@stacksjs/defaults 0.70.354 → 0.70.356

package/app/Actions/Dashboard/Teams/TeamInvitationResendAction.ts

@@ -1,9 +1,12 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
+import { isUniqueViolation } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
+import { teamOperationalError } from '../../Teams/team-response'
 import { deliverTeamInvitation } from './team-invitation-delivery'
 import {
+  changedRows,
   generateInvitationToken,
   hashInvitationToken,
   invitationExpiresAt,
@@ -23,40 +26,59 @@ export default new Action({
     if (!teamId || !invitationId)
       return response.json({ message: 'Invalid team or invitation id.' }, 400)
 
-    const invitation = await (db as any)
-      .selectFrom('team_invitations')
-      .innerJoin('teams', 'teams.id', '=', 'team_invitations.team_id')
-      .where('team_invitations.id', '=', invitationId)
-      .where('team_invitations.team_id', '=', teamId)
-      .select([
-        'team_invitations.id as id',
-        'team_invitations.email as email',
-        'team_invitations.role as role',
-        'team_invitations.status as status',
-        'teams.name as team_name',
-      ])
-      .executeTakeFirst()
+    let invitation
+    try {
+      invitation = await (db as any)
+        .selectFrom('team_invitations')
+        .innerJoin('teams', 'teams.id', '=', 'team_invitations.team_id')
+        .where('team_invitations.id', '=', invitationId)
+        .where('team_invitations.team_id', '=', teamId)
+        .select([
+          'team_invitations.id as id',
+          'team_invitations.email as email',
+          'team_invitations.role as role',
+          'team_invitations.status as status',
+          'team_invitations.token_hash as token_hash',
+          'teams.name as team_name',
+        ])
+        .executeTakeFirst()
+    }
+    catch (error) {
+      return teamOperationalError(error, 'Invitation could not be loaded.', 'TeamInvitationResendAction.lookup', 500)
+    }
     if (!invitation)
       return response.json({ message: 'Invitation not found.' }, 404)
     if (!['pending', 'expired'].includes(String(invitation.status)))
       return response.json({ message: 'Only pending or expired invitations can be resent.' }, 409)
 
     const token = generateInvitationToken()
+    const tokenHash = hashInvitationToken(token)
     const expiresAt = invitationExpiresAt()
-    await (db as any)
-      .updateTable('team_invitations')
-      .set({
-        token_hash: hashInvitationToken(token),
-        status: 'pending',
-        delivery_status: 'pending',
-        delivery_error: null,
-        expires_at: expiresAt,
-        delivered_at: null,
-        updated_at: sqlTimestamp(),
-      })
-      .where('id', '=', invitationId)
-      .where('team_id', '=', teamId)
-      .execute()
+    try {
+      const result = await (db as any)
+        .updateTable('team_invitations')
+        .set({
+          token_hash: tokenHash,
+          pending_key: `${teamId}:${String(invitation.email).trim().toLowerCase()}`,
+          status: 'pending',
+          delivery_status: 'pending',
+          delivery_error: null,
+          expires_at: expiresAt,
+          delivered_at: null,
+          updated_at: sqlTimestamp(),
+        })
+        .where('id', '=', invitationId)
+        .where('team_id', '=', teamId)
+        .where('token_hash', '=', String(invitation.token_hash))
+        .executeTakeFirst()
+      if (changedRows(result) !== 1)
+        return response.json({ message: 'The invitation changed before it could be resent.' }, 409)
+    }
+    catch (error) {
+      if (isUniqueViolation(error))
+        return response.json({ message: 'Another pending invitation already exists for this email.' }, 409)
+      return teamOperationalError(error, 'Invitation could not be refreshed.', 'TeamInvitationResendAction.update', 500)
+    }
 
     try {
       await deliverTeamInvitation({
@@ -65,10 +87,11 @@ export default new Action({
         teamName: String(invitation.team_name),
         role: String(invitation.role),
         token,
+        tokenHash,
       })
     }
-    catch {
-      return response.json({ message: 'The invitation was refreshed, but email delivery failed.' }, 502)
+    catch (error) {
+      return teamOperationalError(error, 'The invitation was refreshed, but email delivery failed.', 'TeamInvitationResendAction.delivery', 502)
     }
 
     return {

package/app/Actions/Dashboard/Teams/TeamInviteAction.ts

@@ -2,9 +2,12 @@ import type { RequestInstance } from '@stacksjs/types'
 import { randomUUID } from 'node:crypto'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
+import { isUniqueViolation } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
+import { TeamStateConflictError, teamOperationalError } from '../../Teams/team-response'
 import { deliverTeamInvitation } from './team-invitation-delivery'
 import {
+  changedRows,
   generateInvitationToken,
   hashInvitationToken,
   invitationExpiresAt,
@@ -25,12 +28,12 @@ export default new Action({
   method: 'POST',
   apiResponse: true,
 
-  async handle(request: RequestInstance) {
+  async handle(request: RequestInstance<InviteInput>) {
     const teamId = parsePositiveId(request.getParam('id'))
     if (!teamId)
       return response.json({ message: 'Invalid team id.' }, 400)
 
-    const input = (request as any).jsonBody as InviteInput | undefined ?? {}
+    const input = request.all()
     const email = normalizeInvitationEmail(input.email)
     const role = normalizeInvitationRole(input.role ?? 'member')
     if (!email)
@@ -38,95 +41,123 @@ export default new Action({
     if (!role)
       return response.json({ message: 'Choose a valid invitation role.' }, 422)
 
-    const team = await db
-      .selectFrom('teams')
-      .where('id', '=', teamId)
-      .select(['id', 'name'])
-      .executeTakeFirst()
-    if (!team)
-      return response.json({ message: 'Team not found.' }, 404)
-
-    const existingUser = await db
-      .selectFrom('users')
-      .where('email', '=', email)
-      .select(['id'])
-      .executeTakeFirst()
-    if (existingUser) {
-      const membership = await (db as any)
-        .selectFrom('team_members')
-        .where('team_id', '=', teamId)
-        .where('user_id', '=', Number(existingUser.id))
-        .select(['id'])
-        .executeTakeFirst()
-      if (membership)
-        return response.json({ message: 'This person is already a member of the team.' }, 409)
-    }
-
-    const pending = await (db as any)
-      .selectFrom('team_invitations')
-      .where('team_id', '=', teamId)
-      .where('email', '=', email)
-      .where('status', '=', 'pending')
-      .select(['id', 'expires_at'])
-      .executeTakeFirst()
-    if (pending && new Date(String(pending.expires_at).replace(' ', 'T')).getTime() > Date.now()) {
-      return response.json({ message: 'A pending invitation already exists. Resend or revoke it from the invitation list.' }, 409)
-    }
-    if (pending) {
-      await (db as any)
-        .updateTable('team_invitations')
-        .set({ status: 'expired', updated_at: sqlTimestamp() })
-        .where('id', '=', Number(pending.id))
-        .execute()
-    }
-
     const token = generateInvitationToken()
     const tokenHash = hashInvitationToken(token)
+    const pendingKey = `${teamId}:${email}`
     const expiresAt = invitationExpiresAt()
-    const requester = (request as any).user ?? (request as any)._authenticatedUser ?? null
-    const invitedByUserId = requester && Number.isInteger(Number(requester.id))
-      ? Number(requester.id)
-      : null
+    let created: { id: number, teamName: string } | Response
+    try {
+      const requester = await request.user()
+      const requesterId = Number(requester?.id)
+      const invitedByUserId = Number.isSafeInteger(requesterId) && requesterId > 0
+        ? requesterId
+        : null
 
-    await (db as any)
-      .insertInto('team_invitations')
-      .values({
-        team_id: teamId,
-        email,
-        role,
-        token_hash: tokenHash,
-        invited_by_user_id: invitedByUserId,
-        status: 'pending',
-        delivery_status: 'pending',
-        expires_at: expiresAt,
-        uuid: randomUUID(),
+      created = await db.transaction(async (rawTrx) => {
+        const trx = rawTrx as unknown as typeof db
+        const team = await trx
+          .selectFrom('teams')
+          .where('id', '=', teamId)
+          .select(['id', 'name'])
+          .executeTakeFirst()
+        if (!team)
+          return response.json({ message: 'Team not found.' }, 404)
+
+        const [existingUser, pending] = await Promise.all([
+          trx
+            .selectFrom('users')
+            .where('email', '=', email)
+            .select(['id'])
+            .executeTakeFirst(),
+          (trx as any)
+            .selectFrom('team_invitations')
+            .where('team_id', '=', teamId)
+            .where('email', '=', email)
+            .where('status', '=', 'pending')
+            .select(['id', 'expires_at', 'token_hash'])
+            .executeTakeFirst(),
+        ])
+        if (existingUser) {
+          const membership = await (trx as any)
+            .selectFrom('team_members')
+            .where('team_id', '=', teamId)
+            .where('user_id', '=', Number(existingUser.id))
+            .select(['id'])
+            .executeTakeFirst()
+          if (membership)
+            return response.json({ message: 'This person is already a member of the team.' }, 409)
+        }
+
+        if (pending && new Date(String(pending.expires_at).replace(' ', 'T')).getTime() > Date.now()) {
+          return response.json({ message: 'A pending invitation already exists. Resend or revoke it from the invitation list.' }, 409)
+        }
+        if (pending) {
+          const expired = await (trx as any)
+            .updateTable('team_invitations')
+            .set({ status: 'expired', pending_key: null, updated_at: sqlTimestamp() })
+            .where('id', '=', Number(pending.id))
+            .where('token_hash', '=', String(pending.token_hash))
+            .where('status', '=', 'pending')
+            .executeTakeFirst()
+          if (changedRows(expired) !== 1)
+            throw new TeamStateConflictError('The pending invitation changed before it could be replaced.')
+        }
+
+        await (trx as any)
+          .insertInto('team_invitations')
+          .values({
+            team_id: teamId,
+            email,
+            role,
+            token_hash: tokenHash,
+            pending_key: pendingKey,
+            invited_by_user_id: invitedByUserId,
+            status: 'pending',
+            delivery_status: 'pending',
+            expires_at: expiresAt,
+            uuid: randomUUID(),
+          })
+          .execute()
+
+        const invitation = await (trx as any)
+          .selectFrom('team_invitations')
+          .where('token_hash', '=', tokenHash)
+          .select(['id'])
+          .executeTakeFirst()
+        if (!invitation)
+          throw new Error('The inserted invitation could not be resolved by its token hash.')
+
+        return { id: Number(invitation.id), teamName: String(team.name) }
       })
-      .execute()
+    }
+    catch (error) {
+      if (error instanceof TeamStateConflictError)
+        return response.json({ message: error.message }, 409)
+      if (isUniqueViolation(error))
+        return response.json({ message: 'A pending invitation already exists. Resend or revoke it from the invitation list.' }, 409)
+      return teamOperationalError(error, 'The invitation could not be created.', 'TeamInviteAction.create', 500)
+    }
 
-    const created = await (db as any)
-      .selectFrom('team_invitations')
-      .where('token_hash', '=', tokenHash)
-      .select(['id'])
-      .executeTakeFirst()
-    if (!created)
-      return response.json({ message: 'The invitation could not be created.' }, 500)
+    if (created instanceof Response)
+      return created
 
     try {
       await deliverTeamInvitation({
-        id: Number(created.id),
+        id: created.id,
         email,
-        teamName: String(team.name),
+        teamName: created.teamName,
         role,
         token,
+        tokenHash,
       })
     }
-    catch {
-      return response.json({ message: 'Invitation created, but email delivery failed. You can retry it from the invitation list.' }, 502)
+    catch (error) {
+      return teamOperationalError(error, 'Invitation created, but email delivery failed. You can retry it from the invitation list.', 'TeamInviteAction.delivery', 502)
     }
 
     return response.json({
       invitation: {
-        id: Number(created.id),
+        id: created.id,
         email,
         role,
         status: 'pending',

package/app/Actions/Dashboard/Teams/TeamMemberDestroyAction.ts

@@ -2,8 +2,9 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { response } from '@stacksjs/router'
+import { TeamStateConflictError, teamOperationalError } from '../../Teams/team-response'
 import { syncTeamMemberCount } from './team-member-count'
-import { parsePositiveId } from './team-records'
+import { changedRows, parsePositiveId } from './team-records'
 
 export default new Action({
   name: 'Dashboard Team Member Destroy',
@@ -17,24 +18,42 @@ export default new Action({
     if (!teamId || !memberId)
       return response.json({ message: 'Invalid team or member id.' }, 400)
 
-    const member = await (db as any)
-      .selectFrom('team_members')
-      .where('id', '=', memberId)
-      .where('team_id', '=', teamId)
-      .select(['id', 'role'])
-      .executeTakeFirst()
-    if (!member)
-      return response.json({ message: 'Team member not found.' }, 404)
-    if (member.role === 'owner')
-      return response.json({ message: 'Transfer team ownership before removing the owner.' }, 409)
+    let result: Response | null
+    try {
+      result = await db.transaction(async (rawTrx) => {
+        const trx = rawTrx as unknown as typeof db
+        const member = await (trx as any)
+          .selectFrom('team_members')
+          .where('id', '=', memberId)
+          .where('team_id', '=', teamId)
+          .select(['id', 'role'])
+          .executeTakeFirst()
+        if (!member)
+          return response.json({ message: 'Team member not found.' }, 404)
+        if (member.role === 'owner')
+          return response.json({ message: 'Transfer team ownership before removing the owner.' }, 409)
 
-    await (db as any)
-      .deleteFrom('team_members')
-      .where('id', '=', memberId)
-      .where('team_id', '=', teamId)
-      .execute()
+        const deleted = await (trx as any)
+          .deleteFrom('team_members')
+          .where('id', '=', memberId)
+          .where('team_id', '=', teamId)
+          .where('role', '!=', 'owner')
+          .executeTakeFirst()
+        if (changedRows(deleted) !== 1)
+          throw new TeamStateConflictError('The team member changed before they could be removed.')
 
-    await syncTeamMemberCount(teamId)
+        await syncTeamMemberCount(teamId, trx)
+        return null
+      })
+    }
+    catch (error) {
+      if (error instanceof TeamStateConflictError)
+        return response.json({ message: error.message }, 409)
+      return teamOperationalError(error, 'The team member could not be removed.', 'TeamMemberDestroyAction', 500)
+    }
+
+    if (result)
+      return result
 
     return response.noContent()
   },

package/app/Actions/Dashboard/Teams/TeamMemberUpdateAction.ts

@@ -2,8 +2,9 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { response } from '@stacksjs/router'
+import { TeamStateConflictError, teamOperationalError } from '../../Teams/team-response'
 import { syncTeamMemberCount } from './team-member-count'
-import { normalizeInvitationRole, parsePositiveId, sqlTimestamp } from './team-records'
+import { changedRows, normalizeInvitationRole, parsePositiveId, sqlTimestamp } from './team-records'
 
 interface UpdateInput {
   role?: unknown
@@ -16,40 +17,52 @@ export default new Action({
   method: 'PATCH',
   apiResponse: true,
 
-  async handle(request: RequestInstance) {
+  async handle(request: RequestInstance<UpdateInput>) {
     const teamId = parsePositiveId(request.getParam('id'))
     const memberId = parsePositiveId(request.getParam('memberId'))
     if (!teamId || !memberId)
       return response.json({ message: 'Invalid team or member id.' }, 400)
 
-    const member = await (db as any)
-      .selectFrom('team_members')
-      .where('id', '=', memberId)
-      .where('team_id', '=', teamId)
-      .select(['id', 'role', 'status'])
-      .executeTakeFirst()
-    if (!member)
-      return response.json({ message: 'Team member not found.' }, 404)
-    if (member.role === 'owner')
-      return response.json({ message: 'Transfer team ownership before changing the owner.' }, 409)
+    const input = request.all()
+    try {
+      return await db.transaction(async (rawTrx) => {
+        const trx = rawTrx as unknown as typeof db
+        const member = await (trx as any)
+          .selectFrom('team_members')
+          .where('id', '=', memberId)
+          .where('team_id', '=', teamId)
+          .select(['id', 'role', 'status'])
+          .executeTakeFirst()
+        if (!member)
+          return response.json({ message: 'Team member not found.' }, 404)
+        if (member.role === 'owner')
+          return response.json({ message: 'Transfer team ownership before changing the owner.' }, 409)
 
-    const input = (request as any).jsonBody as UpdateInput | undefined ?? {}
-    const role = input.role === undefined ? String(member.role) : normalizeInvitationRole(input.role)
-    const status = input.status === undefined ? String(member.status) : String(input.status).trim().toLowerCase()
-    if (!role)
-      return response.json({ message: 'Choose a valid member role.' }, 422)
-    if (!['active', 'suspended'].includes(status))
-      return response.json({ message: 'Choose a valid member status.' }, 422)
+        const role = input.role === undefined ? String(member.role) : normalizeInvitationRole(input.role)
+        const status = input.status === undefined ? String(member.status) : String(input.status).trim().toLowerCase()
+        if (!role)
+          return response.json({ message: 'Choose a valid member role.' }, 422)
+        if (!['active', 'suspended'].includes(status))
+          return response.json({ message: 'Choose a valid member status.' }, 422)
 
-    await (db as any)
-      .updateTable('team_members')
-      .set({ role, status, updated_at: sqlTimestamp() })
-      .where('id', '=', memberId)
-      .where('team_id', '=', teamId)
-      .execute()
+        const updated = await (trx as any)
+          .updateTable('team_members')
+          .set({ role, status, updated_at: sqlTimestamp() })
+          .where('id', '=', memberId)
+          .where('team_id', '=', teamId)
+          .where('role', '!=', 'owner')
+          .executeTakeFirst()
+        if (changedRows(updated) !== 1)
+          throw new TeamStateConflictError('The team member changed before they could be updated.')
 
-    await syncTeamMemberCount(teamId)
-
-    return { member: { id: memberId, role, status } }
+        await syncTeamMemberCount(teamId, trx)
+        return { member: { id: memberId, role, status } }
+      })
+    }
+    catch (error) {
+      if (error instanceof TeamStateConflictError)
+        return response.json({ message: error.message }, 409)
+      return teamOperationalError(error, 'The team member could not be updated.', 'TeamMemberUpdateAction', 500)
+    }
   },
 })

package/app/Actions/Dashboard/Teams/TeamPeopleIndexAction.ts

@@ -2,6 +2,7 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { response } from '@stacksjs/router'
+import { teamOperationalError } from '../../Teams/team-response'
 import { invitationStatus, parsePositiveId } from './team-records'
 
 export default new Action({
@@ -15,69 +16,81 @@ export default new Action({
     if (!teamId)
       return response.json({ message: 'Invalid team id.' }, 400)
 
-    const team = await db
-      .selectFrom('teams')
-      .where('id', '=', teamId)
-      .select(['id', 'name'])
-      .executeTakeFirst()
+    let team
+    try {
+      team = await db
+        .selectFrom('teams')
+        .where('id', '=', teamId)
+        .select(['id', 'name'])
+        .executeTakeFirst()
+    }
+    catch (error) {
+      return teamOperationalError(error, 'Team could not be loaded.', 'TeamPeopleIndexAction.team')
+    }
     if (!team)
       return response.json({ message: 'Team not found.' }, 404)
 
-    const members = await (db as any)
-      .selectFrom('team_members')
-      .innerJoin('users', 'users.id', '=', 'team_members.user_id')
-      .where('team_members.team_id', '=', teamId)
-      .select([
-        'team_members.id as id',
-        'team_members.user_id as user_id',
-        'team_members.role as role',
-        'team_members.status as status',
-        'team_members.created_at as created_at',
-        'users.name as name',
-        'users.email as email',
+    try {
+      const [members, invitations] = await Promise.all([
+        (db as any)
+          .selectFrom('team_members')
+          .innerJoin('users', 'users.id', '=', 'team_members.user_id')
+          .where('team_members.team_id', '=', teamId)
+          .select([
+            'team_members.id as id',
+            'team_members.user_id as user_id',
+            'team_members.role as role',
+            'team_members.status as status',
+            'team_members.created_at as created_at',
+            'users.name as name',
+            'users.email as email',
+          ])
+          .orderBy('users.name', 'asc')
+          .execute(),
+        (db as any)
+          .selectFrom('team_invitations')
+          .where('team_id', '=', teamId)
+          .where('status', '=', 'pending')
+          .select([
+            'id',
+            'email',
+            'role',
+            'status',
+            'delivery_status',
+            'expires_at',
+            'created_at',
+          ])
+          .orderBy('created_at', 'desc')
+          .execute(),
       ])
-      .orderBy('users.name', 'asc')
-      .execute()
 
-    const invitations = await (db as any)
-      .selectFrom('team_invitations')
-      .where('team_id', '=', teamId)
-      .where('status', '=', 'pending')
-      .select([
-        'id',
-        'email',
-        'role',
-        'status',
-        'delivery_status',
-        'expires_at',
-        'created_at',
-      ])
-      .orderBy('created_at', 'desc')
-      .execute()
-
-    return {
-      team: {
-        id: Number(team.id),
-        name: String(team.name),
-      },
-      members: members.map((member: any) => ({
-        id: Number(member.id),
-        userId: Number(member.user_id),
-        name: String(member.name || member.email || 'Team member'),
-        email: String(member.email || ''),
-        role: String(member.role || 'member'),
-        status: String(member.status || 'active'),
-        joinedAt: member.created_at ? String(member.created_at) : null,
-      })),
-      invitations: invitations.map((invitation: any) => ({
-        id: Number(invitation.id),
-        email: String(invitation.email),
-        role: String(invitation.role || 'member'),
-        status: invitationStatus(invitation.status, invitation.expires_at),
-        deliveryStatus: String(invitation.delivery_status || 'pending'),
-        expiresAt: String(invitation.expires_at),
-        createdAt: invitation.created_at ? String(invitation.created_at) : null,
-      })),
+      return {
+        team: {
+          id: Number(team.id),
+          name: String(team.name),
+        },
+        members: members.map((member: any) => ({
+          id: Number(member.id),
+          userId: Number(member.user_id),
+          name: String(member.name || member.email || 'Team member'),
+          email: String(member.email || ''),
+          role: String(member.role || 'member'),
+          status: String(member.status || 'active'),
+          joinedAt: member.created_at ? String(member.created_at) : null,
+        })),
+        invitations: invitations.map((invitation: any) => ({
+          id: Number(invitation.id),
+          email: String(invitation.email),
+          role: String(invitation.role || 'member'),
+          status: invitationStatus(invitation.status, invitation.expires_at),
+          deliveryStatus: String(invitation.delivery_status || 'pending'),
+          expiresAt: String(invitation.expires_at),
+          createdAt: invitation.created_at ? String(invitation.created_at) : null,
+        })),
+      }
+    }
+    catch (error) {
+      return teamOperationalError(error, 'Team members and invitations could not be loaded.', 'TeamPeopleIndexAction.people')
     }
   },
 })