@stacksjs/defaults 0.70.355 → 0.70.356

package/app/Actions/Dashboard/Teams/TeamInviteAction.ts

@@ -2,9 +2,12 @@ import type { RequestInstance } from '@stacksjs/types'
 import { randomUUID } from 'node:crypto'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
+import { isUniqueViolation } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
+import { TeamStateConflictError, teamOperationalError } from '../../Teams/team-response'
 import { deliverTeamInvitation } from './team-invitation-delivery'
 import {
+  changedRows,
   generateInvitationToken,
   hashInvitationToken,
   invitationExpiresAt,
@@ -38,95 +41,123 @@ export default new Action({
     if (!role)
       return response.json({ message: 'Choose a valid invitation role.' }, 422)
 
-    const team = await db
-      .selectFrom('teams')
-      .where('id', '=', teamId)
-      .select(['id', 'name'])
-      .executeTakeFirst()
-    if (!team)
-      return response.json({ message: 'Team not found.' }, 404)
-
-    const existingUser = await db
-      .selectFrom('users')
-      .where('email', '=', email)
-      .select(['id'])
-      .executeTakeFirst()
-    if (existingUser) {
-      const membership = await (db as any)
-        .selectFrom('team_members')
-        .where('team_id', '=', teamId)
-        .where('user_id', '=', Number(existingUser.id))
-        .select(['id'])
-        .executeTakeFirst()
-      if (membership)
-        return response.json({ message: 'This person is already a member of the team.' }, 409)
-    }
-
-    const pending = await (db as any)
-      .selectFrom('team_invitations')
-      .where('team_id', '=', teamId)
-      .where('email', '=', email)
-      .where('status', '=', 'pending')
-      .select(['id', 'expires_at'])
-      .executeTakeFirst()
-    if (pending && new Date(String(pending.expires_at).replace(' ', 'T')).getTime() > Date.now()) {
-      return response.json({ message: 'A pending invitation already exists. Resend or revoke it from the invitation list.' }, 409)
-    }
-    if (pending) {
-      await (db as any)
-        .updateTable('team_invitations')
-        .set({ status: 'expired', updated_at: sqlTimestamp() })
-        .where('id', '=', Number(pending.id))
-        .execute()
-    }
-
     const token = generateInvitationToken()
     const tokenHash = hashInvitationToken(token)
+    const pendingKey = `${teamId}:${email}`
     const expiresAt = invitationExpiresAt()
-    const requester = await request.user()
-    const invitedByUserId = requester && Number.isInteger(Number(requester.id))
-      ? Number(requester.id)
-      : null
+    let created: { id: number, teamName: string } | Response
+    try {
+      const requester = await request.user()
+      const requesterId = Number(requester?.id)
+      const invitedByUserId = Number.isSafeInteger(requesterId) && requesterId > 0
+        ? requesterId
+        : null
 
-    await (db as any)
-      .insertInto('team_invitations')
-      .values({
-        team_id: teamId,
-        email,
-        role,
-        token_hash: tokenHash,
-        invited_by_user_id: invitedByUserId,
-        status: 'pending',
-        delivery_status: 'pending',
-        expires_at: expiresAt,
-        uuid: randomUUID(),
+      created = await db.transaction(async (rawTrx) => {
+        const trx = rawTrx as unknown as typeof db
+        const team = await trx
+          .selectFrom('teams')
+          .where('id', '=', teamId)
+          .select(['id', 'name'])
+          .executeTakeFirst()
+        if (!team)
+          return response.json({ message: 'Team not found.' }, 404)
+
+        const [existingUser, pending] = await Promise.all([
+          trx
+            .selectFrom('users')
+            .where('email', '=', email)
+            .select(['id'])
+            .executeTakeFirst(),
+          (trx as any)
+            .selectFrom('team_invitations')
+            .where('team_id', '=', teamId)
+            .where('email', '=', email)
+            .where('status', '=', 'pending')
+            .select(['id', 'expires_at', 'token_hash'])
+            .executeTakeFirst(),
+        ])
+        if (existingUser) {
+          const membership = await (trx as any)
+            .selectFrom('team_members')
+            .where('team_id', '=', teamId)
+            .where('user_id', '=', Number(existingUser.id))
+            .select(['id'])
+            .executeTakeFirst()
+          if (membership)
+            return response.json({ message: 'This person is already a member of the team.' }, 409)
+        }
+
+        if (pending && new Date(String(pending.expires_at).replace(' ', 'T')).getTime() > Date.now()) {
+          return response.json({ message: 'A pending invitation already exists. Resend or revoke it from the invitation list.' }, 409)
+        }
+        if (pending) {
+          const expired = await (trx as any)
+            .updateTable('team_invitations')
+            .set({ status: 'expired', pending_key: null, updated_at: sqlTimestamp() })
+            .where('id', '=', Number(pending.id))
+            .where('token_hash', '=', String(pending.token_hash))
+            .where('status', '=', 'pending')
+            .executeTakeFirst()
+          if (changedRows(expired) !== 1)
+            throw new TeamStateConflictError('The pending invitation changed before it could be replaced.')
+        }
+
+        await (trx as any)
+          .insertInto('team_invitations')
+          .values({
+            team_id: teamId,
+            email,
+            role,
+            token_hash: tokenHash,
+            pending_key: pendingKey,
+            invited_by_user_id: invitedByUserId,
+            status: 'pending',
+            delivery_status: 'pending',
+            expires_at: expiresAt,
+            uuid: randomUUID(),
+          })
+          .execute()
+
+        const invitation = await (trx as any)
+          .selectFrom('team_invitations')
+          .where('token_hash', '=', tokenHash)
+          .select(['id'])
+          .executeTakeFirst()
+        if (!invitation)
+          throw new Error('The inserted invitation could not be resolved by its token hash.')
+
+        return { id: Number(invitation.id), teamName: String(team.name) }
       })
-      .execute()
+    }
+    catch (error) {
+      if (error instanceof TeamStateConflictError)
+        return response.json({ message: error.message }, 409)
+      if (isUniqueViolation(error))
+        return response.json({ message: 'A pending invitation already exists. Resend or revoke it from the invitation list.' }, 409)
+      return teamOperationalError(error, 'The invitation could not be created.', 'TeamInviteAction.create', 500)
+    }
 
-    const created = await (db as any)
-      .selectFrom('team_invitations')
-      .where('token_hash', '=', tokenHash)
-      .select(['id'])
-      .executeTakeFirst()
-    if (!created)
-      return response.json({ message: 'The invitation could not be created.' }, 500)
+    if (created instanceof Response)
+      return created
 
     try {
       await deliverTeamInvitation({
-        id: Number(created.id),
+        id: created.id,
         email,
-        teamName: String(team.name),
+        teamName: created.teamName,
         role,
         token,
+        tokenHash,
       })
     }
-    catch {
-      return response.json({ message: 'Invitation created, but email delivery failed. You can retry it from the invitation list.' }, 502)
+    catch (error) {
+      return teamOperationalError(error, 'Invitation created, but email delivery failed. You can retry it from the invitation list.', 'TeamInviteAction.delivery', 502)
     }
 
     return response.json({
       invitation: {
-        id: Number(created.id),
+        id: created.id,
         email,
         role,
         status: 'pending',

package/app/Actions/Dashboard/Teams/TeamMemberDestroyAction.ts

@@ -2,8 +2,9 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { response } from '@stacksjs/router'
+import { TeamStateConflictError, teamOperationalError } from '../../Teams/team-response'
 import { syncTeamMemberCount } from './team-member-count'
-import { parsePositiveId } from './team-records'
+import { changedRows, parsePositiveId } from './team-records'
 
 export default new Action({
   name: 'Dashboard Team Member Destroy',
@@ -17,24 +18,42 @@ export default new Action({
     if (!teamId || !memberId)
       return response.json({ message: 'Invalid team or member id.' }, 400)
 
-    const member = await (db as any)
-      .selectFrom('team_members')
-      .where('id', '=', memberId)
-      .where('team_id', '=', teamId)
-      .select(['id', 'role'])
-      .executeTakeFirst()
-    if (!member)
-      return response.json({ message: 'Team member not found.' }, 404)
-    if (member.role === 'owner')
-      return response.json({ message: 'Transfer team ownership before removing the owner.' }, 409)
+    let result: Response | null
+    try {
+      result = await db.transaction(async (rawTrx) => {
+        const trx = rawTrx as unknown as typeof db
+        const member = await (trx as any)
+          .selectFrom('team_members')
+          .where('id', '=', memberId)
+          .where('team_id', '=', teamId)
+          .select(['id', 'role'])
+          .executeTakeFirst()
+        if (!member)
+          return response.json({ message: 'Team member not found.' }, 404)
+        if (member.role === 'owner')
+          return response.json({ message: 'Transfer team ownership before removing the owner.' }, 409)
 
-    await (db as any)
-      .deleteFrom('team_members')
-      .where('id', '=', memberId)
-      .where('team_id', '=', teamId)
-      .execute()
+        const deleted = await (trx as any)
+          .deleteFrom('team_members')
+          .where('id', '=', memberId)
+          .where('team_id', '=', teamId)
+          .where('role', '!=', 'owner')
+          .executeTakeFirst()
+        if (changedRows(deleted) !== 1)
+          throw new TeamStateConflictError('The team member changed before they could be removed.')
 
-    await syncTeamMemberCount(teamId)
+        await syncTeamMemberCount(teamId, trx)
+        return null
+      })
+    }
+    catch (error) {
+      if (error instanceof TeamStateConflictError)
+        return response.json({ message: error.message }, 409)
+      return teamOperationalError(error, 'The team member could not be removed.', 'TeamMemberDestroyAction', 500)
+    }
+
+    if (result)
+      return result
 
     return response.noContent()
   },

package/app/Actions/Dashboard/Teams/TeamMemberUpdateAction.ts

@@ -2,8 +2,9 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { response } from '@stacksjs/router'
+import { TeamStateConflictError, teamOperationalError } from '../../Teams/team-response'
 import { syncTeamMemberCount } from './team-member-count'
-import { normalizeInvitationRole, parsePositiveId, sqlTimestamp } from './team-records'
+import { changedRows, normalizeInvitationRole, parsePositiveId, sqlTimestamp } from './team-records'
 
 interface UpdateInput {
   role?: unknown
@@ -22,34 +23,46 @@ export default new Action({
     if (!teamId || !memberId)
       return response.json({ message: 'Invalid team or member id.' }, 400)
 
-    const member = await (db as any)
-      .selectFrom('team_members')
-      .where('id', '=', memberId)
-      .where('team_id', '=', teamId)
-      .select(['id', 'role', 'status'])
-      .executeTakeFirst()
-    if (!member)
-      return response.json({ message: 'Team member not found.' }, 404)
-    if (member.role === 'owner')
-      return response.json({ message: 'Transfer team ownership before changing the owner.' }, 409)
-
     const input = request.all()
-    const role = input.role === undefined ? String(member.role) : normalizeInvitationRole(input.role)
-    const status = input.status === undefined ? String(member.status) : String(input.status).trim().toLowerCase()
-    if (!role)
-      return response.json({ message: 'Choose a valid member role.' }, 422)
-    if (!['active', 'suspended'].includes(status))
-      return response.json({ message: 'Choose a valid member status.' }, 422)
+    try {
+      return await db.transaction(async (rawTrx) => {
+        const trx = rawTrx as unknown as typeof db
+        const member = await (trx as any)
+          .selectFrom('team_members')
+          .where('id', '=', memberId)
+          .where('team_id', '=', teamId)
+          .select(['id', 'role', 'status'])
+          .executeTakeFirst()
+        if (!member)
+          return response.json({ message: 'Team member not found.' }, 404)
+        if (member.role === 'owner')
+          return response.json({ message: 'Transfer team ownership before changing the owner.' }, 409)
 
-    await (db as any)
-      .updateTable('team_members')
-      .set({ role, status, updated_at: sqlTimestamp() })
-      .where('id', '=', memberId)
-      .where('team_id', '=', teamId)
-      .execute()
+        const role = input.role === undefined ? String(member.role) : normalizeInvitationRole(input.role)
+        const status = input.status === undefined ? String(member.status) : String(input.status).trim().toLowerCase()
+        if (!role)
+          return response.json({ message: 'Choose a valid member role.' }, 422)
+        if (!['active', 'suspended'].includes(status))
+          return response.json({ message: 'Choose a valid member status.' }, 422)
 
-    await syncTeamMemberCount(teamId)
+        const updated = await (trx as any)
+          .updateTable('team_members')
+          .set({ role, status, updated_at: sqlTimestamp() })
+          .where('id', '=', memberId)
+          .where('team_id', '=', teamId)
+          .where('role', '!=', 'owner')
+          .executeTakeFirst()
+        if (changedRows(updated) !== 1)
+          throw new TeamStateConflictError('The team member changed before they could be updated.')
 
-    return { member: { id: memberId, role, status } }
+        await syncTeamMemberCount(teamId, trx)
+        return { member: { id: memberId, role, status } }
+      })
+    }
+    catch (error) {
+      if (error instanceof TeamStateConflictError)
+        return response.json({ message: error.message }, 409)
+      return teamOperationalError(error, 'The team member could not be updated.', 'TeamMemberUpdateAction', 500)
+    }
   },
 })

package/app/Actions/Dashboard/Teams/TeamPeopleIndexAction.ts

@@ -2,6 +2,7 @@ import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
 import { response } from '@stacksjs/router'
+import { teamOperationalError } from '../../Teams/team-response'
 import { invitationStatus, parsePositiveId } from './team-records'
 
 export default new Action({
@@ -15,69 +16,81 @@ export default new Action({
     if (!teamId)
       return response.json({ message: 'Invalid team id.' }, 400)
 
-    const team = await db
-      .selectFrom('teams')
-      .where('id', '=', teamId)
-      .select(['id', 'name'])
-      .executeTakeFirst()
+    let team
+    try {
+      team = await db
+        .selectFrom('teams')
+        .where('id', '=', teamId)
+        .select(['id', 'name'])
+        .executeTakeFirst()
+    }
+    catch (error) {
+      return teamOperationalError(error, 'Team could not be loaded.', 'TeamPeopleIndexAction.team')
+    }
     if (!team)
       return response.json({ message: 'Team not found.' }, 404)
 
-    const members = await (db as any)
-      .selectFrom('team_members')
-      .innerJoin('users', 'users.id', '=', 'team_members.user_id')
-      .where('team_members.team_id', '=', teamId)
-      .select([
-        'team_members.id as id',
-        'team_members.user_id as user_id',
-        'team_members.role as role',
-        'team_members.status as status',
-        'team_members.created_at as created_at',
-        'users.name as name',
-        'users.email as email',
+    try {
+      const [members, invitations] = await Promise.all([
+        (db as any)
+          .selectFrom('team_members')
+          .innerJoin('users', 'users.id', '=', 'team_members.user_id')
+          .where('team_members.team_id', '=', teamId)
+          .select([
+            'team_members.id as id',
+            'team_members.user_id as user_id',
+            'team_members.role as role',
+            'team_members.status as status',
+            'team_members.created_at as created_at',
+            'users.name as name',
+            'users.email as email',
+          ])
+          .orderBy('users.name', 'asc')
+          .execute(),
+        (db as any)
+          .selectFrom('team_invitations')
+          .where('team_id', '=', teamId)
+          .where('status', '=', 'pending')
+          .select([
+            'id',
+            'email',
+            'role',
+            'status',
+            'delivery_status',
+            'expires_at',
+            'created_at',
+          ])
+          .orderBy('created_at', 'desc')
+          .execute(),
       ])
-      .orderBy('users.name', 'asc')
-      .execute()
 
-    const invitations = await (db as any)
-      .selectFrom('team_invitations')
-      .where('team_id', '=', teamId)
-      .where('status', '=', 'pending')
-      .select([
-        'id',
-        'email',
-        'role',
-        'status',
-        'delivery_status',
-        'expires_at',
-        'created_at',
-      ])
-      .orderBy('created_at', 'desc')
-      .execute()
-
-    return {
-      team: {
-        id: Number(team.id),
-        name: String(team.name),
-      },
-      members: members.map((member: any) => ({
-        id: Number(member.id),
-        userId: Number(member.user_id),
-        name: String(member.name || member.email || 'Team member'),
-        email: String(member.email || ''),
-        role: String(member.role || 'member'),
-        status: String(member.status || 'active'),
-        joinedAt: member.created_at ? String(member.created_at) : null,
-      })),
-      invitations: invitations.map((invitation: any) => ({
-        id: Number(invitation.id),
-        email: String(invitation.email),
-        role: String(invitation.role || 'member'),
-        status: invitationStatus(invitation.status, invitation.expires_at),
-        deliveryStatus: String(invitation.delivery_status || 'pending'),
-        expiresAt: String(invitation.expires_at),
-        createdAt: invitation.created_at ? String(invitation.created_at) : null,
-      })),
+      return {
+        team: {
+          id: Number(team.id),
+          name: String(team.name),
+        },
+        members: members.map((member: any) => ({
+          id: Number(member.id),
+          userId: Number(member.user_id),
+          name: String(member.name || member.email || 'Team member'),
+          email: String(member.email || ''),
+          role: String(member.role || 'member'),
+          status: String(member.status || 'active'),
+          joinedAt: member.created_at ? String(member.created_at) : null,
+        })),
+        invitations: invitations.map((invitation: any) => ({
+          id: Number(invitation.id),
+          email: String(invitation.email),
+          role: String(invitation.role || 'member'),
+          status: invitationStatus(invitation.status, invitation.expires_at),
+          deliveryStatus: String(invitation.delivery_status || 'pending'),
+          expiresAt: String(invitation.expires_at),
+          createdAt: invitation.created_at ? String(invitation.created_at) : null,
+        })),
+      }
+    }
+    catch (error) {
+      return teamOperationalError(error, 'Team members and invitations could not be loaded.', 'TeamPeopleIndexAction.people')
     }
   },
 })

package/app/Actions/Dashboard/Teams/team-invitation-delivery.ts

@@ -1,7 +1,8 @@
 import { config } from '@stacksjs/config'
 import { db } from '@stacksjs/database'
 import { sendTeamInvitation } from '../../../Mail/TeamInvitation'
-import { invitationUrl, sqlTimestamp } from './team-records'
+import { teamOperationalIssue } from '../../Teams/team-response'
+import { changedRows, invitationUrl, sqlTimestamp } from './team-records'
 
 interface DeliveryInput {
   id: number
@@ -9,12 +10,22 @@ interface DeliveryInput {
   teamName: string
   role: string
   token: string
+  tokenHash: string
+}
+
+async function recordDeliveryFailure(input: DeliveryInput, message: string): Promise<void> {
+  try {
+    await markTeamInvitationDeliveryFailed(input.id, input.tokenHash, message)
+  }
+  catch (error) {
+    teamOperationalIssue(error, 'Invitation delivery failure could not be recorded.', 'deliverTeamInvitation.failureStatus')
+  }
 }
 
 export async function deliverTeamInvitation(input: DeliveryInput): Promise<void> {
   const baseUrl = String(process.env.APP_URL || config.app.url || '').trim()
   if (!baseUrl) {
-    await markTeamInvitationDeliveryFailed(input.id, 'APP_URL is not configured.')
+    await recordDeliveryFailure(input, 'APP_URL is not configured.')
     throw new Error('APP_URL must be configured before invitations can be delivered.')
   }
 
@@ -26,7 +37,15 @@ export async function deliverTeamInvitation(input: DeliveryInput): Promise<void>
       invitationUrl: invitationUrl(baseUrl, input.token),
       expiresInDays: 7,
     })
-    await (db as any)
+  }
+  catch (error) {
+    const message = teamOperationalIssue(error, 'Email delivery failed.', 'deliverTeamInvitation.provider')
+    await recordDeliveryFailure(input, message)
+    throw error
+  }
+
+  try {
+    const result = await (db as any)
       .updateTable('team_invitations')
       .set({
         delivery_status: 'sent',
@@ -35,16 +54,18 @@ export async function deliverTeamInvitation(input: DeliveryInput): Promise<void>
         updated_at: sqlTimestamp(),
       })
       .where('id', '=', input.id)
-      .execute()
+      .where('token_hash', '=', input.tokenHash)
+      .executeTakeFirst()
+    if (changedRows(result) !== 1)
+      throw new Error('Invitation delivery status changed before it could be recorded.')
   }
   catch (error) {
-    const message = error instanceof Error ? error.message : 'Email delivery failed.'
-    await markTeamInvitationDeliveryFailed(input.id, message)
+    teamOperationalIssue(error, 'Invitation delivery success could not be recorded.', 'deliverTeamInvitation.successStatus')
     throw error
   }
 }
 
-export async function markTeamInvitationDeliveryFailed(id: number, error: string): Promise<void> {
+export async function markTeamInvitationDeliveryFailed(id: number, tokenHash: string, error: string): Promise<void> {
   await (db as any)
     .updateTable('team_invitations')
     .set({
@@ -53,5 +74,6 @@ export async function markTeamInvitationDeliveryFailed(id: number, error: string
       updated_at: sqlTimestamp(),
     })
     .where('id', '=', id)
+    .where('token_hash', '=', tokenHash)
     .execute()
 }

package/app/Actions/Dashboard/Teams/team-member-count.ts

@@ -1,4 +1,4 @@
-import { db } from '@stacksjs/database'
+import { db, sql } from '@stacksjs/database'
 import { sqlTimestamp } from './team-records'
 
 export async function syncTeamMemberCount(teamId: number, connection: typeof db = db): Promise<number> {
@@ -6,9 +6,11 @@ export async function syncTeamMemberCount(teamId: number, connection: typeof db
     .selectFrom('team_members')
     .where('team_id', '=', teamId)
     .where('status', '=', 'active')
-    .select(connection.fn.count('id').as('count'))
+    .select(sql`count(*) as count`)
     .executeTakeFirst()
   const count = Number(row?.count || 0)
+  if (!Number.isSafeInteger(count) || count < 0)
+    throw new TypeError('Team member count must be a non-negative integer.')
 
   await connection
     .updateTable('teams')

package/app/Actions/Dashboard/Teams/team-records.test.ts

@@ -25,6 +25,8 @@ describe('team records', () => {
     expect(changedRows({ changes: 1 })).toBe(1)
     expect(changedRows({ affectedRows: 2 })).toBe(2)
     expect(changedRows([{ numUpdatedRows: 3n }])).toBe(3)
+    expect(changedRows({ numDeletedRows: 4n })).toBe(4)
+    expect(changedRows({ numInsertedRows: 5n })).toBe(5)
     expect(changedRows(null)).toBe(0)
   })
 

package/app/Actions/Dashboard/Teams/team-records.ts

@@ -24,6 +24,8 @@ export function changedRows(result: unknown): number {
     ?? record.affectedRows
     ?? record.numAffectedRows
     ?? record.numUpdatedRows
+    ?? record.numDeletedRows
+    ?? record.numInsertedRows
     ?? 0,
   )
 }

package/app/Actions/Dashboard/dashboard-response.ts

@@ -0,0 +1,16 @@
+import { response } from '@stacksjs/router'
+
+export function dashboardOperationalError(
+  error: unknown,
+  message: string,
+  action: string,
+  status = 503,
+): Response {
+  console.error(`[dashboard/api] ${action} failed:`, error)
+  return response.json({ message }, status)
+}
+
+export function dashboardOperationalIssue(error: unknown, message: string, action: string): string {
+  console.error(`[dashboard/api] ${action} failed:`, error)
+  return message
+}

package/app/Actions/SendWelcomeEmail.ts

@@ -15,7 +15,7 @@ export default new Action({
     const appName = config.app.name || 'our app'
     const url = config.app.url || 'https://localhost:5173'
 
-    await mail.send({
+    await mail.sendOrFail({
       to,
       subject: `Welcome to ${appName}!`,
       text: `