@rocapine/community-core 0.1.0

package/lib/service.js

@@ -0,0 +1,454 @@
+"use strict";
+// Community backend service — every function is a thin wrapper around the injected
+// Supabase client (`cfg.requireClient()`), so a host with `supabase: null` degrades to
+// CommunityDisabledError instead of crashing when no backend is configured. No React
+// imports here.
+//
+// Ported from the mold (`sdk/client/services/community.ts`) with a host app's newer
+// feed/thread composition (search, poll batching via `poll_vote_counts`, reaction batching
+// generalized from that host's prayer-style feature's summary RPC into `post_reaction_summary`).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildFeedSelect = buildFeedSelect;
+exports.fetchReactionSummaries = fetchReactionSummaries;
+exports.fetchFeedPage = fetchFeedPage;
+exports.countNewPosts = countNewPosts;
+exports.fetchProfile = fetchProfile;
+exports.fetchUserPosts = fetchUserPosts;
+exports.searchPosts = searchPosts;
+exports.fetchThread = fetchThread;
+exports.createPost = createPost;
+exports.votePoll = votePoll;
+exports.createComment = createComment;
+exports.moderateOne = moderateOne;
+exports.setLike = setLike;
+exports.setReaction = setReaction;
+exports.reportContent = reportContent;
+exports.blockUser = blockUser;
+exports.deleteOwnPost = deleteOwnPost;
+exports.deleteOwnComment = deleteOwnComment;
+exports.updateProfile = updateProfile;
+exports.uploadAvatar = uploadAvatar;
+const supabase_js_1 = require("@supabase/supabase-js");
+const identity_1 = require("./identity");
+const models_1 = require("./models");
+/** Avatar images live in this Storage bucket on every install (mold value, unchanged). */
+const AVATAR_BUCKET = "avatars";
+async function requireUid(cfg) {
+    const uid = await (0, identity_1.ensureIdentity)(cfg);
+    if (!uid)
+        throw new Error("You appear to be offline. Please try again.");
+    return uid;
+}
+// Embedded filter: comment counts only count visible comments, so the badge
+// on a card always matches what the opened thread renders.
+const FEED_SELECT = "id, author_id, topic, content, status, pinned_at, created_at, profiles!posts_author_id_fkey(username, is_official, handle, avatar_url), likes(count), comments(count), poll_options(id, idx, label)";
+const PROFILE_SELECT = "id, username, handle, is_official, bio, avatar_url";
+/** Minimal injection guard for `CommunityConfig.feed.extraPostColumns`: a bare
+ * column name only, no `.`, `(`, `:`, whitespace, etc. — those are how a
+ * PostgREST select embeds a relation or renames a column, and letting them
+ * through would extend the query in ways this extension point isn't meant to
+ * allow. */
+const VALID_EXTRA_COLUMN = /^[a-z0-9_]+$/;
+/**
+ * Appends `extraPostColumns` (if any) to the posts feed select. Pure and
+ * exported so it's unit-testable without a Supabase client. Invalid column
+ * names are dropped with a `console.warn` rather than failing the query.
+ */
+function buildFeedSelect(extraPostColumns) {
+    if (!extraPostColumns || extraPostColumns.length === 0)
+        return FEED_SELECT;
+    const valid = extraPostColumns.filter((column) => {
+        if (VALID_EXTRA_COLUMN.test(column))
+            return true;
+        console.warn(`[@rocapine/community-core] ignoring invalid feed.extraPostColumns entry: ${JSON.stringify(column)}`);
+        return false;
+    });
+    if (valid.length === 0)
+        return FEED_SELECT;
+    return `${FEED_SELECT}, ${valid.join(", ")}`;
+}
+async function fetchMyLikes(client, postIds, uid) {
+    if (postIds.length === 0)
+        return new Set();
+    const { data, error } = await client
+        .from("likes")
+        .select("post_id")
+        .eq("user_id", uid)
+        .in("post_id", postIds);
+    if (error)
+        throw error;
+    return new Set((data ?? []).map((r) => r.post_id));
+}
+/**
+ * Batched poll state for the poll posts of one page: per-option counts via the
+ * security-definer RPC (poll_votes rows are private), my votes via RLS select.
+ * Gated on `cfg.modules.polls`: off (or no poll posts on the page) skips the
+ * RPC/select round trip entirely and returns the empty shape.
+ */
+async function fetchPollData(cfg, postIds, uid) {
+    if (!cfg.modules.polls || postIds.length === 0)
+        return models_1.EMPTY_POLL_DATA;
+    const client = cfg.requireClient();
+    const [countsRes, myVotesRes] = await Promise.all([
+        client.rpc("poll_vote_counts", { p_post_ids: postIds }),
+        client
+            .from("poll_votes")
+            .select("post_id, option_id")
+            .eq("user_id", uid)
+            .in("post_id", postIds),
+    ]);
+    if (countsRes.error)
+        throw countsRes.error;
+    if (myVotesRes.error)
+        throw myVotesRes.error;
+    const counts = new Map();
+    for (const row of (countsRes.data ?? [])) {
+        counts.set(row.option_id, Number(row.votes));
+    }
+    const myVotes = new Map();
+    for (const row of (myVotesRes.data ?? [])) {
+        myVotes.set(row.post_id, row.option_id);
+    }
+    return { counts, myVotes };
+}
+/**
+ * Batched reaction state for one page: count + last reactor's display name + my-reaction
+ * flag, all from the single security-definer `post_reaction_summary` RPC (the backend
+ * already resolves "did I react" server-side, so unlike the mold's prayer batching this
+ * needs no second query). Gated on `cfg.modules.reaction`; a missing/erroring RPC (e.g.
+ * the reaction module's migration not installed yet) degrades to no reaction data instead
+ * of taking the whole feed down.
+ */
+async function fetchReactionSummaries(cfg, postIds) {
+    if (!cfg.modules.reaction || postIds.length === 0)
+        return models_1.EMPTY_REACTION_DATA;
+    const client = cfg.requireClient();
+    const { data, error } = await client.rpc("post_reaction_summary", { p_post_ids: postIds });
+    if (error)
+        return models_1.EMPTY_REACTION_DATA;
+    const counts = new Map();
+    const mine = new Set();
+    const lastReactorName = new Map();
+    for (const row of (data ?? [])) {
+        counts.set(row.post_id, Number(row.reaction_count));
+        lastReactorName.set(row.post_id, row.last_reactor_name);
+        if (row.has_reacted)
+            mine.add(row.post_id);
+    }
+    return { counts, mine, lastReactorName };
+}
+/** Attach my-like state + poll state + reaction state to a batch of raw post
+ * rows and map to the UI model. */
+async function toFeedPosts(cfg, client, rows, uid) {
+    const postIds = rows.map((r) => r.id);
+    const [liked, pollData, reactionData] = await Promise.all([
+        fetchMyLikes(client, postIds, uid),
+        fetchPollData(cfg, rows.filter((r) => r.poll_options.length > 0).map((r) => r.id), uid),
+        fetchReactionSummaries(cfg, postIds),
+    ]);
+    return rows.map((r) => (0, models_1.mapPostRow)(r, uid, cfg.anonymousAuthorFallback, cfg.topics, liked, pollData, reactionData, cfg.feed.transformPost));
+}
+/**
+ * One feed page, newest first. RLS already excludes other users' hidden and
+ * blocked-author content; we only exclude our own soft-deleted posts.
+ */
+async function fetchFeedPage(cfg, opts = {}) {
+    const client = cfg.requireClient();
+    const uid = await requireUid(cfg);
+    const page = opts.cursor ?? 0;
+    let query = client
+        .from("posts")
+        .select(buildFeedSelect(cfg.feed.extraPostColumns))
+        .eq("comments.status", "visible")
+        // Others' rows are already limited to 'visible' by RLS; this also shows the
+        // author their own 'pending' posts (optimistic) while hiding their moderated-out
+        // ones.
+        .in("status", ["visible", "pending"])
+        .order("pinned_at", { ascending: false, nullsFirst: false })
+        .order("created_at", { ascending: false })
+        .range(page * models_1.FEED_PAGE_SIZE, page * models_1.FEED_PAGE_SIZE + models_1.FEED_PAGE_SIZE - 1);
+    if (opts.topic)
+        query = query.eq("topic", opts.topic);
+    const { data, error } = await query;
+    if (error)
+        throw error;
+    return toFeedPosts(cfg, client, (data ?? []), uid);
+}
+/**
+ * Count of visible posts newer than `sinceIso`, excluding my own, for the
+ * given topic. RLS already excludes blocked authors and hidden/deleted rows.
+ * `topic` is beyond the brief's literal signature but kept (both source apps
+ * take it) so a topic-filtered feed's "N new posts" pill stays accurate.
+ */
+async function countNewPosts(cfg, sinceIso, topic) {
+    const client = cfg.requireClient();
+    const uid = await requireUid(cfg);
+    let query = client
+        .from("posts")
+        .select("id", { count: "exact", head: true })
+        .eq("status", "visible")
+        .gt("created_at", sinceIso)
+        .neq("author_id", uid);
+    if (topic)
+        query = query.eq("topic", topic);
+    const { count, error } = await query;
+    if (error)
+        throw error;
+    return count ?? 0;
+}
+/** A single profile by id, e.g. for the profile page header. */
+async function fetchProfile(cfg, userId) {
+    const client = cfg.requireClient();
+    const { data, error } = await client
+        .from("profiles")
+        .select(PROFILE_SELECT)
+        .eq("id", userId)
+        .single();
+    if (error)
+        throw error;
+    return (0, models_1.mapProfileRow)(data, cfg.anonymousAuthorFallback);
+}
+/**
+ * One user's posts, newest first (no pinned ordering — a profile page is
+ * strictly chronological). Same visibility rules as the main feed, same
+ * page-index cursor as `fetchFeedPage` (product decision, reversing the
+ * earlier single-page scope cut).
+ */
+async function fetchUserPosts(cfg, userId, opts = {}) {
+    const client = cfg.requireClient();
+    const uid = await requireUid(cfg);
+    const page = opts.cursor ?? 0;
+    const { data, error } = await client
+        .from("posts")
+        .select(buildFeedSelect(cfg.feed.extraPostColumns))
+        .eq("author_id", userId)
+        .eq("comments.status", "visible")
+        .in("status", ["visible", "pending"])
+        .order("created_at", { ascending: false })
+        .range(page * models_1.FEED_PAGE_SIZE, page * models_1.FEED_PAGE_SIZE + models_1.FEED_PAGE_SIZE - 1);
+    if (error)
+        throw error;
+    return toFeedPosts(cfg, client, (data ?? []), uid);
+}
+/**
+ * Full-text-ish search over visible post content (newest first), same
+ * page-index cursor as `fetchFeedPage` (product decision, reversing the
+ * earlier single-page scope cut).
+ */
+async function searchPosts(cfg, query, opts = {}) {
+    const cleaned = query.trim();
+    if (cleaned.length === 0)
+        return [];
+    const client = cfg.requireClient();
+    const uid = await requireUid(cfg);
+    const page = opts.cursor ?? 0;
+    const { data, error } = await client
+        .from("posts")
+        .select(buildFeedSelect(cfg.feed.extraPostColumns))
+        .eq("comments.status", "visible")
+        .eq("status", "visible")
+        .ilike("content", `%${cleaned}%`)
+        .order("created_at", { ascending: false })
+        .range(page * models_1.FEED_PAGE_SIZE, page * models_1.FEED_PAGE_SIZE + models_1.FEED_PAGE_SIZE - 1);
+    if (error)
+        throw error;
+    return toFeedPosts(cfg, client, (data ?? []), uid);
+}
+/**
+ * Note: `cfg.feed.extraPostColumns`/`transformPost` do NOT apply here — this
+ * queries `comments`, not `posts` (the thread's parent post is passed in by
+ * the caller from an already-fetched, already-transformed `FeedPost`, not
+ * re-fetched).
+ */
+async function fetchThread(cfg, postId) {
+    const client = cfg.requireClient();
+    const uid = await requireUid(cfg);
+    const { data, error } = await client
+        .from("comments")
+        .select("id, post_id, author_id, content, status, created_at, profiles(username, is_official, handle, avatar_url)")
+        .eq("post_id", postId)
+        .in("status", ["visible", "pending"])
+        .order("created_at", { ascending: true });
+    if (error)
+        throw error;
+    return (data ?? []).map((r) => (0, models_1.mapCommentRow)(r, uid, cfg.anonymousAuthorFallback));
+}
+/**
+ * Insert a post as 'pending' (invisible to others until moderated). Returns id.
+ * With pollOptions, the post and its options are created transactionally by
+ * the create_poll_post RPC (security invoker, same RLS as a plain insert);
+ * that branch is gated on `cfg.modules.polls`.
+ */
+async function createPost(cfg, input) {
+    const { topic, body, pollOptions } = input;
+    const hasPoll = !!pollOptions && pollOptions.length > 0;
+    if (hasPoll && !cfg.modules.polls)
+        throw new Error("polls module is not enabled");
+    const client = cfg.requireClient();
+    const uid = await requireUid(cfg);
+    if (hasPoll) {
+        const { data, error } = await client.rpc("create_poll_post", {
+            p_topic: topic,
+            p_content: body,
+            p_options: pollOptions,
+        });
+        if (error)
+            throw error;
+        return data;
+    }
+    const { data, error } = await client
+        .from("posts")
+        .insert({ author_id: uid, topic, content: body })
+        .select("id")
+        .single();
+    if (error)
+        throw error;
+    return data.id;
+}
+/**
+ * Cast or change my vote: one row per (post, user), upsert swaps the option.
+ * `optionId` is the poll option's row id (matching `FeedPoll.myOptionId` /
+ * `applyPollVote`'s optimistic-update contract from Task 3), not a numeric
+ * index — see the task report for this naming call against the brief.
+ * Gated on `cfg.modules.polls` for consistent DX with the reaction module.
+ */
+async function votePoll(cfg, postId, optionId) {
+    if (!cfg.modules.polls)
+        throw new Error("polls module is not enabled");
+    const client = cfg.requireClient();
+    const uid = await requireUid(cfg);
+    const { error } = await client
+        .from("poll_votes")
+        .upsert({ post_id: postId, option_id: optionId, user_id: uid }, { onConflict: "post_id,user_id" });
+    if (error)
+        throw error;
+}
+/** Insert a comment as 'pending'. Returns id. */
+async function createComment(cfg, postId, body) {
+    const client = cfg.requireClient();
+    const uid = await requireUid(cfg);
+    const { data, error } = await client
+        .from("comments")
+        .insert({ post_id: postId, author_id: uid, content: body })
+        .select("id")
+        .single();
+    if (error)
+        throw error;
+    return data.id;
+}
+/** Run synchronous moderation on a just-created pending post/comment. */
+async function moderateOne(cfg, input) {
+    const client = cfg.requireClient();
+    const { data, error } = await client.functions.invoke("moderate-one", { body: input });
+    if (error)
+        return { status: "pending", reason: "moderation unavailable" };
+    return data;
+}
+async function setLike(cfg, postId, on) {
+    const client = cfg.requireClient();
+    const uid = await requireUid(cfg);
+    if (on) {
+        const { error } = await client.from("likes").insert({ post_id: postId, user_id: uid });
+        // 23505 = already liked (double tap / retry): the desired state holds.
+        if (error && error.code !== "23505")
+            throw error;
+    }
+    else {
+        const { error } = await client.from("likes").delete().match({ post_id: postId, user_id: uid });
+        if (error)
+            throw error;
+    }
+}
+/**
+ * `setPrayed` generalized to `setReaction`: insert my private, non-retractable
+ * reaction row (rows are never deleted — see spec §6). Gated on `cfg.modules.reaction`.
+ */
+async function setReaction(cfg, postId) {
+    if (!cfg.modules.reaction)
+        throw new Error("reaction module is not enabled");
+    const client = cfg.requireClient();
+    const uid = await requireUid(cfg);
+    const { error } = await client.from("post_reactions").insert({ post_id: postId, user_id: uid });
+    // 23505 = already reacted to this post: the desired state holds.
+    if (error && error.code !== "23505")
+        throw error;
+}
+async function reportContent(cfg, input) {
+    const client = cfg.requireClient();
+    const uid = await requireUid(cfg);
+    const { error } = await client.from("reports").insert({
+        reporter_id: uid,
+        reported_user_id: input.reportedUserId,
+        post_id: input.postId ?? null,
+        comment_id: input.commentId ?? null,
+        reason: input.reason,
+        details: input.details?.trim() || null,
+    });
+    if (error)
+        throw error;
+}
+async function blockUser(cfg, blockedId) {
+    const client = cfg.requireClient();
+    const uid = await requireUid(cfg);
+    const { error } = await client.from("blocks").insert({ blocker_id: uid, blocked_id: blockedId });
+    if (error && error.code !== "23505")
+        throw error; // already blocked is fine
+}
+async function deleteOwnPost(cfg, postId) {
+    const client = cfg.requireClient();
+    await requireUid(cfg);
+    const { error } = await client.from("posts").update({ status: "deleted" }).eq("id", postId);
+    if (error)
+        throw error;
+}
+async function deleteOwnComment(cfg, commentId) {
+    const client = cfg.requireClient();
+    await requireUid(cfg);
+    const { error } = await client.from("comments").update({ status: "deleted" }).eq("id", commentId);
+    if (error)
+        throw error;
+}
+/**
+ * The only write path for handle/bio/avatar — moderated server-side by the
+ * `update-profile` Edge Function. `invoke` treats any non-2xx as `error`; a
+ * `FunctionsHttpError` carries the typed JSON body (e.g. `handle_taken`) on
+ * its `context` response, other error kinds mean the request never landed.
+ */
+async function updateProfile(cfg, input) {
+    const client = cfg.requireClient();
+    const { handle, bio, avatarUrl } = input;
+    const { data, error } = await client.functions.invoke("update-profile", {
+        body: { handle, bio, avatarPath: avatarUrl },
+    });
+    if (!error)
+        return data;
+    if (error instanceof supabase_js_1.FunctionsHttpError) {
+        // A platform-level 5xx can carry a non-JSON body: degrade to a network error.
+        try {
+            return (await error.context.json());
+        }
+        catch {
+            return { status: "error", error: "network" };
+        }
+    }
+    return { status: "error", error: "network" };
+}
+/**
+ * Upload a JPEG avatar to the `avatars` bucket from a local file URI. Returns
+ * the storage path. Takes a `fileUri` (not a base64 string, unlike the mold)
+ * so the core has no Hermes/`atob` dependency — `fetch` on a `file://` URI is
+ * the portable way to read local bytes in React Native.
+ */
+async function uploadAvatar(cfg, fileUri) {
+    const client = cfg.requireClient();
+    const uid = await requireUid(cfg);
+    const path = `${uid}/${Date.now()}.jpg`;
+    const response = await fetch(fileUri);
+    const bytes = await response.arrayBuffer();
+    const { error } = await client.storage
+        .from(AVATAR_BUCKET)
+        .upload(path, bytes, { contentType: "image/jpeg" });
+    if (error)
+        throw error;
+    return path;
+}

package/lib/time.d.ts

@@ -0,0 +1,21 @@
+/** Pure, language-free decomposition of an elapsed duration, for a consumer
+ * (e.g. `@rocapine/community-ui`'s `formatTimeAgo`) to localize into its own
+ * catalog. `unit: "now"` carries no `value` worth formatting. */
+export type TimeAgoParts = {
+    unit: "now";
+    value: 0;
+} | {
+    unit: "minute" | "hour" | "day";
+    value: number;
+};
+/** Decompose `iso` relative to `nowMs` into a unit + count, with no language
+ * baked in — see `timeAgo` for the hardcoded-English string this replaces
+ * core-internally, kept for back-compat. */
+export declare function timeAgoParts(iso: string, nowMs: number): TimeAgoParts;
+/**
+ * Compact relative label: "now", "12m", "5h", "3d". Hardcoded English —
+ * kept for back-compat, but `@rocapine/community-ui` no longer calls this
+ * itself; it localizes through `timeAgoParts` + its own catalog instead (see
+ * `formatTimeAgo` in the ui package).
+ */
+export declare function timeAgo(iso: string, nowMs: number): string;

package/lib/time.js

@@ -0,0 +1,32 @@
+"use strict";
+// Display helpers for feeds. No React Native / Supabase imports: pure, exercised in node (vitest).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.timeAgoParts = timeAgoParts;
+exports.timeAgo = timeAgo;
+const MIN = 60000;
+const HOUR = 3600000;
+/** Decompose `iso` relative to `nowMs` into a unit + count, with no language
+ * baked in — see `timeAgo` for the hardcoded-English string this replaces
+ * core-internally, kept for back-compat. */
+function timeAgoParts(iso, nowMs) {
+    const elapsed = Math.max(0, nowMs - Date.parse(iso));
+    if (elapsed < MIN)
+        return { unit: "now", value: 0 };
+    if (elapsed < HOUR)
+        return { unit: "minute", value: Math.floor(elapsed / MIN) };
+    if (elapsed < 24 * HOUR)
+        return { unit: "hour", value: Math.floor(elapsed / HOUR) };
+    return { unit: "day", value: Math.floor(elapsed / (24 * HOUR)) };
+}
+/**
+ * Compact relative label: "now", "12m", "5h", "3d". Hardcoded English —
+ * kept for back-compat, but `@rocapine/community-ui` no longer calls this
+ * itself; it localizes through `timeAgoParts` + its own catalog instead (see
+ * `formatTimeAgo` in the ui package).
+ */
+function timeAgo(iso, nowMs) {
+    const parts = timeAgoParts(iso, nowMs);
+    if (parts.unit === "now")
+        return "now";
+    return `${parts.value}${parts.unit === "minute" ? "m" : parts.unit === "hour" ? "h" : "d"}`;
+}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@rocapine/community-core",
+  "version": "0.1.0",
+  "description": "Headless Supabase-backed community backend: identity, feed/thread/moderation services, and React Query hooks.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Rocapine/community-sdk"
+  },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "files": [
+    "lib",
+    "LICENSE"
+  ],
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "build": "tsc -p tsconfig.json --outDir lib --noEmit false",
+    "test": "vitest run"
+  },
+  "peerDependencies": {
+    "react": ">=18",
+    "@supabase/supabase-js": "^2.45.0",
+    "@tanstack/react-query": "^5.50.0"
+  },
+  "devDependencies": {
+    "react": "19.2.0",
+    "@supabase/supabase-js": "^2.45.0",
+    "@tanstack/react-query": "^5.50.0",
+    "@types/react": "^19.2.0"
+  }
+}