@stacksjs/defaults 0.70.58 → 0.70.59

package/app/Actions/Dashboard/Kanban/BoardDestroyAction.ts

@@ -0,0 +1,84 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+/**
+ * `DELETE /api/dashboard/kanban/boards/:id` (stacksjs/stacks#1846 Phase 2).
+ *
+ * Hard delete with cascade: removes the board, its columns, its cards,
+ * its labels, and the relevant pivot rows in `card_labels` and
+ * `card_assignees`. No DB-level FK cascade to lean on — the existing
+ * Stacks migration convention is app-layer integrity, so the cascade
+ * lives in this action.
+ *
+ * Order matters: pivots first (they reference card_id), then cards,
+ * then columns, then labels, then the board itself. Reverse-of-FK
+ * order so no statement runs against rows that still have referents.
+ *
+ * Soft-archive is a different operation — call PATCH with
+ * `{ archived: true }`. This action is the hard delete; data is gone.
+ */
+export default new Action({
+  name: 'Kanban Board Destroy',
+  description: 'Hard-deletes a board and all of its columns, cards, labels, and pivot rows.',
+  method: 'DELETE',
+  apiResponse: true,
+  async handle(request) {
+    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
+    const id = Number(rawId)
+    if (!Number.isFinite(id) || id <= 0) {
+      return { error: 'Invalid board id', status: 400 }
+    }
+
+    try {
+      // Wrap in a transaction so partial failures roll back. If the
+      // active dialect doesn't support transactions through
+      // `db.transaction` (some shapes pass through to the underlying
+      // bun-query-builder which has driver-specific implementations),
+      // fall through to a best-effort sequential delete — the deletes
+      // are idempotent, so re-running the same DELETE on the same id
+      // is safe.
+      const txOps = async (qb: any) => {
+        // Pivots + card-scoped children first — they reference cards.
+        await qb.unsafe(
+          'DELETE FROM card_labels WHERE card_id IN (SELECT id FROM cards WHERE board_id = ?)',
+          [id],
+        ).execute()
+        await qb.unsafe(
+          'DELETE FROM card_assignees WHERE card_id IN (SELECT id FROM cards WHERE board_id = ?)',
+          [id],
+        ).execute()
+        // Card comments (Phase 3, migration 0000000112). Same
+        // card-scoped pattern as the pivots.
+        await qb.unsafe(
+          'DELETE FROM card_comments WHERE card_id IN (SELECT id FROM cards WHERE board_id = ?)',
+          [id],
+        ).execute()
+        // Cards (denormalised board_id avoids the column join).
+        await qb.deleteFrom('cards').where('board_id', '=', id).execute()
+        // Columns + labels — both directly reference board_id.
+        await qb.deleteFrom('board_columns').where('board_id', '=', id).execute()
+        await qb.deleteFrom('labels').where('board_id', '=', id).execute()
+        // Finally the board itself.
+        await qb.deleteFrom('boards').where('id', '=', id).execute()
+      }
+
+      try {
+        await (db as any).transaction(txOps)
+      }
+      catch (txErr) {
+        // Transaction unavailable or driver-specific shape failed —
+        // run sequentially. If this fails mid-way the next call to
+        // the same action will pick up where the previous one left
+        // off (all deletes are idempotent).
+        console.warn('[dashboard/kanban] BoardDestroyAction transaction unavailable, falling back to sequential:', txErr)
+        await txOps(db)
+      }
+
+      return { deleted: true, id }
+    }
+    catch (err) {
+      console.error('[dashboard/kanban] BoardDestroyAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Kanban/BoardShowAction.ts

@@ -0,0 +1,215 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+interface BoardRow {
+  id: number
+  uuid: string | null
+  name: string
+  description: string | null
+  icon: string
+  color: string
+  position: number
+  archived: number
+  created_at: string | null
+  updated_at: string | null
+}
+
+interface ColumnRow {
+  id: number
+  uuid: string | null
+  board_id: number
+  name: string
+  position: number
+  card_limit: number | null
+  color: string
+  created_at: string | null
+  updated_at: string | null
+}
+
+interface CardRow {
+  id: number
+  uuid: string | null
+  column_id: number
+  board_id: number
+  title: string
+  description: string | null
+  position: number
+  created_by_user_id: number | null
+  due_date: string | null
+  archived: number
+  created_at: string | null
+  updated_at: string | null
+}
+
+interface LabelRow {
+  id: number
+  board_id: number
+  name: string
+  color: string
+}
+
+/**
+ * `GET /api/dashboard/kanban/boards/:id`
+ *
+ * Returns a single board with its columns + cards + label palette
+ * nested in render order. Powers the kanban board page
+ * (`/kanban/[id]`) — Phase 2 hits this on mount, the drag handler
+ * then mutates positions via the (Phase 2) reorder endpoint and
+ * relies on optimistic updates for snappy UX.
+ *
+ * Query layout (3 queries, all indexed):
+ *   1. Single-row board lookup by id.
+ *   2. All columns for the board (ordered by `position`).
+ *   3. All non-archived cards for the board (ordered by
+ *      `column_id, position`).
+ *   4. All labels for the board.
+ *
+ * Card-label pivot reads land in Phase 3 alongside the card detail
+ * modal — the board view shows label chips inline, hydrated from a
+ * single pivot query batched with the card fetch.
+ */
+export default new Action({
+  name: 'Kanban Board Show',
+  description: 'Returns a single kanban board with its columns + cards + label palette.',
+  method: 'GET',
+  apiResponse: true,
+  async handle(request) {
+    // Route param resolution: bun-router exposes `:id` via
+    // `request.param('id')` / `request.params.id`. Both shapes appear
+    // in this codebase depending on how the route was registered;
+    // covering both keeps the action portable.
+    const rawId = (request as any)?.params?.id
+      ?? (request as any)?.param?.('id')
+      ?? null
+    const id = Number(rawId)
+    if (!Number.isFinite(id) || id <= 0) {
+      return { error: 'Invalid board id', status: 400 }
+    }
+
+    try {
+      const boards = await db.unsafe(
+        'SELECT * FROM boards WHERE id = ? LIMIT 1',
+        [id],
+      ).execute() as BoardRow[]
+      const board = boards[0]
+      if (!board) {
+        return { error: 'Board not found', status: 404 }
+      }
+
+      const [columns, cards, labels] = await Promise.all([
+        db.unsafe(
+          'SELECT * FROM board_columns WHERE board_id = ? ORDER BY position ASC, id ASC',
+          [id],
+        ).execute() as Promise<ColumnRow[]>,
+        db.unsafe(
+          'SELECT * FROM cards WHERE board_id = ? AND archived = 0 ORDER BY column_id ASC, position ASC, id ASC',
+          [id],
+        ).execute() as Promise<CardRow[]>,
+        db.unsafe(
+          'SELECT id, board_id, name, color FROM labels WHERE board_id = ? ORDER BY name ASC',
+          [id],
+        ).execute() as Promise<LabelRow[]>,
+      ])
+
+      // Pivot lookups for label + assignee chips on card previews
+      // (stacksjs/stacks#1846 Phase 3). Two batched JOINs keyed off the
+      // board's card list — single round-trip per pivot, then group
+      // client-side into `cardId → list` maps.
+      const [cardLabelRows, cardAssigneeRows] = await Promise.all([
+        db.unsafe(
+          `SELECT cl.card_id, l.id, l.name, l.color
+          FROM card_labels cl
+          JOIN labels l ON l.id = cl.label_id
+          WHERE cl.card_id IN (SELECT id FROM cards WHERE board_id = ? AND archived = 0)
+          ORDER BY l.name ASC`,
+          [id],
+        ).execute() as Promise<Array<{ card_id: number, id: number, name: string, color: string }>>,
+        db.unsafe(
+          `SELECT ca.card_id, ca.user_id, u.name, u.email
+          FROM card_assignees ca
+          LEFT JOIN users u ON u.id = ca.user_id
+          WHERE ca.card_id IN (SELECT id FROM cards WHERE board_id = ? AND archived = 0)`,
+          [id],
+        ).execute() as Promise<Array<{ card_id: number, user_id: number, name: string | null, email: string | null }>>,
+      ])
+
+      const labelsByCard = new Map<number, Array<{ id: number, name: string, color: string }>>()
+      for (const r of cardLabelRows ?? []) {
+        const list = labelsByCard.get(r.card_id) ?? []
+        list.push({ id: r.id, name: r.name, color: r.color })
+        labelsByCard.set(r.card_id, list)
+      }
+      const assigneesByCard = new Map<number, Array<{ userId: number, name: string | null, email: string | null }>>()
+      for (const r of cardAssigneeRows ?? []) {
+        const list = assigneesByCard.get(r.card_id) ?? []
+        list.push({ userId: r.user_id, name: r.name, email: r.email })
+        assigneesByCard.set(r.card_id, list)
+      }
+
+      // Group cards by column id so the page renders columns directly
+      // from `columns[].cards` without doing the grouping client-side.
+      // Empty columns get an empty array, not undefined.
+      const cardsByColumn = new Map<number, CardRow[]>()
+      for (const c of cards ?? []) {
+        const list = cardsByColumn.get(c.column_id) ?? []
+        list.push(c)
+        cardsByColumn.set(c.column_id, list)
+      }
+
+      const responseColumns = (columns ?? []).map(col => ({
+        id: col.id,
+        uuid: col.uuid,
+        boardId: col.board_id,
+        name: col.name,
+        position: col.position,
+        cardLimit: col.card_limit,
+        color: col.color,
+        cards: (cardsByColumn.get(col.id) ?? []).map(c => ({
+          id: c.id,
+          uuid: c.uuid,
+          columnId: c.column_id,
+          boardId: c.board_id,
+          title: c.title,
+          description: c.description,
+          position: c.position,
+          createdByUserId: c.created_by_user_id,
+          dueDate: c.due_date,
+          archived: c.archived === 1,
+          createdAt: c.created_at,
+          updatedAt: c.updated_at,
+          labels: labelsByCard.get(c.id) ?? [],
+          assignees: assigneesByCard.get(c.id) ?? [],
+        })),
+      }))
+
+      return {
+        board: {
+          id: board.id,
+          uuid: board.uuid,
+          name: board.name,
+          description: board.description,
+          icon: board.icon,
+          color: board.color,
+          position: board.position,
+          archived: board.archived === 1,
+          createdAt: board.created_at,
+          updatedAt: board.updated_at,
+        },
+        columns: responseColumns,
+        labels: (labels ?? []).map(l => ({
+          id: l.id,
+          boardId: l.board_id,
+          name: l.name,
+          color: l.color,
+        })),
+      }
+    }
+    catch (err) {
+      console.error('[dashboard/kanban] BoardShowAction failed:', err)
+      return {
+        error: err instanceof Error ? err.message : 'unknown error',
+        status: 500,
+      }
+    }
+  },
+})

package/app/Actions/Dashboard/Kanban/BoardStoreAction.ts

@@ -0,0 +1,98 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+interface BoardInput {
+  name?: unknown
+  description?: unknown
+  icon?: unknown
+  color?: unknown
+}
+
+/**
+ * `POST /api/dashboard/kanban/boards` (stacksjs/stacks#1846 Phase 2).
+ *
+ * Creates a new board with sensible defaults and appends it to the
+ * end of the boards list (`position = max(position) + 1` so the new
+ * row shows up last in the index). Returns the inserted row including
+ * its id so the optimistic-insert in the dashboard store can swap its
+ * temp placeholder for the real record.
+ *
+ * Validation: title required + length-bounded; everything else is
+ * optional with model-level defaults. The validation rules on the
+ * `Board` model define the canonical contract; this action mirrors
+ * the must-have subset so a malformed body doesn't reach `db`.
+ */
+export default new Action({
+  name: 'Kanban Board Store',
+  description: 'Creates a new kanban board.',
+  method: 'POST',
+  apiResponse: true,
+  async handle(request) {
+    const body = (request as any).jsonBody as BoardInput | undefined ?? {}
+
+    const name = typeof body.name === 'string' ? body.name.trim() : ''
+    if (!name || name.length > 120) {
+      return { error: 'Name is required and must be 1-120 characters.', status: 400 }
+    }
+    const description = typeof body.description === 'string' ? body.description.trim() : null
+    const icon = typeof body.icon === 'string' && body.icon ? body.icon : 'rectangle.stack.fill'
+    const color = typeof body.color === 'string' && body.color ? body.color : 'violet'
+
+    try {
+      // Position assignment: append at the end of the boards list.
+      // Concurrent inserts could pick the same `position` (race between
+      // the SELECT max() and the INSERT), but it's harmless — `position`
+      // is a sort hint, not a unique key. Reorder via /boards/reorder
+      // restores tight ordering when the user cares.
+      const maxRow = await db.unsafe(
+        'SELECT COALESCE(MAX(position), -1) AS m FROM boards WHERE archived = 0',
+      ).execute() as Array<{ m: number }>
+      const nextPosition = (Number(maxRow?.[0]?.m ?? -1) + 1) || 0
+
+      await db.insertInto('boards').values({
+        name,
+        description,
+        icon,
+        color,
+        position: nextPosition,
+        archived: 0,
+      }).execute()
+
+      // SELECT the inserted row back. MySQL doesn't support RETURNING,
+      // so we use the (name, position) pair as a best-effort identifier
+      // — append-only with a unique position keeps this reliable.
+      const inserted = await db.unsafe(
+        `SELECT id, uuid, name, description, icon, color, position, archived, created_at, updated_at
+        FROM boards
+        WHERE name = ? AND position = ?
+        ORDER BY id DESC
+        LIMIT 1`,
+        [name, nextPosition],
+      ).execute() as Array<{ id: number, uuid: string | null, name: string, description: string | null, icon: string, color: string, position: number, archived: number, created_at: string | null, updated_at: string | null }>
+      const row = inserted?.[0]
+      if (!row) {
+        return { error: 'Board insert succeeded but follow-up read returned nothing.', status: 500 }
+      }
+
+      return {
+        board: {
+          id: row.id,
+          uuid: row.uuid,
+          name: row.name,
+          description: row.description,
+          icon: row.icon,
+          color: row.color,
+          position: row.position,
+          archived: row.archived === 1,
+          cardCount: 0,
+          createdAt: row.created_at,
+          updatedAt: row.updated_at,
+        },
+      }
+    }
+    catch (err) {
+      console.error('[dashboard/kanban] BoardStoreAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Kanban/BoardUpdateAction.ts

@@ -0,0 +1,96 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+interface BoardInput {
+  name?: unknown
+  description?: unknown
+  icon?: unknown
+  color?: unknown
+  archived?: unknown
+}
+
+/**
+ * `PATCH /api/dashboard/kanban/boards/:id` (stacksjs/stacks#1846 Phase 2).
+ *
+ * Partial update — only the fields present in the body are written.
+ * Omitting `archived` does NOT change the archive flag; passing
+ * `archived: true` soft-archives the board (it drops out of the
+ * /boards index but stays queryable at `/boards/:id`).
+ *
+ * `position` is intentionally NOT updatable here — bulk reordering
+ * goes through `/boards/reorder` so the page can rewrite multiple
+ * rows in one round-trip and avoid the gaps that single-row updates
+ * leave behind. Position-via-PATCH would invite the "drag a card,
+ * then the sibling row's position is wrong" footgun.
+ */
+export default new Action({
+  name: 'Kanban Board Update',
+  description: 'Partial update of a kanban board.',
+  method: 'PATCH',
+  apiResponse: true,
+  async handle(request) {
+    const rawId = (request as any)?.params?.id ?? (request as any)?.param?.('id') ?? null
+    const id = Number(rawId)
+    if (!Number.isFinite(id) || id <= 0) {
+      return { error: 'Invalid board id', status: 400 }
+    }
+
+    const body = (request as any).jsonBody as BoardInput | undefined ?? {}
+    const set: Record<string, unknown> = {}
+
+    if (typeof body.name === 'string') {
+      const name = body.name.trim()
+      if (!name || name.length > 120) {
+        return { error: 'Name must be 1-120 characters.', status: 400 }
+      }
+      set.name = name
+    }
+    if (typeof body.description === 'string' || body.description === null) {
+      set.description = typeof body.description === 'string' ? body.description.trim() : null
+    }
+    if (typeof body.icon === 'string' && body.icon)
+      set.icon = body.icon
+    if (typeof body.color === 'string' && body.color)
+      set.color = body.color
+    if (typeof body.archived === 'boolean')
+      set.archived = body.archived ? 1 : 0
+
+    if (Object.keys(set).length === 0) {
+      return { error: 'No updatable fields provided.', status: 400 }
+    }
+
+    try {
+      // The `db.updateTable` chain works across dialects; we accumulate
+      // the partial set above and apply it in one statement.
+      await db.updateTable('boards').set(set as any).where('id', '=', id).execute()
+
+      const rows = await db.unsafe(
+        `SELECT id, uuid, name, description, icon, color, position, archived, created_at, updated_at
+        FROM boards WHERE id = ? LIMIT 1`,
+        [id],
+      ).execute() as Array<Record<string, unknown>>
+      const r = rows?.[0]
+      if (!r) {
+        return { error: 'Board not found', status: 404 }
+      }
+      return {
+        board: {
+          id: Number(r.id),
+          uuid: r.uuid == null ? null : String(r.uuid),
+          name: String(r.name),
+          description: r.description == null ? null : String(r.description),
+          icon: String(r.icon),
+          color: String(r.color),
+          position: Number(r.position),
+          archived: Number(r.archived) === 1,
+          createdAt: r.created_at == null ? null : String(r.created_at),
+          updatedAt: r.updated_at == null ? null : String(r.updated_at),
+        },
+      }
+    }
+    catch (err) {
+      console.error('[dashboard/kanban] BoardUpdateAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Kanban/BoardsIndexAction.ts

@@ -0,0 +1,81 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+interface BoardRow {
+  id: number
+  uuid: string | null
+  name: string
+  description: string | null
+  icon: string
+  color: string
+  position: number
+  archived: number
+  created_at: string | null
+  updated_at: string | null
+  card_count?: number
+}
+
+/**
+ * `GET /api/dashboard/kanban/boards`
+ *
+ * Lists every non-archived board with a fast card-count sub-query so
+ * the index page can show "5 cards" badges without a second round-trip
+ * per board. Cards table is joined in aggregate, not row-by-row, so
+ * the response stays single-query (N+1 free).
+ *
+ * Auth: gated by the `auth` + `role:admin,dev` middleware on the route
+ * group (boards are a dev-mode surface per #1843). The action body
+ * doesn't re-check the role; the middleware did.
+ *
+ * Phase 1 — read-only. Phase 2 lands store / update / destroy + the
+ * reorder endpoint that moves a board's position.
+ */
+export default new Action({
+  name: 'Kanban Boards Index',
+  description: 'Lists kanban boards with per-board card counts for the dashboard index page.',
+  method: 'GET',
+  apiResponse: true,
+  async handle() {
+    try {
+      // The card_count is computed via a correlated sub-select rather
+      // than a JOIN + GROUP BY so the row shape stays flat. Empty
+      // boards return `card_count: 0` instead of being dropped (which
+      // is what an inner join + group-by would do).
+      const rows = await db.unsafe(`
+        SELECT
+          b.id, b.uuid, b.name, b.description, b.icon, b.color,
+          b.position, b.archived, b.created_at, b.updated_at,
+          (SELECT COUNT(*) FROM cards c WHERE c.board_id = b.id AND c.archived = 0) AS card_count
+        FROM boards b
+        WHERE b.archived = 0
+        ORDER BY b.position ASC, b.id ASC
+      `).execute() as BoardRow[]
+
+      const boards = (rows ?? []).map(r => ({
+        id: r.id,
+        uuid: r.uuid,
+        name: r.name,
+        description: r.description,
+        icon: r.icon,
+        color: r.color,
+        position: r.position,
+        archived: r.archived === 1,
+        cardCount: Number(r.card_count ?? 0),
+        createdAt: r.created_at,
+        updatedAt: r.updated_at,
+      }))
+
+      return { boards }
+    }
+    catch (err) {
+      console.error('[dashboard/kanban] BoardsIndexAction failed:', err)
+      // Soft-error shape — page renders an empty-state with the
+      // message instead of bubbling a 500. Missing `boards` table
+      // (migrations not run) ends up here on a fresh project.
+      return {
+        boards: [],
+        error: err instanceof Error ? err.message : 'unknown error',
+      }
+    }
+  },
+})

package/app/Actions/Dashboard/Kanban/BoardsReorderAction.ts

@@ -0,0 +1,80 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+interface ReorderInput {
+  /**
+   * Ordered list of board ids in their new display order. Array index
+   * becomes the row's new `position`. Clients sending a partial list
+   * (e.g. only the moved id) will leave other boards' positions
+   * untouched — the canonical "after a drag, send the full visible
+   * list" semantics avoids drift.
+   */
+  order?: unknown
+}
+
+/**
+ * `POST /api/dashboard/kanban/boards/reorder` (stacksjs/stacks#1846 Phase 2).
+ *
+ * Rewrites the `position` column on every board in the submitted list
+ * to match its index. Wrapped in a transaction so a partial failure
+ * doesn't leave the boards index half-renumbered.
+ *
+ * Why not PATCH each board's position one-at-a-time? Two reasons:
+ *   1. N round-trips become 1 — the page already knows the new order
+ *      when the drag ends, so we shouldn't pretend it's N independent
+ *      operations.
+ *   2. Atomicity. Mid-flight UI state where some boards have the new
+ *      position and some don't shows up as out-of-order rendering on
+ *      the next paint.
+ */
+export default new Action({
+  name: 'Kanban Boards Reorder',
+  description: 'Bulk-rewrite `position` on a list of boards to match the submitted order.',
+  method: 'POST',
+  apiResponse: true,
+  async handle(request) {
+    const body = (request as any).jsonBody as ReorderInput | undefined ?? {}
+    if (!Array.isArray(body.order) || body.order.length === 0) {
+      return { error: '`order` must be a non-empty array of board ids.', status: 400 }
+    }
+    const ids: number[] = []
+    for (const v of body.order) {
+      const n = Number(v)
+      if (!Number.isFinite(n) || n <= 0) {
+        return { error: '`order` contains an invalid id.', status: 400 }
+      }
+      ids.push(n)
+    }
+    // Reject duplicates — they'd cause the same row to be written
+    // multiple times with the LAST index winning, which silently
+    // contradicts the visible order.
+    if (new Set(ids).size !== ids.length) {
+      return { error: '`order` contains duplicate ids.', status: 400 }
+    }
+
+    try {
+      const txOps = async (qb: any) => {
+        for (let i = 0; i < ids.length; i++) {
+          await qb.updateTable('boards')
+            .set({ position: i })
+            .where('id', '=', ids[i])
+            .execute()
+        }
+      }
+      try {
+        await (db as any).transaction(txOps)
+      }
+      catch {
+        // Same fallback rationale as BoardDestroyAction — UPDATE is
+        // idempotent for `position` (setting it twice to the same
+        // value is a no-op), so a partial run + retry recovers.
+        await txOps(db)
+      }
+      return { reordered: ids.length }
+    }
+    catch (err) {
+      console.error('[dashboard/kanban] BoardsReorderAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})