/operating.md`.
- */
 export const NONCE_HEADER = 'x-nonce'

package/src/server/mail-send.ts

@@ -6,12 +6,6 @@ import { drivers } from '@meith/drivers'
 
 import { emitEvent, filterView } from './plugin-view'
 
-/**
- * Every message the board sends from a request, past the plugins first. A
- * plugin may rewrite the recipient, the subject or either body, or return null
- * to drop the message — which is silent, because the member asked the board to
- * do something and the board's answer is the page, not the mail.
- */
 export async function sendBoardMail(template: string, mail: OutgoingMail): Promise<boolean> {
   const proposed = await filterView(
     'mail.send.before',

package/src/server/marketplace-actions.ts

@@ -9,12 +9,6 @@ import type { FormState } from './auth-form-state'
 import { tr } from './i18n'
 import { refreshMarketplaceNow } from './marketplace-admin'
 
-/**
- * The Browse tab's "Refresh" button. Runs the exact same fetch, validate,
- * cache, notify pass as the daily task (`refreshMarketplaceNow`, shared with
- * `packages/runtime`'s task worker) — this is the "on demand" half of that
- * one behaviour, not a second implementation of it.
- */
 export async function refreshMarketplaceAction(
   _prev: FormState,
   _form: FormData,