@meith/web 0.31.0 → 0.33.0

package/src/server/feed-token.ts

@@ -0,0 +1,78 @@
+import 'server-only'
+
+import { authenticateFeedToken, FEED_TOKEN_PREFIX, issueToken } from '@meith/api'
+import { PUBLIC_CONTENT, ValidationError } from '@meith/core'
+import {
+  type FeedScope,
+  type FeedTokenSummary,
+  getDb,
+  PostgresFeedTokenRepository,
+} from '@meith/db'
+import { msg } from '@meith/i18n'
+
+import { getContainer } from './container'
+import { publicScope } from './syndication'
+
+export type { FeedTokenSummary }
+
+export function feedTokenStore(): PostgresFeedTokenRepository | null {
+  return getContainer().dataSource === 'postgres' ? new PostgresFeedTokenRepository(getDb()) : null
+}
+
+export async function resolveFeedToken(presented: string): Promise<number | null> {
+  const store = feedTokenStore()
+  if (store === null) return null
+
+  const outcome = await authenticateFeedToken(presented, store)
+  if (!outcome.ok) return null
+
+  await store.touch(outcome.record.id, new Date()).catch(() => {})
+  return outcome.record.userId
+}
+
+export async function memberFeedScope(userId: number): Promise<FeedScope | null> {
+  const { authorizer, actorSource } = getContainer()
+  const actor = await actorSource.buildForUser(userId)
+  if (actor === null) return null
+
+  return { ...(await authorizer.threadAudience(actor)), content: PUBLIC_CONTENT }
+}
+
+export interface ResolvedFeedScope {
+  readonly scope: FeedScope
+  readonly tokened: boolean
+}
+
+export async function feedScopeForRequest(request: Request): Promise<ResolvedFeedScope> {
+  const presented = new URL(request.url).searchParams.get('token')
+  if (presented === null || presented === '') {
+    return { scope: await publicScope(), tokened: false }
+  }
+
+  const userId = await resolveFeedToken(presented)
+  if (userId === null) return { scope: await publicScope(), tokened: true }
+
+  const member = await memberFeedScope(userId)
+  return { scope: member ?? (await publicScope()), tokened: true }
+}
+
+export async function issueFeedToken(userId: number): Promise<string> {
+  const store = feedTokenStore()
+  if (store === null) throw new ValidationError(msg('error.app.feed-token-needs-database'))
+
+  const issued = issueToken(FEED_TOKEN_PREFIX)
+  await store.regenerate({ userId, lookup: issued.lookup, secretHash: issued.secretHash })
+  return issued.token
+}
+
+export async function revokeFeedToken(userId: number): Promise<void> {
+  const store = feedTokenStore()
+  if (store === null) return
+  await store.revokeForUser(userId)
+}
+
+export async function feedTokenSummary(userId: number): Promise<FeedTokenSummary | null> {
+  const store = feedTokenStore()
+  if (store === null) return null
+  return store.summaryForUser(userId)
+}

package/src/server/fixture-post-repo.ts

@@ -82,6 +82,24 @@ export class FixturePostRepository implements PostRepository {
     }
   }
 
+  async locateFirstUnread(
+    threadId: number,
+    after: { readonly postId: number; readonly since: Date | null },
+    options: { readonly scope: ContentScope; readonly pageSize: number },
+  ): Promise<PostLocation | null> {
+    const first = this.rows
+      .filter(
+        (row) =>
+          row.threadId === threadId &&
+          options.scope.states.includes(row.visibility) &&
+          row.id > after.postId &&
+          (after.since === null || row.createdAt > after.since),
+      )
+      .sort((a, b) => a.id - b.id)[0]
+
+    return first === undefined ? null : this.locate(threadId, first.id, options)
+  }
+
   async listThread(
     threadId: number,
     options: {

package/src/server/forum-admin-actions.ts

@@ -2,7 +2,7 @@
 
 import { revalidatePath } from 'next/cache'
 
-import { readMatrixCell } from '@meith/authorization'
+import { diffMatrixSubmission, matrixCellName, readMatrixCell } from '@meith/authorization'
 import { CacheTags, FORUM_PERMISSION_FIELDS, ValidationError } from '@meith/core'
 import { MODERATOR_RIGHTS } from '@meith/db'
 import { drivers } from '@meith/drivers'
@@ -86,31 +86,38 @@ export async function saveForumOptionsAction(_prev: FormState, form: FormData):
   }
 }
 
-export async function saveForumPermissionsAction(
+export async function saveForumPermissionMatrixAction(
   _prev: FormState,
   form: FormData,
 ): Promise<FormState> {
   try {
     await requireAdmin()
     const id = forumId(form)
-    const groupId = Number(trimmedText(form, 'groupId'))
-    if (!Number.isSafeInteger(groupId) || groupId <= 0) {
-      throw new ValidationError(msg('error.app.such-group'))
-    }
+    const repository = requireForumAdmin()
 
-    const values: Record<string, boolean | number | null> = {}
-    for (const field of FORUM_PERMISSION_FIELDS) {
-      const raw = form.get(field.key)
-      values[field.key] = readMatrixCell(field, typeof raw === 'string' ? raw : undefined)
-    }
+    const groups = await repository.listGroups()
+    const current = await repository.readOverrides([id])
+
+    const submissions = groups.map((group) => ({
+      groupId: group.id,
+      values: Object.fromEntries(
+        FORUM_PERMISSION_FIELDS.map((field) => {
+          const raw = form.get(matrixCellName(group.id, field.key))
+          return [field.key, readMatrixCell(field, typeof raw === 'string' ? raw : undefined)]
+        }),
+      ),
+    }))
 
-    await requireForumAdmin().saveOverrides(id, groupId, values)
+    const changes = diffMatrixSubmission(current, id, submissions)
+    await repository.saveOverridesForGroups(id, changes)
 
     refreshForumPermissionScreens()
-    await recordAdminAction({
-      action: 'forum.permissions_changed',
-      detail: { forumId: id, groupId },
-    })
+    for (const change of changes) {
+      await recordAdminAction({
+        action: 'forum.permissions_changed',
+        detail: { forumId: id, groupId: change.groupId },
+      })
+    }
 
     return { notice: 'saved' }
   } catch (err) {

package/src/server/forum-admin.ts

@@ -2,10 +2,14 @@ import { msg } from '@meith/i18n'
 import 'server-only'
 
 import {
+  buildFieldMatrix,
   buildPermissionMatrix,
   type CopyPlan,
+  type FieldMatrixRow,
   type ForumOverride,
+  type MatrixColumn,
   type MatrixRow,
+  matrixColumns,
   planCopyToDescendants,
 } from '@meith/authorization'
 import { ForbiddenError, type PermissionSet } from '@meith/core'
@@ -37,6 +41,8 @@ export function ancestorChain(forum: ForumRow): readonly number[] {
 export interface ForumMatrixView {
   readonly forum: ForumRow
   readonly rows: readonly MatrixRow[]
+  readonly columns: readonly MatrixColumn[]
+  readonly fields: readonly FieldMatrixRow[]
   readonly chain: readonly number[]
   readonly overrides: readonly ForumOverride[]
   readonly groups: readonly { readonly groupId: number; readonly title: string }[]
@@ -77,6 +83,7 @@ export async function buildForumMatrixView(forumId: number): Promise<ForumMatrix
   const descendants = all.filter((row) => row.path.startsWith(`${forum.path}.`))
 
   const overrides = await repository.readOverrides([...chain, ...descendants.map((row) => row.id)])
+  const rows = buildPermissionMatrix({ chain, groups, overrides })
 
   return {
     forum,
@@ -84,7 +91,9 @@ export async function buildForumMatrixView(forumId: number): Promise<ForumMatrix
     overrides,
     descendants,
     groups: groups.map(({ groupId, title }) => ({ groupId, title })),
-    rows: buildPermissionMatrix({ chain, groups, overrides }),
+    rows,
+    columns: matrixColumns(rows),
+    fields: buildFieldMatrix(rows),
   }
 }
 

package/src/server/inline-moderation-actions.ts

@@ -16,6 +16,7 @@ import {
 } from '@meith/moderation'
 
 import type { FormState } from './auth-form-state'
+import { requireConfirmation } from './confirm'
 import { getContainer } from './container'
 import { getActor } from './context'
 import { formStateReporter } from './form-state-reporter'
@@ -71,6 +72,11 @@ export async function inlineModerateAction(_prev: FormState, form: FormData): Pr
       throw new ForbiddenError(msg('error.app.moderate-anything-here'))
     }
 
+    if (tool === 'delete') {
+      const confirm = requireConfirmation(form, await tr('moderationForm.confirm.delete'))
+      if (confirm !== null) return confirm
+    }
+
     outcome = await new InlineModeration({ inline: inlineModeration }).apply({
       selection,
       tool,

package/src/server/message-actions.ts

@@ -9,9 +9,11 @@ import { parseFolder } from '@meith/messages'
 import { folderHref } from '../view/messages'
 import { dailyLimitMessage, limitMessage, spendDailyLimit, spendLimit } from './antispam'
 import type { FormState } from './auth-form-state'
+import { requireConfirmation } from './confirm'
 import { getActor } from './context'
 import { formStateReporter } from './form-state-reporter'
 import { text } from './form-values'
+import { tr } from './i18n'
 import { requireMessaging } from './messages'
 
 const toFormState = formStateReporter('message-actions', 'unexpected error in a message action')
@@ -65,12 +67,19 @@ export async function messageBulkAction(_prev: FormState, form: FormData): Promi
     const { service, userId } = await requireMessaging(await getActor())
 
     if (command === 'empty') {
+      const confirm = requireConfirmation(form, await tr('messageForm.confirm.emptyTrash'))
+      if (confirm !== null) return confirm
       query = `emptied=${await service.emptyTrash(userId)}`
     } else {
       const copyIds = selectedIds(form)
       if (copyIds.length === 0)
         throw new ValidationError(msg('error.app.select-at-least-one-message'))
 
+      if (command === 'delete') {
+        const confirm = requireConfirmation(form, await tr('messageForm.confirm.deleteForever'))
+        if (confirm !== null) return confirm
+      }
+
       switch (command) {
         case 'read':
           query = `marked=${await service.markRead(userId, copyIds)}`

package/src/server/navigation-admin-actions.ts

@@ -16,8 +16,10 @@ import { NAVIGATION_AUDIENCE_VALUES, outlineOf } from '../view/navigation'
 import { isNavigationNudge, isWhereItIs, nudgeTarget } from '../view/navigation-arrange'
 import { recordAdminAction, requireAdmin } from './admin'
 import type { FormState } from './auth-form-state'
+import { requireConfirmation } from './confirm'
 import { formStateReporter } from './form-state-reporter'
 import { checkbox, trimmedText } from './form-values'
+import { tr } from './i18n'
 import { navigationRepository } from './navigation'
 import { isSafeLocalPath } from './safe-path'
 
@@ -150,6 +152,10 @@ export async function deleteNavigationItemAction(
     await requireAdmin()
 
     const navigationItemId = itemId(form)
+
+    const confirm = requireConfirmation(form, await tr('adminNavigation.confirm.delete'))
+    if (confirm !== null) return confirm
+
     await requireNavigation().delete(navigationItemId)
 
     await refresh()

package/src/server/plugin-admin.ts

@@ -2,7 +2,7 @@ import 'server-only'
 
 import forumConfig from '@board/config'
 
-import { env, logger, readPluginEnv } from '@meith/core'
+import { cronCadenceSeconds, env, logger, parseCron, readPluginEnv } from '@meith/core'
 import {
   appliedPluginMigrations,
   getDb,
@@ -58,6 +58,7 @@ export interface PluginTaskRow {
   readonly id: string
   readonly registeredId: string
   readonly intervalSeconds: number
+  readonly schedule: string | null
 }
 
 export interface PluginPageRow {
@@ -228,7 +229,11 @@ export async function pluginInventory(t?: Translator): Promise<PluginInventory>
         (task): PluginTaskRow => ({
           id: task.id,
           registeredId: pluginTaskId(entry.key, task.id),
-          intervalSeconds: task.intervalSeconds,
+          intervalSeconds:
+            task.schedule === undefined
+              ? task.intervalSeconds
+              : cronCadenceSeconds(parseCron(task.schedule)),
+          schedule: task.schedule ?? null,
         }),
       ),
 

package/src/server/plugin-pages.ts

@@ -7,6 +7,7 @@ import { logger } from '@meith/core'
 import type { PluginDefinition } from '@meith/plugin-kit'
 
 import { getTranslator } from './i18n'
+import { resolveModCpAccess } from './modcp'
 import { runtimeContextFor } from './plugin-runtime'
 import { getSettingOverrides } from './settings'
 
@@ -26,6 +27,11 @@ export type BoardPageResult =
   | { readonly outcome: 'missing' }
   | { readonly outcome: 'sign-in-first'; readonly title: string }
 
+export type StaffPageResult =
+  | { readonly outcome: 'rendered'; readonly title: string; readonly node: ReactNode | null }
+  | { readonly outcome: 'missing' }
+  | { readonly outcome: 'forbidden' }
+
 function translated(
   t: Awaited<ReturnType<typeof getTranslator>> | undefined,
   key: string | undefined,
@@ -59,6 +65,7 @@ export async function renderPluginBoardPage(
 
   const page = (definition.pages ?? []).find((candidate) => candidate.path === path)
   if (page === undefined) return { outcome: 'missing' }
+  if (page.access === 'staff') return { outcome: 'missing' }
 
   const overrides = await getSettingOverrides()
   if (overrides.get(`plugin.${pluginKey}._enabled`) === '0') return { outcome: 'missing' }
@@ -90,6 +97,49 @@ export async function renderPluginBoardPage(
   }
 }
 
+export async function renderPluginStaffPage(
+  pluginKey: string,
+  path: string,
+  request: BoardPageRequest,
+): Promise<StaffPageResult> {
+  const entry = (forumConfig.plugins ?? []).find((candidate) => candidate.key === pluginKey)
+  const definition = entry?.plugin as PluginDefinition | undefined
+
+  if (entry === undefined || definition === undefined) return { outcome: 'missing' }
+  if (entry.enabled === false) return { outcome: 'missing' }
+
+  const page = (definition.pages ?? []).find((candidate) => candidate.path === path)
+  if (page === undefined || page.access !== 'staff') return { outcome: 'missing' }
+
+  const overrides = await getSettingOverrides()
+  if (overrides.get(`plugin.${pluginKey}._enabled`) === '0') return { outcome: 'missing' }
+
+  const access = await resolveModCpAccess()
+  if (access === null || !access.hasGroupAccess) return { outcome: 'forbidden' }
+
+  const [log, t] = [logger({ component: 'plugin-page', plugin: pluginKey }), await getTranslator()]
+  const title = translated(t, page.titleKey, page.title, page.titleArgs)
+
+  try {
+    return {
+      outcome: 'rendered',
+      title,
+      node: await page.render({
+        ...runtimeContextFor(pluginKey, definition, overrides, log),
+        viewer: request.viewer,
+        path,
+        query: request.query,
+        boardUrl: request.boardUrl,
+        locale: t.locale,
+        t,
+      }),
+    }
+  } catch (error) {
+    log.error({ err: error, path }, 'plugin staff page failed to render')
+    return { outcome: 'rendered', title, node: null }
+  }
+}
+
 export async function renderPluginAdminPage(
   pluginKey: string,
   path: string,

package/src/server/plugin-panel.ts

@@ -3,7 +3,7 @@ import 'server-only'
 import forumConfig from '@board/config'
 
 import type { Translator } from '@meith/i18n'
-import { type PluginDefinition, pluginAdminPath } from '@meith/plugin-kit'
+import { type PluginDefinition, pluginAdminPath, pluginStaffPagePath } from '@meith/plugin-kit'
 
 import type { PluginPage } from '@/view/plugin-panel'
 
@@ -47,3 +47,36 @@ export async function pluginPanelSection(
     })),
   }
 }
+
+export async function pluginStaffPanelSection(
+  pluginKey: string,
+  t?: Translator,
+): Promise<PluginPanelSection | null> {
+  const entry = (forumConfig.plugins ?? []).find((candidate) => candidate.key === pluginKey)
+  const definition = entry?.plugin as PluginDefinition | undefined
+
+  if (entry === undefined || definition === undefined) return null
+  if (entry.enabled === false) return null
+
+  const pages = (definition.pages ?? []).filter((page) => page.access === 'staff')
+  if (pages.length === 0) return null
+
+  const overrides = await getSettingOverrides()
+  if (overrides.get(`plugin.${pluginKey}._enabled`) === '0') return null
+
+  return {
+    key: pluginKey,
+    name:
+      t !== undefined && definition.nameKey !== undefined && t.has(definition.nameKey)
+        ? t.t(definition.nameKey)
+        : definition.name,
+    pages: pages.map((page) => ({
+      path: page.path,
+      title:
+        t !== undefined && page.titleKey !== undefined && t.has(page.titleKey)
+          ? t.t(page.titleKey, page.titleArgs)
+          : page.title,
+      href: pluginStaffPagePath(pluginKey, page.path),
+    })),
+  }
+}

package/src/server/plugin-routes.ts

@@ -16,6 +16,7 @@ import {
 import { recordAdminAction, requireAdmin } from './admin'
 import { boardUrl } from './board-url'
 import { getActor } from './context'
+import { resolveModCpAccess } from './modcp'
 import { activeDefinitions, pluginHost, syncPluginEnablement } from './plugin-host'
 import { runtimeContextFor } from './plugin-runtime'
 import { viewerRef } from './plugin-view'
@@ -213,6 +214,13 @@ export async function dispatchPluginRoute(
     return fail(401, 'unauthenticated', 'Sign in to use this.')
   }
 
+  if (route.access === 'staff') {
+    const access = await resolveModCpAccess()
+    if (access === null || !access.hasGroupAccess) {
+      return fail(403, 'staff_only', await tr('notice.app.moderators-only-endpoint'))
+    }
+  }
+
   if (route.access === 'admin') {
     try {
       await requireAdmin()

package/src/server/plugin-view.tsx

@@ -9,8 +9,10 @@ import type {
   HookValue,
   PluginRegion,
   PluginRegionContext,
+  ThreadRowBadgeSubject,
 } from '@meith/plugin-kit'
 
+import { getTranslator } from './i18n'
 import { pluginHost, syncPluginEnablement } from './plugin-host'
 
 export function viewerRef(actor: Actor): { userId: number | null; isGuest: boolean } {
@@ -37,22 +39,59 @@ export async function emitEvent<K extends HookName>(
 
 export async function pluginRegion(
   region: PluginRegion,
-  context: Omit<PluginRegionContext, 'region' | 'runtime'>,
+  context: Omit<PluginRegionContext, 'region' | 'runtime' | 'locale' | 't'>,
+  card?: string,
 ): Promise<React.ReactNode> {
   await syncPluginEnablement()
 
-  const nodes = await pluginHost.renderRegion(region, { ...context, region })
+  const t = await getTranslator()
+  const nodes = await pluginHost.renderRegion(region, { ...context, region, locale: t.locale, t })
   if (nodes.length === 0) return null
 
   return (
     <>
-      {nodes.map((entry) => (
-        <Fragment key={entry.key}>{entry.node}</Fragment>
-      ))}
+      {nodes.map((entry) =>
+        card === undefined ? (
+          <Fragment key={entry.key}>{entry.node}</Fragment>
+        ) : (
+          <section key={entry.key} className={card}>
+            {entry.node}
+          </section>
+        ),
+      )}
     </>
   )
 }
 
-export async function boardRegion(region: PluginRegion, actor: Actor): Promise<React.ReactNode> {
-  return pluginRegion(region, { viewer: viewerRef(actor), subjectId: null, authorId: null })
+export async function boardRegion(
+  region: PluginRegion,
+  actor: Actor,
+  card?: string,
+): Promise<React.ReactNode> {
+  return pluginRegion(region, { viewer: viewerRef(actor), subjectId: null, authorId: null }, card)
+}
+
+export async function threadRowBadges(
+  actor: Actor,
+  threads: readonly ThreadRowBadgeSubject[],
+): Promise<ReadonlyMap<number, React.ReactNode>> {
+  await syncPluginEnablement()
+  if (threads.length === 0) return new Map()
+
+  const t = await getTranslator()
+  const byThread = await pluginHost.renderThreadRowBadges({
+    viewer: viewerRef(actor),
+    threads,
+    locale: t.locale,
+    t,
+  })
+
+  const out = new Map<number, React.ReactNode>()
+  for (const [threadId, nodes] of byThread) {
+    out.set(
+      threadId,
+      nodes.map((entry) => <Fragment key={entry.key}>{entry.node}</Fragment>),
+    )
+  }
+  return out
 }

package/src/server/poll-actions.ts

@@ -6,6 +6,9 @@ import { ForbiddenError, ValidationError } from '@meith/core'
 import { msg } from '@meith/i18n'
 import { type PollEditOption, PollService } from '@meith/polls'
 
+import { type PollVoteView, pollVoteView } from '@/view/poll-vote'
+import { isEnhancedSubmit } from '@/view/progressive-enhancement'
+
 import { getContainer } from './container'
 import { getActor } from './context'
 import { emitEvent, viewerRef } from './plugin-view'
@@ -50,7 +53,10 @@ function editedOptions(form: FormData): readonly PollEditOption[] {
   })
 }
 
-export async function votePollAction(form: FormData): Promise<void> {
+export async function votePollAction(
+  _prev: PollVoteView | null,
+  form: FormData,
+): Promise<PollVoteView | null> {
   const threadId = id(form, 'threadId')
   const pollId = id(form, 'pollId')
   const actor = await getActor()
@@ -72,6 +78,12 @@ export async function votePollAction(form: FormData): Promise<void> {
   for (const optionId of chosen) {
     await emitEvent('poll.voted', { pollId, optionId }, viewerRef(actor))
   }
+
+  if (isEnhancedSubmit(form)) {
+    const fresh = await polls.find(threadId, actor.userId)
+    return fresh === null ? null : pollVoteView(fresh, scope.mayVote, new Date())
+  }
+
   redirect(`/thread/${threadId}`)
 }
 

package/src/server/presence.ts

@@ -134,6 +134,29 @@ export async function onlineScopeFor(actor: Actor): Promise<OnlineScope> {
   }
 }
 
+export interface AuthorPresence {
+  readonly lastActiveAt: Date | null
+  readonly invisible: boolean
+}
+
+export async function presenceFor(
+  userIds: readonly number[],
+): Promise<ReadonlyMap<number, AuthorPresence>> {
+  const repo = presenceRepository()
+  if (repo === null || userIds.length === 0) return new Map()
+
+  try {
+    const rows = await repo.lastActiveFor(userIds)
+    const out = new Map<number, AuthorPresence>()
+    for (const row of rows) {
+      out.set(row.userId, { lastActiveAt: row.lastActiveAt, invisible: row.invisible })
+    }
+    return out
+  } catch {
+    return new Map()
+  }
+}
+
 export async function readOnline(actor: Actor, now: Date): Promise<OnlineSnapshot | null> {
   const repo = presenceRepository()
   if (repo === null) return null

package/src/server/push-actions.ts

@@ -15,6 +15,8 @@ const toFormState = formStateReporter('push-actions', 'unexpected error in web p
 
 const ENDPOINT_MAX = 1000
 
+const SUBSCRIPTIONS_PER_USER_MAX = 20
+
 const BASE64URL = /^[A-Za-z0-9_-]+$/
 
 const IP_LITERAL = /^\[|^\d+\.\d+\.\d+\.\d+$/
@@ -77,6 +79,13 @@ export async function subscribeToPushAction(input: PushSubscriptionInput): Promi
     }
 
     const { service, userId } = await requirePushCentre()
+
+    const existing = await service.pushSubscriptions(userId)
+    const known = existing.some((subscription) => subscription.endpoint === input.endpoint)
+    if (!known && existing.length >= SUBSCRIPTIONS_PER_USER_MAX) {
+      return { error: await tr('notice.app.push-subscription-limit') }
+    }
+
     await service.subscribeToPush({
       userId,
       endpoint: input.endpoint,

package/src/server/reply-core.ts

@@ -4,7 +4,12 @@ import 'server-only'
 import type { Actor } from '@meith/authorization'
 import { ForbiddenError, ValidationError } from '@meith/core'
 import { restrictsPosting } from '@meith/moderation'
-import { type AuthorRestriction, ReplyComposer, type ReplyTarget } from '@meith/threads'
+import {
+  type AuthorRestriction,
+  ReplyComposer,
+  type ReplyTarget,
+  type SubscriptionCadence,
+} from '@meith/threads'
 
 import {
   dailyLimitMessage,
@@ -65,6 +70,7 @@ export async function resolveReplyTarget(
 export interface SubmitReplyInput {
   readonly message: string
   readonly subscribe?: boolean
+  readonly subscribeMode?: SubscriptionCadence
   readonly seenLastPostId?: number | null
 }
 
@@ -125,6 +131,7 @@ export async function submitReply(
     {
       message: draft.body,
       subscribe: input.subscribe ?? false,
+      ...(input.subscribeMode === undefined ? {} : { subscribeMode: input.subscribeMode }),
       seenLastPostId: input.seenLastPostId ?? null,
       bypassesModeration: authorizer.can(actor, 'content.viewUnapproved', scope),
       bypassesFlood: authorizer.can(actor, 'flood.bypass'),