@plumix/core 0.1.0

package/dist/rpc/procedures/user/enable.js

@@ -0,0 +1,44 @@
+import { eq } from "../../../db/index.js";
+import { users } from "../../../db/schema/users.js";
+import { authenticated } from "../../authenticated.js";
+import { base } from "../../base.js";
+import { userEnableInputSchema } from "./schemas.js";
+const CAPABILITY = "user:edit";
+// Restore a previously-disabled user by clearing `disabledAt`. No
+// last-admin guard here — unlike disable/delete/demote, re-enabling is
+// never the path to an all-admins-locked-out state. Idempotent: a second
+// call on an already-active user short-circuits with the existing row.
+export const enable = base
+    .use(authenticated)
+    .input(userEnableInputSchema)
+    .handler(async ({ input, context, errors }) => {
+    if (!context.auth.can(CAPABILITY)) {
+        throw errors.FORBIDDEN({ data: { capability: CAPABILITY } });
+    }
+    const filtered = await context.hooks.applyFilter("rpc:user.enable:input", input);
+    const existing = await context.db.query.users.findFirst({
+        where: eq(users.id, filtered.id),
+    });
+    if (!existing) {
+        throw errors.NOT_FOUND({ data: { kind: "user", id: input.id } });
+    }
+    if (!existing.disabledAt) {
+        return context.hooks.applyFilter("rpc:user.enable:output", existing);
+    }
+    const [updated] = await context.db
+        .update(users)
+        .set({ disabledAt: null })
+        .where(eq(users.id, existing.id))
+        .returning();
+    if (!updated) {
+        throw errors.CONFLICT({ data: { reason: "update_failed" } });
+    }
+    // Mirrors the status_changed action fired by `user.disable` — one
+    // hook covers both transitions so plugins observing "account
+    // activity state changed" don't need to subscribe to two events.
+    await context.hooks.doAction("user:status_changed", updated, {
+        enabled: true,
+    });
+    return context.hooks.applyFilter("rpc:user.enable:output", updated);
+});
+//# sourceMappingURL=enable.js.map

package/dist/rpc/procedures/user/enable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enable.js","sourceRoot":"","sources":["../../../../src/rpc/procedures/user/enable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,UAAU,GAAG,WAAW,CAAC;AAE/B,kEAAkE;AAClE,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI;KACvB,GAAG,CAAC,aAAa,CAAC;KAClB,KAAK,CAAC,qBAAqB,CAAC;KAC5B,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAC9C,uBAAuB,EACvB,KAAK,CACN,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QACtD,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;SAC/B,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;SACzB,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;SAChC,SAAS,EAAE,CAAC;IACf,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,kEAAkE;IAClE,6DAA6D;IAC7D,iEAAiE;IACjE,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,EAAE;QAC3D,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC"}

package/dist/rpc/procedures/user/get.d.ts

@@ -0,0 +1,82 @@
+export declare const get: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("../../../index.js").AppContextBase<typeof import("../../../db/schema/index.js")> & import("../../../index.js").AppContextExtensions & Record<never, never>, import("../../../index.js").AppContextBase<typeof import("../../../db/schema/index.js")> & import("../../../index.js").AppContextExtensions & Record<never, never>, import("../../../index.js").AppContext>, import("@orpc/server").MergedCurrentContext<import("../../../index.js").AppContext, import("../../../index.js").AuthenticatedAppContext<typeof import("../../../db/schema/index.js")>>, import("valibot").ObjectSchema<{
+    readonly id: import("valibot").SchemaWithPipe<readonly [import("valibot").NumberSchema<undefined>, import("valibot").IntegerAction<number, undefined>, import("valibot").MinValueAction<number, 1, undefined>, import("valibot").MaxValueAction<number, number, undefined>]>;
+}, undefined>, import("@orpc/server").Schema<{
+    id: number;
+    email: string;
+    name: string | null;
+    avatarUrl: string | null;
+    role: "subscriber" | "contributor" | "author" | "editor" | "admin";
+    meta: Record<string, unknown>;
+    emailVerifiedAt: Date | null;
+    disabledAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+}, {
+    id: number;
+    email: string;
+    name: string | null;
+    avatarUrl: string | null;
+    role: "subscriber" | "contributor" | "author" | "editor" | "admin";
+    meta: Record<string, unknown>;
+    emailVerifiedAt: Date | null;
+    disabledAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+}>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+    readonly UNAUTHORIZED: {
+        readonly message: "Authentication required";
+    };
+    readonly BAD_REQUEST: {
+        readonly message: "Invalid input";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly FORBIDDEN: {
+        readonly message: "Permission denied";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly capability: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly NOT_FOUND: {
+        readonly message: "Resource not found";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly kind: import("valibot").StringSchema<undefined>;
+            readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+        }, undefined>;
+    };
+    readonly CONFLICT: {
+        readonly message: "Resource conflict";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+            readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly PAYLOAD_TOO_LARGE: {
+        readonly message: "Payload too large";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly limit: import("valibot").NumberSchema<undefined>;
+            readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly UNSUPPORTED_MEDIA_TYPE: {
+        readonly message: "Unsupported media type";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly mime: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly INVALID_BLOCK_CONTENT: {
+        readonly message: "Block content failed registry validation";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly path: import("valibot").StringSchema<undefined>;
+                readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+}>, Record<never, never>>;
+//# sourceMappingURL=get.d.ts.map

package/dist/rpc/procedures/user/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../../src/rpc/procedures/user/get.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAiBZ,CAAC"}

package/dist/rpc/procedures/user/get.js

@@ -0,0 +1,27 @@
+import { eq } from "../../../db/index.js";
+import { users } from "../../../db/schema/users.js";
+import { authenticated } from "../../authenticated.js";
+import { base } from "../../base.js";
+import { decodeMetaBag } from "./meta.js";
+import { userGetInputSchema } from "./schemas.js";
+// Listing gates access to arbitrary user records; self-lookup is always
+// allowed via `user:edit_own` so admin UIs can render "your profile".
+const LIST_CAPABILITY = "user:list";
+export const get = base
+    .use(authenticated)
+    .input(userGetInputSchema)
+    .handler(async ({ input, context, errors }) => {
+    const isSelf = context.user.id === input.id;
+    if (!isSelf && !context.auth.can(LIST_CAPABILITY)) {
+        throw errors.FORBIDDEN({ data: { capability: LIST_CAPABILITY } });
+    }
+    const row = await context.db.query.users.findFirst({
+        where: eq(users.id, input.id),
+    });
+    if (!row) {
+        throw errors.NOT_FOUND({ data: { kind: "user", id: input.id } });
+    }
+    const meta = decodeMetaBag(context.plugins, row.meta);
+    return context.hooks.applyFilter("rpc:user.get:output", { ...row, meta });
+});
+//# sourceMappingURL=get.js.map

package/dist/rpc/procedures/user/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../../src/rpc/procedures/user/get.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,wEAAwE;AACxE,sEAAsE;AACtE,MAAM,eAAe,GAAG,WAAW,CAAC;AAEpC,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI;KACpB,GAAG,CAAC,aAAa,CAAC;KAClB,KAAK,CAAC,kBAAkB,CAAC;KACzB,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QACjD,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,qBAAqB,EAAE,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC"}

package/dist/rpc/procedures/user/helpers.d.ts

@@ -0,0 +1,10 @@
+import type { Db } from "../../../context/app.js";
+/**
+ * Subquery: true when an active admin OTHER than `excludeUserId` exists.
+ *
+ * Used as an atomic WHERE-clause predicate on UPDATE/DELETE against
+ * `users` so the last-admin check happens at write time — not in a
+ * read-then-write pair that two concurrent demotions could both pass.
+ */
+export declare function otherActiveAdminExists(db: Db, excludeUserId: number): import("drizzle-orm").SQL<unknown>;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/rpc/procedures/user/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../src/rpc/procedures/user/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,yBAAyB,CAAC;AAIlD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,sCAanE"}

package/dist/rpc/procedures/user/helpers.js

@@ -0,0 +1,16 @@
+import { and, eq, exists, isNull, ne } from "../../../db/index.js";
+import { users } from "../../../db/schema/users.js";
+/**
+ * Subquery: true when an active admin OTHER than `excludeUserId` exists.
+ *
+ * Used as an atomic WHERE-clause predicate on UPDATE/DELETE against
+ * `users` so the last-admin check happens at write time — not in a
+ * read-then-write pair that two concurrent demotions could both pass.
+ */
+export function otherActiveAdminExists(db, excludeUserId) {
+    return exists(db
+        .select({ v: users.id })
+        .from(users)
+        .where(and(eq(users.role, "admin"), isNull(users.disabledAt), ne(users.id, excludeUserId))));
+}
+//# sourceMappingURL=helpers.js.map

package/dist/rpc/procedures/user/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../../src/rpc/procedures/user/helpers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAM,EAAE,aAAqB;IAClE,OAAO,MAAM,CACX,EAAE;SACC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;SACvB,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EACvB,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EACxB,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,CAAC,CAC5B,CACF,CACJ,CAAC;AACJ,CAAC"}