@stacksjs/defaults 0.70.57 → 0.70.59

package/app/Actions/Dashboard/Kanban/CardAssigneesSyncAction.ts

@@ -0,0 +1,103 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+interface SyncInput {
+  userIds?: unknown
+}
+
+/**
+ * `POST /api/dashboard/kanban/cards/:id/assignees` (stacksjs/stacks#1846 Phase 3).
+ *
+ * Replaces the set of users assigned to a card. Sync semantics —
+ * pass the new full list of user ids, the action diffs against
+ * what's currently attached.
+ *
+ * Stamps `assigned_by_user_id` on each new pivot row from the
+ * request's authenticated user (when available) so the card detail
+ * modal can surface "assigned by X" attribution. Unauthenticated
+ * dev-dashboard calls leave it null.
+ *
+ * Cross-validation: each user id must exist. Doesn't validate
+ * board-scoped membership — kanban users aren't (currently) team-
+ * scoped; any platform user can be assigned to any card. Phase 4
+ * could tighten this if board-membership becomes a concept.
+ */
+export default new Action({
+  name: 'Kanban Card Assignees Sync',
+  description: 'Replaces the set of users assigned to a card.',
+  method: 'POST',
+  apiResponse: true,
+  async handle(request) {
+    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
+    const cardId = Number(rawId)
+    if (!Number.isFinite(cardId) || cardId <= 0)
+      return { error: 'Invalid card id', status: 400 }
+
+    const body = (request as any).jsonBody as SyncInput | undefined ?? {}
+    if (!Array.isArray(body.userIds))
+      return { error: '`userIds` must be an array of user ids (possibly empty).', status: 400 }
+
+    const userIds: number[] = []
+    for (const v of body.userIds) {
+      const n = Number(v)
+      if (!Number.isFinite(n) || n <= 0)
+        return { error: '`userIds` contains an invalid id.', status: 400 }
+      userIds.push(n)
+    }
+    const uniqueUserIds = Array.from(new Set(userIds))
+
+    try {
+      const cardRows = await db.unsafe('SELECT id FROM cards WHERE id = ? LIMIT 1', [cardId]).execute() as Array<{ id: number }>
+      if (!cardRows?.length)
+        return { error: 'Card not found.', status: 404 }
+
+      // Validate user ids exist.
+      if (uniqueUserIds.length > 0) {
+        const placeholders = uniqueUserIds.map(() => '?').join(',')
+        const userRows = await db.unsafe(
+          `SELECT id FROM users WHERE id IN (${placeholders})`,
+          uniqueUserIds,
+        ).execute() as Array<{ id: number }>
+        if (userRows.length !== uniqueUserIds.length)
+          return { error: 'One or more user ids do not exist.', status: 400 }
+      }
+
+      const requester = (request as any).user ?? (request as any)._authenticatedUser ?? null
+      const assignedByUserId = requester && typeof requester.id === 'number' ? requester.id : null
+
+      const txOps = async (qb: any) => {
+        await qb.deleteFrom('card_assignees').where('card_id', '=', cardId).execute()
+        if (uniqueUserIds.length > 0) {
+          const rows = uniqueUserIds.map(userId => ({
+            card_id: cardId,
+            user_id: userId,
+            assigned_by_user_id: assignedByUserId,
+          }))
+          await qb.insertInto('card_assignees').values(rows).execute()
+        }
+      }
+      try {
+        await (db as any).transaction(txOps)
+      }
+      catch {
+        await txOps(db)
+      }
+
+      // Return the resolved user rows for the optimistic UI to confirm.
+      let assignees: Array<{ userId: number, name: string | null, email: string | null }> = []
+      if (uniqueUserIds.length > 0) {
+        const placeholders = uniqueUserIds.map(() => '?').join(',')
+        const rows = await db.unsafe(
+          `SELECT id, name, email FROM users WHERE id IN (${placeholders}) ORDER BY name ASC`,
+          uniqueUserIds,
+        ).execute() as Array<{ id: number, name: string | null, email: string | null }>
+        assignees = rows.map(r => ({ userId: r.id, name: r.name, email: r.email }))
+      }
+      return { cardId, assignees }
+    }
+    catch (err) {
+      console.error('[dashboard/kanban] CardAssigneesSyncAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Kanban/CardCommentDestroyAction.ts

@@ -0,0 +1,33 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+/**
+ * `DELETE /api/dashboard/kanban/comments/:id` (stacksjs/stacks#1846 Phase 3).
+ *
+ * Hard-deletes a card comment. No authorship check yet — Phase 4
+ * could add "only the author or an admin can delete" semantics by
+ * looking at `request.user.id` vs the comment's `user_id`. For now
+ * the dashboard's role-gated visibility (only admin+dev see the
+ * surface) is the gate.
+ */
+export default new Action({
+  name: 'Kanban Card Comment Destroy',
+  description: 'Hard-deletes a single card comment.',
+  method: 'DELETE',
+  apiResponse: true,
+  async handle(request) {
+    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
+    const id = Number(rawId)
+    if (!Number.isFinite(id) || id <= 0)
+      return { error: 'Invalid comment id', status: 400 }
+
+    try {
+      await db.deleteFrom('card_comments').where('id', '=', id).execute()
+      return { deleted: true, id }
+    }
+    catch (err) {
+      console.error('[dashboard/kanban] CardCommentDestroyAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Kanban/CardCommentStoreAction.ts

@@ -0,0 +1,82 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+interface CommentInput {
+  body?: unknown
+}
+
+/**
+ * `POST /api/dashboard/kanban/cards/:id/comments` (stacksjs/stacks#1846 Phase 3).
+ *
+ * Appends a comment to a card. Stamps `user_id` from the request's
+ * authenticated user when available; leaves it null on the no-auth
+ * dev dashboard so the surface stays usable locally.
+ *
+ * Returns the inserted row with denormalised author name/email for
+ * the optimistic UI to render without a round-trip back through
+ * `/cards/:id`.
+ */
+export default new Action({
+  name: 'Kanban Card Comment Store',
+  description: 'Adds a comment to a card.',
+  method: 'POST',
+  apiResponse: true,
+  async handle(request) {
+    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
+    const cardId = Number(rawId)
+    if (!Number.isFinite(cardId) || cardId <= 0)
+      return { error: 'Invalid card id', status: 400 }
+
+    const body = (request as any).jsonBody as CommentInput | undefined ?? {}
+    const text = typeof body.body === 'string' ? body.body.trim() : ''
+    if (!text || text.length > 10000)
+      return { error: '`body` is required and must be 1-10000 characters.', status: 400 }
+
+    try {
+      const cardRows = await db.unsafe('SELECT id FROM cards WHERE id = ? LIMIT 1', [cardId]).execute() as Array<{ id: number }>
+      if (!cardRows?.length)
+        return { error: 'Card not found.', status: 404 }
+
+      const user = (request as any).user ?? (request as any)._authenticatedUser ?? null
+      const userId = user && typeof user.id === 'number' ? user.id : null
+
+      await db.insertInto('card_comments').values({
+        card_id: cardId,
+        user_id: userId,
+        body: text,
+      }).execute()
+
+      // Pull the inserted row + author denormalisation. Ordered by id
+      // DESC so the freshest matching row wins.
+      const rows = await db.unsafe(
+        `SELECT cc.id, cc.uuid, cc.user_id, cc.body, cc.created_at, cc.updated_at, u.name, u.email
+        FROM card_comments cc
+        LEFT JOIN users u ON u.id = cc.user_id
+        WHERE cc.card_id = ? AND cc.body = ?
+        ORDER BY cc.id DESC
+        LIMIT 1`,
+        [cardId, text],
+      ).execute() as Array<{ id: number, uuid: string | null, user_id: number | null, body: string, created_at: string | null, updated_at: string | null, name: string | null, email: string | null }>
+      const r = rows?.[0]
+      if (!r)
+        return { error: 'Comment insert succeeded but follow-up read returned nothing.', status: 500 }
+
+      return {
+        comment: {
+          id: r.id,
+          uuid: r.uuid,
+          userId: r.user_id,
+          body: r.body,
+          authorName: r.name,
+          authorEmail: r.email,
+          createdAt: r.created_at,
+          updatedAt: r.updated_at,
+        },
+      }
+    }
+    catch (err) {
+      console.error('[dashboard/kanban] CardCommentStoreAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Kanban/CardDestroyAction.ts

@@ -0,0 +1,48 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+/**
+ * `DELETE /api/dashboard/kanban/cards/:id` (stacksjs/stacks#1846 Phase 2).
+ *
+ * Hard-deletes a card and clears its pivot rows in `card_labels` /
+ * `card_assignees`. The columns and board are untouched — only the
+ * single card row + its pivot dependencies go.
+ *
+ * Soft-archive (the more common ask) is a PATCH with
+ * `{ archived: true }` — the card stays in the DB but drops out of
+ * the board view. This action is the hard delete.
+ */
+export default new Action({
+  name: 'Kanban Card Destroy',
+  description: 'Hard-deletes a card and its pivot rows.',
+  method: 'DELETE',
+  apiResponse: true,
+  async handle(request) {
+    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
+    const id = Number(rawId)
+    if (!Number.isFinite(id) || id <= 0) {
+      return { error: 'Invalid card id', status: 400 }
+    }
+
+    try {
+      const txOps = async (qb: any) => {
+        await qb.deleteFrom('card_labels').where('card_id', '=', id).execute()
+        await qb.deleteFrom('card_assignees').where('card_id', '=', id).execute()
+        // Card comments (Phase 3, stacksjs/stacks#1846).
+        await qb.deleteFrom('card_comments').where('card_id', '=', id).execute()
+        await qb.deleteFrom('cards').where('id', '=', id).execute()
+      }
+      try {
+        await (db as any).transaction(txOps)
+      }
+      catch {
+        await txOps(db)
+      }
+      return { deleted: true, id }
+    }
+    catch (err) {
+      console.error('[dashboard/kanban] CardDestroyAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Kanban/CardLabelsSyncAction.ts

@@ -0,0 +1,103 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+interface SyncInput {
+  labelIds?: unknown
+}
+
+/**
+ * `POST /api/dashboard/kanban/cards/:id/labels` (stacksjs/stacks#1846 Phase 3).
+ *
+ * Replaces the set of labels attached to a card. Sync semantics —
+ * pass the new full list of label ids, the action diffs against
+ * what's currently attached and attaches/detaches to match.
+ *
+ * Cross-validation: every label in `labelIds` must belong to the
+ * same board as the card. Stops a malformed page from cross-
+ * contaminating two boards' label namespaces.
+ *
+ * Wrapped in a transaction so a partial failure leaves the card
+ * with either the old set or the new set, never something in
+ * between.
+ */
+export default new Action({
+  name: 'Kanban Card Labels Sync',
+  description: 'Replaces the set of labels attached to a card.',
+  method: 'POST',
+  apiResponse: true,
+  async handle(request) {
+    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
+    const cardId = Number(rawId)
+    if (!Number.isFinite(cardId) || cardId <= 0)
+      return { error: 'Invalid card id', status: 400 }
+
+    const body = (request as any).jsonBody as SyncInput | undefined ?? {}
+    if (!Array.isArray(body.labelIds))
+      return { error: '`labelIds` must be an array of label ids (possibly empty).', status: 400 }
+
+    const labelIds: number[] = []
+    for (const v of body.labelIds) {
+      const n = Number(v)
+      if (!Number.isFinite(n) || n <= 0)
+        return { error: '`labelIds` contains an invalid id.', status: 400 }
+      labelIds.push(n)
+    }
+    const uniqueLabelIds = Array.from(new Set(labelIds))
+
+    try {
+      // Resolve the card → board so we can validate label scope.
+      const cardRows = await db.unsafe(
+        'SELECT id, board_id FROM cards WHERE id = ? LIMIT 1',
+        [cardId],
+      ).execute() as Array<{ id: number, board_id: number }>
+      const card = cardRows?.[0]
+      if (!card)
+        return { error: 'Card not found.', status: 404 }
+
+      // Every label must belong to the same board (labels are
+      // board-scoped per Phase 1's `labels.board_id` design).
+      if (uniqueLabelIds.length > 0) {
+        const placeholders = uniqueLabelIds.map(() => '?').join(',')
+        const labelRows = await db.unsafe(
+          `SELECT id FROM labels WHERE id IN (${placeholders}) AND board_id = ?`,
+          [...uniqueLabelIds, card.board_id],
+        ).execute() as Array<{ id: number }>
+        if (labelRows.length !== uniqueLabelIds.length)
+          return { error: 'One or more label ids do not belong to this card\'s board.', status: 400 }
+      }
+
+      // Sync: drop all current pivot rows for this card, insert the
+      // new set. Cheaper than diffing for the typical "user picked a
+      // few labels" use case (single-digit label counts per card).
+      const txOps = async (qb: any) => {
+        await qb.deleteFrom('card_labels').where('card_id', '=', cardId).execute()
+        if (uniqueLabelIds.length > 0) {
+          const rows = uniqueLabelIds.map(labelId => ({ card_id: cardId, label_id: labelId }))
+          await qb.insertInto('card_labels').values(rows).execute()
+        }
+      }
+      try {
+        await (db as any).transaction(txOps)
+      }
+      catch {
+        await txOps(db)
+      }
+
+      // Return the resolved label rows so the optimistic UI can
+      // confirm its in-flight state matches what the server stored.
+      let labels: Array<{ id: number, name: string, color: string }> = []
+      if (uniqueLabelIds.length > 0) {
+        const placeholders = uniqueLabelIds.map(() => '?').join(',')
+        labels = await db.unsafe(
+          `SELECT id, name, color FROM labels WHERE id IN (${placeholders}) ORDER BY name ASC`,
+          uniqueLabelIds,
+        ).execute() as Array<{ id: number, name: string, color: string }>
+      }
+      return { cardId, labels }
+    }
+    catch (err) {
+      console.error('[dashboard/kanban] CardLabelsSyncAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Kanban/CardShowAction.ts

@@ -0,0 +1,122 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+interface CardRow {
+  id: number
+  uuid: string | null
+  column_id: number
+  board_id: number
+  title: string
+  description: string | null
+  position: number
+  created_by_user_id: number | null
+  due_date: string | null
+  archived: number
+  created_at: string | null
+  updated_at: string | null
+}
+
+/**
+ * `GET /api/dashboard/kanban/cards/:id` (stacksjs/stacks#1846 Phase 3).
+ *
+ * Fetches a single card with everything the detail modal needs in one
+ * round-trip: labels, assignees, comments. The board view's cards
+ * already carry labels + assignees (BoardShowAction batches the
+ * pivots) — this endpoint is for the case where the user lands
+ * directly on a card URL or refreshes mid-modal.
+ *
+ * Three queries via `Promise.all`:
+ *   1. The card itself.
+ *   2. Labels via the card_labels pivot (with the label row).
+ *   3. Assignees via the card_assignees pivot (with user.name/email).
+ *   4. Comments (denormalised user name/email for display).
+ */
+export default new Action({
+  name: 'Kanban Card Show',
+  description: 'Returns a single card with its labels, assignees, and comments thread.',
+  method: 'GET',
+  apiResponse: true,
+  async handle(request) {
+    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
+    const id = Number(rawId)
+    if (!Number.isFinite(id) || id <= 0) {
+      return { error: 'Invalid card id', status: 400 }
+    }
+
+    try {
+      const cardRows = await db.unsafe(
+        'SELECT * FROM cards WHERE id = ? LIMIT 1',
+        [id],
+      ).execute() as CardRow[]
+      const card = cardRows?.[0]
+      if (!card) {
+        return { error: 'Card not found', status: 404 }
+      }
+
+      const [labels, assignees, comments] = await Promise.all([
+        db.unsafe(
+          `SELECT l.id, l.name, l.color
+          FROM card_labels cl
+          JOIN labels l ON l.id = cl.label_id
+          WHERE cl.card_id = ?
+          ORDER BY l.name ASC`,
+          [id],
+        ).execute() as Promise<Array<{ id: number, name: string, color: string }>>,
+        db.unsafe(
+          `SELECT ca.user_id, ca.assigned_by_user_id, ca.created_at, u.name, u.email
+          FROM card_assignees ca
+          LEFT JOIN users u ON u.id = ca.user_id
+          WHERE ca.card_id = ?`,
+          [id],
+        ).execute() as Promise<Array<{ user_id: number, assigned_by_user_id: number | null, created_at: string | null, name: string | null, email: string | null }>>,
+        db.unsafe(
+          `SELECT cc.id, cc.uuid, cc.user_id, cc.body, cc.created_at, cc.updated_at, u.name, u.email
+          FROM card_comments cc
+          LEFT JOIN users u ON u.id = cc.user_id
+          WHERE cc.card_id = ?
+          ORDER BY cc.created_at ASC, cc.id ASC`,
+          [id],
+        ).execute() as Promise<Array<{ id: number, uuid: string | null, user_id: number | null, body: string, created_at: string | null, updated_at: string | null, name: string | null, email: string | null }>>,
+      ])
+
+      return {
+        card: {
+          id: card.id,
+          uuid: card.uuid,
+          columnId: card.column_id,
+          boardId: card.board_id,
+          title: card.title,
+          description: card.description,
+          position: card.position,
+          createdByUserId: card.created_by_user_id,
+          dueDate: card.due_date,
+          archived: card.archived === 1,
+          createdAt: card.created_at,
+          updatedAt: card.updated_at,
+        },
+        labels: (labels ?? []).map(l => ({ id: l.id, name: l.name, color: l.color })),
+        assignees: (assignees ?? []).map(a => ({
+          userId: a.user_id,
+          name: a.name,
+          email: a.email,
+          assignedByUserId: a.assigned_by_user_id,
+          assignedAt: a.created_at,
+        })),
+        comments: (comments ?? []).map(c => ({
+          id: c.id,
+          uuid: c.uuid,
+          userId: c.user_id,
+          body: c.body,
+          authorName: c.name,
+          authorEmail: c.email,
+          createdAt: c.created_at,
+          updatedAt: c.updated_at,
+        })),
+      }
+    }
+    catch (err) {
+      console.error('[dashboard/kanban] CardShowAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Kanban/CardStoreAction.ts

@@ -0,0 +1,112 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+interface CardInput {
+  columnId?: unknown
+  title?: unknown
+  description?: unknown
+  dueDate?: unknown
+}
+
+/**
+ * `POST /api/dashboard/kanban/cards` (stacksjs/stacks#1846 Phase 2).
+ *
+ * Creates a card at the end of the target column. `boardId` is
+ * resolved server-side from `column.board_id` (denormalised onto the
+ * card row) so clients don't pass it in — passing it from the page
+ * would invite drift if the column was moved between boards (which
+ * isn't a feature, but still).
+ *
+ * Stamps `created_by_user_id` from `request.user` when the request is
+ * authenticated; leaves it null for the no-auth dev dashboard so the
+ * surface still works on localhost.
+ */
+export default new Action({
+  name: 'Kanban Card Store',
+  description: 'Creates a new card in a column.',
+  method: 'POST',
+  apiResponse: true,
+  async handle(request) {
+    const body = (request as any).jsonBody as CardInput | undefined ?? {}
+
+    const columnId = Number(body.columnId)
+    if (!Number.isFinite(columnId) || columnId <= 0) {
+      return { error: '`columnId` is required and must be a positive integer.', status: 400 }
+    }
+    const title = typeof body.title === 'string' ? body.title.trim() : ''
+    if (!title || title.length > 300) {
+      return { error: '`title` is required and must be 1-300 characters.', status: 400 }
+    }
+    const description = typeof body.description === 'string' ? body.description.trim() : null
+    const dueDate = typeof body.dueDate === 'string' && body.dueDate ? body.dueDate : null
+
+    try {
+      // Resolve the column → board_id so we can denormalise. Same trip
+      // also validates that the column exists; an orphan column id
+      // rejects up front rather than inserting a card with a dangling
+      // FK that no query would ever surface.
+      const cols = await db.unsafe(
+        'SELECT id, board_id FROM board_columns WHERE id = ? LIMIT 1',
+        [columnId],
+      ).execute() as Array<{ id: number, board_id: number }>
+      const col = cols?.[0]
+      if (!col) {
+        return { error: 'Column not found.', status: 404 }
+      }
+
+      const maxRow = await db.unsafe(
+        'SELECT COALESCE(MAX(position), -1) AS m FROM cards WHERE column_id = ?',
+        [columnId],
+      ).execute() as Array<{ m: number }>
+      const nextPosition = (Number(maxRow?.[0]?.m ?? -1) + 1) || 0
+
+      const user = (request as any).user ?? (request as any)._authenticatedUser ?? null
+      const createdByUserId = user && typeof user.id === 'number' ? user.id : null
+
+      await db.insertInto('cards').values({
+        column_id: columnId,
+        board_id: col.board_id,
+        title,
+        description,
+        position: nextPosition,
+        created_by_user_id: createdByUserId,
+        due_date: dueDate,
+        archived: 0,
+      }).execute()
+
+      const rows = await db.unsafe(
+        `SELECT id, uuid, column_id, board_id, title, description, position,
+                created_by_user_id, due_date, archived, created_at, updated_at
+        FROM cards
+        WHERE column_id = ? AND title = ? AND position = ?
+        ORDER BY id DESC LIMIT 1`,
+        [columnId, title, nextPosition],
+      ).execute() as Array<Record<string, unknown>>
+      const r = rows?.[0]
+      if (!r) {
+        return { error: 'Card insert succeeded but follow-up read returned nothing.', status: 500 }
+      }
+
+      return {
+        card: {
+          id: Number(r.id),
+          uuid: r.uuid == null ? null : String(r.uuid),
+          columnId: Number(r.column_id),
+          boardId: Number(r.board_id),
+          title: String(r.title),
+          description: r.description == null ? null : String(r.description),
+          position: Number(r.position),
+          createdByUserId: r.created_by_user_id == null ? null : Number(r.created_by_user_id),
+          dueDate: r.due_date == null ? null : String(r.due_date),
+          archived: Number(r.archived) === 1,
+          createdAt: r.created_at == null ? null : String(r.created_at),
+          updatedAt: r.updated_at == null ? null : String(r.updated_at),
+        },
+      }
+    }
+    catch (err) {
+      console.error('[dashboard/kanban] CardStoreAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})