@stacksjs/defaults 0.70.228 → 0.70.230

package/app/Actions/Dashboard/Teams/TeamPeopleIndexAction.ts

@@ -0,0 +1,83 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { invitationStatus, parsePositiveId } from './team-records'
+
+export default new Action({
+  name: 'Dashboard Team People Index',
+  description: 'Returns one team with its active members and pending invitations.',
+  method: 'GET',
+  apiResponse: true,
+
+  async handle(request: RequestInstance) {
+    const teamId = parsePositiveId(request.getParam('id'))
+    if (!teamId)
+      return response.json({ message: 'Invalid team id.' }, 400)
+
+    const team = await db
+      .selectFrom('teams')
+      .where('id', '=', teamId)
+      .select(['id', 'name'])
+      .executeTakeFirst()
+    if (!team)
+      return response.json({ message: 'Team not found.' }, 404)
+
+    const members = await (db as any)
+      .selectFrom('team_members')
+      .innerJoin('users', 'users.id', '=', 'team_members.user_id')
+      .where('team_members.team_id', '=', teamId)
+      .select([
+        'team_members.id as id',
+        'team_members.user_id as user_id',
+        'team_members.role as role',
+        'team_members.status as status',
+        'team_members.created_at as created_at',
+        'users.name as name',
+        'users.email as email',
+      ])
+      .orderBy('users.name', 'asc')
+      .execute()
+
+    const invitations = await (db as any)
+      .selectFrom('team_invitations')
+      .where('team_id', '=', teamId)
+      .where('status', '=', 'pending')
+      .select([
+        'id',
+        'email',
+        'role',
+        'status',
+        'delivery_status',
+        'expires_at',
+        'created_at',
+      ])
+      .orderBy('created_at', 'desc')
+      .execute()
+
+    return {
+      team: {
+        id: Number(team.id),
+        name: String(team.name),
+      },
+      members: members.map((member: any) => ({
+        id: Number(member.id),
+        userId: Number(member.user_id),
+        name: String(member.name || member.email || 'Team member'),
+        email: String(member.email || ''),
+        role: String(member.role || 'member'),
+        status: String(member.status || 'active'),
+        joinedAt: member.created_at ? String(member.created_at) : null,
+      })),
+      invitations: invitations.map((invitation: any) => ({
+        id: Number(invitation.id),
+        email: String(invitation.email),
+        role: String(invitation.role || 'member'),
+        status: invitationStatus(invitation.status, invitation.expires_at),
+        deliveryStatus: String(invitation.delivery_status || 'pending'),
+        expiresAt: String(invitation.expires_at),
+        createdAt: invitation.created_at ? String(invitation.created_at) : null,
+      })),
+    }
+  },
+})

package/app/Actions/Dashboard/Teams/team-invitation-delivery.ts

@@ -0,0 +1,57 @@
+import { config } from '@stacksjs/config'
+import { db } from '@stacksjs/database'
+import { sendTeamInvitation } from '../../../Mail/TeamInvitation'
+import { invitationUrl, sqlTimestamp } from './team-records'
+
+interface DeliveryInput {
+  id: number
+  email: string
+  teamName: string
+  role: string
+  token: string
+}
+
+export async function deliverTeamInvitation(input: DeliveryInput): Promise<void> {
+  const baseUrl = String(process.env.APP_URL || config.app.url || '').trim()
+  if (!baseUrl) {
+    await markTeamInvitationDeliveryFailed(input.id, 'APP_URL is not configured.')
+    throw new Error('APP_URL must be configured before invitations can be delivered.')
+  }
+
+  try {
+    await sendTeamInvitation({
+      to: input.email,
+      teamName: input.teamName,
+      role: input.role,
+      invitationUrl: invitationUrl(baseUrl, input.token),
+      expiresInDays: 7,
+    })
+    await (db as any)
+      .updateTable('team_invitations')
+      .set({
+        delivery_status: 'sent',
+        delivery_error: null,
+        delivered_at: sqlTimestamp(),
+        updated_at: sqlTimestamp(),
+      })
+      .where('id', '=', input.id)
+      .execute()
+  }
+  catch (error) {
+    const message = error instanceof Error ? error.message : 'Email delivery failed.'
+    await markTeamInvitationDeliveryFailed(input.id, message)
+    throw error
+  }
+}
+
+export async function markTeamInvitationDeliveryFailed(id: number, error: string): Promise<void> {
+  await (db as any)
+    .updateTable('team_invitations')
+    .set({
+      delivery_status: 'failed',
+      delivery_error: error.slice(0, 2000),
+      updated_at: sqlTimestamp(),
+    })
+    .where('id', '=', id)
+    .execute()
+}

package/app/Actions/Dashboard/Teams/team-member-count.ts

@@ -0,0 +1,20 @@
+import { db } from '@stacksjs/database'
+import { sqlTimestamp } from './team-records'
+
+export async function syncTeamMemberCount(teamId: number, connection: typeof db = db): Promise<number> {
+  const row = await (connection as any)
+    .selectFrom('team_members')
+    .where('team_id', '=', teamId)
+    .where('status', '=', 'active')
+    .select(connection.fn.count('id').as('count'))
+    .executeTakeFirst()
+  const count = Number(row?.count || 0)
+
+  await connection
+    .updateTable('teams')
+    .set({ member_count: count, updated_at: sqlTimestamp() })
+    .where('id', '=', teamId)
+    .execute()
+
+  return count
+}

package/app/Actions/Dashboard/Teams/team-records.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, test } from 'bun:test'
+import {
+  changedRows,
+  hashInvitationToken,
+  invitationExpiresAt,
+  invitationStatus,
+  invitationUrl,
+  normalizeInvitationEmail,
+  normalizeInvitationRole,
+  parsePositiveId,
+} from './team-records'
+
+describe('team records', () => {
+  test('normalizes ids, email addresses, and assignable roles', () => {
+    expect(parsePositiveId('42')).toBe(42)
+    expect(parsePositiveId('0')).toBeNull()
+    expect(parsePositiveId('4.2')).toBeNull()
+    expect(normalizeInvitationEmail('  Teammate@Example.COM ')).toBe('teammate@example.com')
+    expect(normalizeInvitationEmail('not-an-email')).toBeNull()
+    expect(normalizeInvitationRole(' ADMIN ')).toBe('admin')
+    expect(normalizeInvitationRole('owner')).toBeNull()
+  })
+
+  test('normalizes update counts across supported database drivers', () => {
+    expect(changedRows({ changes: 1 })).toBe(1)
+    expect(changedRows({ affectedRows: 2 })).toBe(2)
+    expect(changedRows([{ numUpdatedRows: 3n }])).toBe(3)
+    expect(changedRows(null)).toBe(0)
+  })
+
+  test('hashes invitation bearers and builds an encoded acceptance URL', () => {
+    expect(hashInvitationToken('invite-token')).toBe('f9e3c47d452a8fab2dc56ef07d766534cb2cd31c5f63de7107412acc65daa5b8')
+    expect(invitationUrl('https://example.com/', 'a token')).toBe('https://example.com/team-invitations/a%20token')
+  })
+
+  test('derives expiry timestamps and expired display state deterministically', () => {
+    const now = new Date('2026-07-30T12:00:00.000Z')
+    expect(invitationExpiresAt(now, 7)).toBe('2026-08-06 12:00:00')
+    expect(invitationStatus('pending', '2026-07-31 12:00:00', now)).toBe('pending')
+    expect(invitationStatus('pending', '2026-07-29 12:00:00', now)).toBe('expired')
+    expect(invitationStatus('accepted', '2026-07-29 12:00:00', now)).toBe('accepted')
+  })
+})

package/app/Actions/Dashboard/Teams/team-records.ts

@@ -0,0 +1,79 @@
+import { createHash, randomBytes } from 'node:crypto'
+
+export const TEAM_MEMBER_ROLES = ['owner', 'admin', 'member', 'viewer'] as const
+export const TEAM_INVITATION_ROLES = ['admin', 'member', 'viewer'] as const
+
+export type TeamMemberRole = typeof TEAM_MEMBER_ROLES[number]
+export type TeamInvitationRole = typeof TEAM_INVITATION_ROLES[number]
+
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+
+export function parsePositiveId(value: unknown): number | null {
+  const id = Number(value)
+  return Number.isInteger(id) && id > 0 ? id : null
+}
+
+export function changedRows(result: unknown): number {
+  const row = Array.isArray(result) ? result[0] : result
+  if (!row || typeof row !== 'object')
+    return 0
+
+  const record = row as Record<string, unknown>
+  return Number(
+    record.changes
+    ?? record.affectedRows
+    ?? record.numAffectedRows
+    ?? record.numUpdatedRows
+    ?? 0,
+  )
+}
+
+export function normalizeInvitationEmail(value: unknown): string | null {
+  if (typeof value !== 'string')
+    return null
+
+  const email = value.trim().toLowerCase()
+  return email.length <= 320 && EMAIL_RE.test(email) ? email : null
+}
+
+export function normalizeInvitationRole(value: unknown): TeamInvitationRole | null {
+  if (typeof value !== 'string')
+    return null
+
+  const role = value.trim().toLowerCase()
+  return TEAM_INVITATION_ROLES.includes(role as TeamInvitationRole)
+    ? role as TeamInvitationRole
+    : null
+}
+
+export function generateInvitationToken(): string {
+  return randomBytes(32).toString('base64url')
+}
+
+export function hashInvitationToken(token: string): string {
+  return createHash('sha256').update(token).digest('hex')
+}
+
+export function sqlTimestamp(value: Date = new Date()): string {
+  return value.toISOString().slice(0, 19).replace('T', ' ')
+}
+
+export function invitationExpiresAt(now: Date = new Date(), days = 7): string {
+  return sqlTimestamp(new Date(now.getTime() + days * 24 * 60 * 60 * 1000))
+}
+
+export function invitationStatus(status: unknown, expiresAt: unknown, now: Date = new Date()): string {
+  const value = String(status || 'pending')
+  if (value !== 'pending')
+    return value
+
+  const expires = new Date(String(expiresAt || '').replace(' ', 'T'))
+  return Number.isNaN(expires.getTime()) || expires.getTime() > now.getTime()
+    ? value
+    : 'expired'
+}
+
+export function invitationUrl(baseUrl: string, token: string): string {
+  const normalizedBase = baseUrl.trim().replace(/\/$/, '')
+  return `${normalizedBase}/team-invitations/${encodeURIComponent(token)}`
+}

package/app/Actions/Dashboard/legacy-dashboard-actions.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, test } from 'bun:test'
+import BlogAnalyticsAction from './Analytics/BlogAnalyticsAction'
+import BrowserAnalyticsAction from './Analytics/BrowserAnalyticsAction'
+import CommerceAnalyticsAction from './Analytics/CommerceAnalyticsAction'
+import CountryAnalyticsAction from './Analytics/CountryAnalyticsAction'
+import DeviceAnalyticsAction from './Analytics/DeviceAnalyticsAction'
+import PageAnalyticsAction from './Analytics/PageAnalyticsAction'
+import ReferrerAnalyticsAction from './Analytics/ReferrerAnalyticsAction'
+import SalesAnalyticsAction from './Analytics/SalesAnalyticsAction'
+import WebAnalyticsAction from './Analytics/WebAnalyticsAction'
+import BuddyChatStateAction from './Buddy/BuddyChatStateAction'
+import BuddyDashboardAction from './BuddyDashboardAction'
+import DashboardHealthAction from './DashboardHealthAction'
+import QueryDashboardAction from './Queries/QueryDashboardAction'
+import QueryIndexAction from './Queries/QueryIndexAction'
+import ServiceHealthAction from './ServiceHealthAction'
+
+describe('legacy dashboard action routes', () => {
+  test('reuse the canonical Buddy state action', () => {
+    expect(BuddyDashboardAction).toBe(BuddyChatStateAction)
+  })
+
+  test('reuse the canonical persisted query action', () => {
+    expect(QueryIndexAction).toBe(QueryDashboardAction)
+  })
+
+  test('reuses native health probes for the legacy services route', () => {
+    expect(ServiceHealthAction).toBe(DashboardHealthAction)
+  })
+
+  test('reuses canonical analytics actions for legacy routes', () => {
+    for (const action of [
+      BlogAnalyticsAction,
+      BrowserAnalyticsAction,
+      CountryAnalyticsAction,
+      DeviceAnalyticsAction,
+      PageAnalyticsAction,
+      ReferrerAnalyticsAction,
+    ])
+      expect(action).toBe(WebAnalyticsAction)
+
+    expect(CommerceAnalyticsAction).toBe(SalesAnalyticsAction)
+  })
+})

package/app/Actions/LogAction.ts

@@ -22,8 +22,8 @@ export default new Action({
       // `schema.string().in([...])` was a renamed/removed method
       // (stacksjs/stacks#1853) — the validator throws "schema.string().in
       // is not a function" at module evaluation. Use `schema.enum([...])`
-      // — that's the working enum primitive used elsewhere in defaults
-      // (Settings/UpdateAiConfig.ts) and in the typical project's models.
+      // — that's the working enum primitive used throughout the framework
+      // defaults and in the typical project's models.
       rule: schema.enum(['info', 'warn', 'error']),
       message: 'The log level must be one of "info", "warn", or "error".',
     },

package/app/Actions/Monitoring/ErrorDestroyAction.ts

@@ -7,8 +7,8 @@ export default new Action({
   description: 'Delete all errors in a group',
   method: 'DELETE',
   async handle(request: RequestInstance) {
-    const type = decodeURIComponent(request.string('type'))
-    const message = decodeURIComponent(request.string('message'))
+    const type = request.string('type')
+    const message = request.string('message')
 
     if (!type || !message) {
       return response.json({ error: 'Both type and message are required' }, 400)

package/app/Actions/Monitoring/ErrorGroupAction.ts

@@ -7,8 +7,8 @@ export default new Action({
   description: 'Fetch all errors in a specific group (by type and message)',
   method: 'GET',
   async handle(request: RequestInstance) {
-    const type = decodeURIComponent(request.string('type'))
-    const message = decodeURIComponent(request.string('message'))
+    const type = request.string('type')
+    const message = request.string('message')
 
     if (!type || !message) {
       return response.json({ error: 'Both type and message are required' }, 400)

package/app/Actions/Teams/AcceptInvitationAction.ts

@@ -0,0 +1,114 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { randomUUID } from 'node:crypto'
+import { Action } from '@stacksjs/actions'
+import { resolveAuthenticatedUser } from '@stacksjs/auth'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import {
+  changedRows,
+  generateInvitationToken,
+  hashInvitationToken,
+  invitationStatus,
+  normalizeInvitationEmail,
+  sqlTimestamp,
+} from '../Dashboard/Teams/team-records'
+import { syncTeamMemberCount } from '../Dashboard/Teams/team-member-count'
+
+export default new Action({
+  name: 'Accept Team Invitation',
+  description: 'Accepts a team invitation for its authenticated email recipient.',
+  method: 'POST',
+  apiResponse: true,
+
+  async handle(request: RequestInstance) {
+    const token = String(request.getParam('token') || '')
+    if (!token || token.length > 200)
+      return response.json({ message: 'Invitation not found.' }, 404)
+
+    const authenticated = await resolveAuthenticatedUser(request as any)
+    if (!authenticated?.id)
+      return response.json({ message: 'Sign in to accept this invitation.' }, 401)
+
+    const user = await db
+      .selectFrom('users')
+      .where('id', '=', authenticated.id)
+      .select(['id', 'email'])
+      .executeTakeFirst()
+    if (!user)
+      return response.json({ message: 'Authenticated user not found.' }, 401)
+
+    const invitation = await (db as any)
+      .selectFrom('team_invitations')
+      .where('token_hash', '=', hashInvitationToken(token))
+      .select(['id', 'team_id', 'email', 'role', 'status', 'expires_at'])
+      .executeTakeFirst()
+    if (!invitation)
+      return response.json({ message: 'Invitation not found.' }, 404)
+
+    const status = invitationStatus(invitation.status, invitation.expires_at)
+    if (status !== 'pending')
+      return response.json({ message: status === 'expired' ? 'This invitation has expired.' : 'This invitation is no longer available.' }, 409)
+
+    const invitedEmail = normalizeInvitationEmail(invitation.email)
+    const userEmail = normalizeInvitationEmail(user.email)
+    if (!invitedEmail || invitedEmail !== userEmail)
+      return response.json({ message: 'Sign in with the email address that received this invitation.' }, 403)
+
+    const teamId = Number(invitation.team_id)
+    const userId = Number(user.id)
+    const now = sqlTimestamp()
+
+    const accepted = await db.transaction(async (rawTrx) => {
+      const trx = rawTrx as unknown as typeof db
+      const claim = await (trx as any)
+        .updateTable('team_invitations')
+        .set({
+          status: 'accepted',
+          token_hash: hashInvitationToken(generateInvitationToken()),
+          accepted_by_user_id: userId,
+          accepted_at: now,
+          updated_at: now,
+        })
+        .where('id', '=', Number(invitation.id))
+        .where('token_hash', '=', hashInvitationToken(token))
+        .where('status', '=', 'pending')
+        .executeTakeFirst()
+
+      if (changedRows(claim) !== 1)
+        return null
+
+      const existing = await (trx as any)
+        .selectFrom('team_members')
+        .where('team_id', '=', teamId)
+        .where('user_id', '=', userId)
+        .select(['id'])
+        .executeTakeFirst()
+
+      if (!existing) {
+        await (trx as any)
+          .insertInto('team_members')
+          .values({
+            team_id: teamId,
+            user_id: userId,
+            role: String(invitation.role),
+            status: 'active',
+            created_at: now,
+            uuid: randomUUID(),
+          })
+          .execute()
+      }
+
+      await syncTeamMemberCount(teamId, trx)
+      return { alreadyMember: Boolean(existing) }
+    })
+
+    if (!accepted)
+      return response.json({ message: 'This invitation is no longer available.' }, 409)
+
+    return {
+      accepted: true,
+      alreadyMember: accepted.alreadyMember,
+      teamId,
+    }
+  },
+})

package/app/Actions/Teams/ShowInvitationAction.ts

@@ -0,0 +1,46 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { hashInvitationToken, invitationStatus } from '../Dashboard/Teams/team-records'
+
+export default new Action({
+  name: 'Show Team Invitation',
+  description: 'Returns the public details needed to accept a bearer-token invitation.',
+  method: 'GET',
+  apiResponse: true,
+
+  async handle(request: RequestInstance) {
+    const token = String(request.getParam('token') || '')
+    if (!token || token.length > 200)
+      return response.json({ message: 'Invitation not found.' }, 404)
+
+    const invitation = await (db as any)
+      .selectFrom('team_invitations')
+      .innerJoin('teams', 'teams.id', '=', 'team_invitations.team_id')
+      .where('team_invitations.token_hash', '=', hashInvitationToken(token))
+      .select([
+        'team_invitations.id as id',
+        'team_invitations.team_id as team_id',
+        'team_invitations.email as email',
+        'team_invitations.role as role',
+        'team_invitations.status as status',
+        'team_invitations.expires_at as expires_at',
+        'teams.name as team_name',
+      ])
+      .executeTakeFirst()
+    if (!invitation)
+      return response.json({ message: 'Invitation not found.' }, 404)
+
+    return {
+      invitation: {
+        teamId: Number(invitation.team_id),
+        teamName: String(invitation.team_name),
+        email: String(invitation.email),
+        role: String(invitation.role),
+        status: invitationStatus(invitation.status, invitation.expires_at),
+        expiresAt: String(invitation.expires_at),
+      },
+    }
+  },
+})

package/app/Jobs/SendCampaignJob.ts

@@ -1,7 +1,7 @@
 import { config } from '@stacksjs/config'
 import { mail, template } from '@stacksjs/email'
 import { log } from '@stacksjs/logging'
-import { buildUnsubscribeHeaders } from '@stacksjs/newsletter'
+import { buildUnsubscribeHeaders, shouldRunScheduledCampaign } from '@stacksjs/newsletter'
 import { Campaign, CampaignSend, EmailList, EmailListSubscriber, Subscriber } from '@stacksjs/orm'
 import { Job } from '@stacksjs/queue'
 import { url } from '@stacksjs/router'
@@ -27,6 +27,7 @@ interface SendCampaignPayload {
   campaignId: number
   chunkSize?: number
   dryRun?: boolean
+  scheduledAt?: string
 }
 
 export default new Job({
@@ -51,12 +52,19 @@ export default new Job({
       return { sent: 0, skipped: true }
     }
 
+    if (!shouldRunScheduledCampaign(campaign, payload.scheduledAt)) {
+      log.warn(`[SendCampaign] Skipping obsolete schedule for campaign ${campaign.id}`)
+      return { sent: 0, skipped: true }
+    }
+
     if (!campaign.email_list_id)
       throw new Error(`[SendCampaign] Campaign ${campaign.id} has no email_list_id`)
 
     const list = await (EmailList as any).find(campaign.email_list_id)
     if (!list)
       throw new Error(`[SendCampaign] EmailList ${campaign.email_list_id} not found`)
+    if (list.status !== 'active')
+      throw new Error(`[SendCampaign] EmailList ${campaign.email_list_id} is not active`)
 
     await campaign.update({ status: 'sending' })
 
@@ -79,6 +87,12 @@ export default new Job({
     // crash safety: if the worker dies mid-send we can resume from the
     // first subscriber without a CampaignSend row for this campaign.
     while (true) {
+      const currentCampaign = await (Campaign as any).find(campaign.id)
+      if (!currentCampaign || ['cancelled', 'sent'].includes(currentCampaign.status)) {
+        log.warn(`[SendCampaign] Stopping campaign ${campaign.id} in status '${currentCampaign?.status || 'missing'}'`)
+        return { sent, failed, stopped: true }
+      }
+
       const pivots = await (EmailListSubscriber as any)
         .where('email_list_id', campaign.email_list_id)
         .where('status', 'subscribed')
@@ -189,7 +203,13 @@ export default new Job({
       offset += pivots.length
     }
 
-    await campaign.update({
+    const completedCampaign = await (Campaign as any).find(campaign.id)
+    if (!completedCampaign || completedCampaign.status === 'cancelled') {
+      log.warn(`[SendCampaign] Not completing cancelled campaign ${campaign.id}`)
+      return { sent, failed, stopped: true }
+    }
+
+    await completedCampaign.update({
       status: 'sent',
       sent_at: new Date().toISOString(),
       sent_count: sent,

package/app/Mail/TeamInvitation.ts

@@ -0,0 +1,38 @@
+import { config } from '@stacksjs/config'
+import { mail, template } from '@stacksjs/email'
+
+export interface TeamInvitationMailOptions {
+  to: string
+  teamName: string
+  role: string
+  invitationUrl: string
+  expiresInDays: number
+}
+
+export async function sendTeamInvitation(options: TeamInvitationMailOptions): Promise<void> {
+  const appName = config.app.name || 'Stacks'
+  const subject = `You are invited to join ${options.teamName}`
+  const { html, text } = await template('team-invitation', {
+    variables: {
+      appName,
+      teamName: options.teamName,
+      role: options.role,
+      invitationUrl: options.invitationUrl,
+      expiresInDays: options.expiresInDays,
+    },
+    subject,
+  })
+
+  await mail.send({
+    to: [options.to],
+    from: {
+      name: config.email.from?.name || appName,
+      address: config.email.from?.address || 'hello@stacksjs.com',
+    },
+    subject,
+    html,
+    text,
+  })
+}
+
+export default sendTeamInvitation