@stacksjs/defaults 0.70.58 → 0.70.60

package/app/Actions/Dashboard/Rbac/PermissionStoreAction.ts

@@ -0,0 +1,53 @@
+import { Action } from '@stacksjs/actions'
+import { createPermission, findPermission } from '@stacksjs/auth'
+
+interface PermissionInput {
+  name?: unknown
+  guardName?: unknown
+  description?: unknown
+}
+
+/**
+ * `POST /api/dashboard/rbac/permissions` (stacksjs/stacks#1845).
+ *
+ * Mirrors RoleStoreAction. Permissions are typically dotted names
+ * like `posts.publish` or `users.delete` — the dashboard imposes
+ * no naming convention, that's an app-layer concern.
+ */
+export default new Action({
+  name: 'Dashboard RBAC Permission Store',
+  description: 'Create a new permission.',
+  method: 'POST',
+  apiResponse: true,
+  async handle(request) {
+    const body = (request as any).jsonBody as PermissionInput | undefined ?? {}
+
+    const name = typeof body.name === 'string' ? body.name.trim() : ''
+    if (!name || name.length > 100) {
+      return { error: '`name` is required and must be 1-100 characters.', status: 400 }
+    }
+    const guardName = typeof body.guardName === 'string' && body.guardName ? body.guardName.trim() : 'web'
+    const description = typeof body.description === 'string' ? body.description.trim() : undefined
+
+    try {
+      const existing = await findPermission(name, guardName)
+      if (existing) {
+        return { error: 'A permission with that name and guard already exists.', status: 409 }
+      }
+      const permission = await createPermission(name, guardName, description)
+      return {
+        permission: {
+          id: permission.id,
+          name: permission.name,
+          guardName: permission.guard_name,
+          description: permission.description ?? null,
+          createdAt: permission.created_at ?? null,
+        },
+      }
+    }
+    catch (err) {
+      console.error('[dashboard/rbac] PermissionStoreAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Rbac/PermissionsIndexAction.ts

@@ -0,0 +1,34 @@
+import { Action } from '@stacksjs/actions'
+import { getAllPermissions } from '@stacksjs/auth'
+
+/**
+ * `GET /api/dashboard/rbac/permissions` (stacksjs/stacks#1845).
+ *
+ * Same shape as RolesIndexAction but against permissions. Drives the
+ * Permissions tab on the management page + the column headers of the
+ * Role-Permission matrix.
+ */
+export default new Action({
+  name: 'Dashboard RBAC Permissions Index',
+  description: 'List every permission known to the RBAC store.',
+  method: 'GET',
+  apiResponse: true,
+  async handle() {
+    try {
+      const permissions = await getAllPermissions()
+      return {
+        permissions: permissions.map(p => ({
+          id: p.id,
+          name: p.name,
+          guardName: p.guard_name,
+          description: p.description ?? null,
+          createdAt: p.created_at ?? null,
+        })),
+      }
+    }
+    catch (err) {
+      console.error('[dashboard/rbac] PermissionsIndexAction failed:', err)
+      return { permissions: [], error: err instanceof Error ? err.message : 'unknown error' }
+    }
+  },
+})

package/app/Actions/Dashboard/Rbac/RoleDestroyAction.ts

@@ -0,0 +1,35 @@
+import { Action } from '@stacksjs/actions'
+import { deleteRole } from '@stacksjs/auth'
+
+/**
+ * `DELETE /api/dashboard/rbac/roles/:name` (stacksjs/stacks#1845).
+ *
+ * Removes a role by name + guard. The underlying store cascades the
+ * user_roles + role_permissions pivot rows so a deleted role doesn't
+ * leave orphan attachments. No notification to formerly-assigned
+ * users — the dashboard's role-gated visibility re-evaluates on the
+ * next page load.
+ */
+export default new Action({
+  name: 'Dashboard RBAC Role Destroy',
+  description: 'Hard-delete a role + its pivot rows.',
+  method: 'DELETE',
+  apiResponse: true,
+  async handle(request) {
+    const name = String((request as any)?.params?.name ?? '').trim()
+    if (!name) {
+      return { error: '`name` route param is required.', status: 400 }
+    }
+    const url = new URL(request.url ?? 'http://localhost/')
+    const guardName = url.searchParams.get('guard') || 'web'
+
+    try {
+      await deleteRole(name, guardName)
+      return { deleted: true, name, guardName }
+    }
+    catch (err) {
+      console.error('[dashboard/rbac] RoleDestroyAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Rbac/RolePermissionsShowAction.ts

@@ -0,0 +1,45 @@
+import { Action } from '@stacksjs/actions'
+import { findRole, getRolePermissions } from '@stacksjs/auth'
+
+/**
+ * `GET /api/dashboard/rbac/roles/:name/permissions` (stacksjs/stacks#1845).
+ *
+ * Returns the permissions attached to a role. Drives the
+ * Role-Permission matrix on the management page — when an admin
+ * picks a role, this populates which permission checkboxes are
+ * currently on.
+ */
+export default new Action({
+  name: 'Dashboard RBAC Role Permissions Show',
+  description: 'List permissions attached to one role.',
+  method: 'GET',
+  apiResponse: true,
+  async handle(request) {
+    const name = String((request as any)?.params?.name ?? '').trim()
+    if (!name) {
+      return { error: '`name` route param is required.', status: 400 }
+    }
+    const url = new URL(request.url ?? 'http://localhost/')
+    const guardName = url.searchParams.get('guard') || 'web'
+
+    try {
+      const role = await findRole(name, guardName)
+      if (!role) {
+        return { error: 'Role not found.', status: 404 }
+      }
+      const permissions = await getRolePermissions(role.id)
+      return {
+        role: { id: role.id, name: role.name, guardName: role.guard_name },
+        permissions: permissions.map(p => ({
+          id: p.id,
+          name: p.name,
+          guardName: p.guard_name,
+        })),
+      }
+    }
+    catch (err) {
+      console.error('[dashboard/rbac] RolePermissionsShowAction failed:', err)
+      return { permissions: [], error: err instanceof Error ? err.message : 'unknown error' }
+    }
+  },
+})

package/app/Actions/Dashboard/Rbac/RolePermissionsSyncAction.ts

@@ -0,0 +1,63 @@
+import { Action } from '@stacksjs/actions'
+import { getRolePermissions, findRole, syncRolePermissions } from '@stacksjs/auth'
+
+interface SyncInput {
+  permissions?: unknown
+  guardName?: unknown
+}
+
+/**
+ * `POST /api/dashboard/rbac/roles/:name/permissions` (stacksjs/stacks#1845).
+ *
+ * Replace-all: pass the full new permission-name list. The facade
+ * resolves names → ids and calls the store's syncRolePermissions
+ * (which is `delete-then-insert` under the hood, transactional).
+ */
+export default new Action({
+  name: 'Dashboard RBAC Role Permissions Sync',
+  description: 'Replace the permission set attached to one role.',
+  method: 'POST',
+  apiResponse: true,
+  async handle(request) {
+    const roleName = String((request as any)?.params?.name ?? '').trim()
+    if (!roleName) {
+      return { error: '`name` route param is required.', status: 400 }
+    }
+
+    const body = (request as any).jsonBody as SyncInput | undefined ?? {}
+    if (!Array.isArray(body.permissions)) {
+      return { error: '`permissions` must be an array of permission names (possibly empty).', status: 400 }
+    }
+    const names: string[] = []
+    for (const v of body.permissions) {
+      if (typeof v !== 'string' || !v.trim()) {
+        return { error: '`permissions` must contain non-empty strings.', status: 400 }
+      }
+      names.push(v.trim())
+    }
+    const guardName = typeof body.guardName === 'string' && body.guardName ? body.guardName.trim() : 'web'
+
+    try {
+      await syncRolePermissions(roleName, Array.from(new Set(names)), guardName)
+      // Re-fetch the role + its current permissions so the optimistic
+      // UI can reconcile against canonical state.
+      const role = await findRole(roleName, guardName)
+      if (!role) {
+        return { error: 'Role not found after sync.', status: 404 }
+      }
+      const after = await getRolePermissions(role.id)
+      return {
+        role: { id: role.id, name: role.name, guardName: role.guard_name },
+        permissions: after.map(p => ({ id: p.id, name: p.name, guardName: p.guard_name })),
+      }
+    }
+    catch (err) {
+      const msg = err instanceof Error ? err.message : 'unknown error'
+      if (msg.includes('not found')) {
+        return { error: msg, status: 400 }
+      }
+      console.error('[dashboard/rbac] RolePermissionsSyncAction failed:', err)
+      return { error: msg, status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Rbac/RoleStoreAction.ts

@@ -0,0 +1,58 @@
+import { Action } from '@stacksjs/actions'
+import { createRole, findRole } from '@stacksjs/auth'
+
+interface RoleInput {
+  name?: unknown
+  guardName?: unknown
+  description?: unknown
+}
+
+/**
+ * `POST /api/dashboard/rbac/roles` (stacksjs/stacks#1845).
+ *
+ * Creates a new role. Pre-checks uniqueness for (name, guard_name)
+ * up front so the response carries a clean 409 instead of letting
+ * the DB's unique-constraint surface bubble through as a 500.
+ *
+ * Idempotency note: the underlying BqbRbacStore swallows the
+ * unique-violation race at the SQL level too, so concurrent calls
+ * with the same (name, guard) settle on a single row regardless of
+ * which one wins the SELECT-then-INSERT race.
+ */
+export default new Action({
+  name: 'Dashboard RBAC Role Store',
+  description: 'Create a new role.',
+  method: 'POST',
+  apiResponse: true,
+  async handle(request) {
+    const body = (request as any).jsonBody as RoleInput | undefined ?? {}
+
+    const name = typeof body.name === 'string' ? body.name.trim() : ''
+    if (!name || name.length > 60) {
+      return { error: '`name` is required and must be 1-60 characters.', status: 400 }
+    }
+    const guardName = typeof body.guardName === 'string' && body.guardName ? body.guardName.trim() : 'web'
+    const description = typeof body.description === 'string' ? body.description.trim() : undefined
+
+    try {
+      const existing = await findRole(name, guardName)
+      if (existing) {
+        return { error: 'A role with that name and guard already exists.', status: 409 }
+      }
+      const role = await createRole(name, guardName, description)
+      return {
+        role: {
+          id: role.id,
+          name: role.name,
+          guardName: role.guard_name,
+          description: role.description ?? null,
+          createdAt: role.created_at ?? null,
+        },
+      }
+    }
+    catch (err) {
+      console.error('[dashboard/rbac] RoleStoreAction failed:', err)
+      return { error: err instanceof Error ? err.message : 'unknown error', status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Rbac/RolesIndexAction.ts

@@ -0,0 +1,36 @@
+import { Action } from '@stacksjs/actions'
+import { getAllRoles } from '@stacksjs/auth'
+
+/**
+ * `GET /api/dashboard/rbac/roles` (stacksjs/stacks#1845).
+ *
+ * Returns every role in the system. The dashboard's permissions page
+ * renders this as a list users can pick from when assigning roles.
+ * Soft-errors to an empty list rather than 500 so a broken RBAC store
+ * (e.g., migrations not run) renders an empty-state instead of
+ * yelling at the user.
+ */
+export default new Action({
+  name: 'Dashboard RBAC Roles Index',
+  description: 'List every role known to the RBAC store.',
+  method: 'GET',
+  apiResponse: true,
+  async handle() {
+    try {
+      const roles = await getAllRoles()
+      return {
+        roles: roles.map(r => ({
+          id: r.id,
+          name: r.name,
+          guardName: r.guard_name,
+          description: r.description ?? null,
+          createdAt: r.created_at ?? null,
+        })),
+      }
+    }
+    catch (err) {
+      console.error('[dashboard/rbac] RolesIndexAction failed:', err)
+      return { roles: [], error: err instanceof Error ? err.message : 'unknown error' }
+    }
+  },
+})

package/app/Actions/Dashboard/Rbac/UserRolesShowAction.ts

@@ -0,0 +1,40 @@
+import { Action } from '@stacksjs/actions'
+import { getUserRoles } from '@stacksjs/auth'
+
+/**
+ * `GET /api/dashboard/rbac/users/:id/roles` (stacksjs/stacks#1845).
+ *
+ * Returns the roles attached to a single user. Drives the per-user
+ * picker on the Users tab of the management page — when an admin
+ * clicks a user, this populates the "currently assigned" set so
+ * the sync UI can diff against it.
+ */
+export default new Action({
+  name: 'Dashboard RBAC User Roles Show',
+  description: 'List roles attached to one user.',
+  method: 'GET',
+  apiResponse: true,
+  async handle(request) {
+    const rawId = (request as any)?.params?.id
+    const userId = Number(rawId)
+    if (!Number.isFinite(userId) || userId <= 0) {
+      return { error: 'Invalid user id.', status: 400 }
+    }
+
+    try {
+      const roles = await getUserRoles(userId)
+      return {
+        userId,
+        roles: roles.map(r => ({
+          id: r.id,
+          name: r.name,
+          guardName: r.guard_name,
+        })),
+      }
+    }
+    catch (err) {
+      console.error('[dashboard/rbac] UserRolesShowAction failed:', err)
+      return { userId, roles: [], error: err instanceof Error ? err.message : 'unknown error' }
+    }
+  },
+})

package/app/Actions/Dashboard/Rbac/UserRolesSyncAction.ts

@@ -0,0 +1,65 @@
+import { Action } from '@stacksjs/actions'
+import { getUserRoles, syncRoles } from '@stacksjs/auth'
+
+interface SyncInput {
+  roles?: unknown
+  guardName?: unknown
+}
+
+/**
+ * `POST /api/dashboard/rbac/users/:id/roles` (stacksjs/stacks#1845).
+ *
+ * Replace-all sync: pass the full new role-name list and the
+ * underlying facade attaches/detaches to match. Same semantics as
+ * the kanban label/assignee sync endpoints.
+ *
+ * The facade resolves role names → role ids internally (and throws
+ * if any name doesn't exist), so we surface those as 400s rather
+ * than letting them bubble as 500s.
+ */
+export default new Action({
+  name: 'Dashboard RBAC User Roles Sync',
+  description: 'Replace the role set attached to one user.',
+  method: 'POST',
+  apiResponse: true,
+  async handle(request) {
+    const rawId = (request as any)?.params?.id
+    const userId = Number(rawId)
+    if (!Number.isFinite(userId) || userId <= 0) {
+      return { error: 'Invalid user id.', status: 400 }
+    }
+
+    const body = (request as any).jsonBody as SyncInput | undefined ?? {}
+    if (!Array.isArray(body.roles)) {
+      return { error: '`roles` must be an array of role names (possibly empty).', status: 400 }
+    }
+    const names: string[] = []
+    for (const v of body.roles) {
+      if (typeof v !== 'string' || !v.trim()) {
+        return { error: '`roles` must contain non-empty strings.', status: 400 }
+      }
+      names.push(v.trim())
+    }
+    const guardName = typeof body.guardName === 'string' && body.guardName ? body.guardName.trim() : 'web'
+
+    try {
+      await syncRoles(userId, Array.from(new Set(names)), guardName)
+      const after = await getUserRoles(userId)
+      return {
+        userId,
+        roles: after.map(r => ({ id: r.id, name: r.name, guardName: r.guard_name })),
+      }
+    }
+    catch (err) {
+      const msg = err instanceof Error ? err.message : 'unknown error'
+      // The facade throws "Role 'X' not found" — surface as 400 so
+      // the UI can show "this role doesn't exist anymore" rather
+      // than a 500.
+      if (msg.includes('not found')) {
+        return { error: msg, status: 400 }
+      }
+      console.error('[dashboard/rbac] UserRolesSyncAction failed:', err)
+      return { error: msg, status: 500 }
+    }
+  },
+})

package/app/Actions/Dashboard/Rbac/UsersListAction.ts

@@ -0,0 +1,39 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+
+/**
+ * `GET /api/dashboard/rbac/users` (stacksjs/stacks#1845).
+ *
+ * Lightweight user list for the RBAC Users tab. Returns `{ id,
+ * name, email }` only — enough to show a row label + run the
+ * per-user role-sync UI. Bounded to 500 rows so a typo doesn't
+ * dump the whole users table into one response (the page can
+ * paginate / filter later if needed).
+ *
+ * Scoped to RBAC rather than reusing the kanban users list because:
+ *   - The two surfaces have different role-gating contracts
+ *     (kanban: admin+dev; RBAC: admin-only when the auth middleware
+ *      is applied).
+ *   - Future RBAC-specific filters (e.g. `?withoutRole=admin`)
+ *     belong on this endpoint, not on the kanban one.
+ */
+export default new Action({
+  name: 'Dashboard RBAC Users List',
+  description: 'Lightweight user list for the RBAC assignment UI.',
+  method: 'GET',
+  apiResponse: true,
+  async handle() {
+    try {
+      const rows = await db.unsafe(
+        'SELECT id, name, email FROM users ORDER BY name ASC, id ASC LIMIT 500',
+      ).execute() as Array<{ id: number, name: string | null, email: string | null }>
+      return {
+        users: (rows ?? []).map(r => ({ id: r.id, name: r.name, email: r.email })),
+      }
+    }
+    catch (err) {
+      console.error('[dashboard/rbac] UsersListAction failed:', err)
+      return { users: [], error: err instanceof Error ? err.message : 'unknown error' }
+    }
+  },
+})

package/app/Actions/Dashboard/Realtime/RealtimeStatsAction.ts

@@ -0,0 +1,50 @@
+import { Action } from '@stacksjs/actions'
+import { Websocket } from '@stacksjs/orm'
+
+export default new Action({
+  name: 'RealtimeStatsAction',
+  description: 'Returns realtime connection statistics.',
+  method: 'GET',
+  async handle() {
+    try {
+      const allConnections = await Websocket.all()
+      const totalConnections = await Websocket.count()
+
+      // Group connections by channel
+      const channelMap: Record<string, { connections: number, messages: number }> = {}
+      for (const conn of allConnections) {
+        const channel = String(conn.get('channel') || conn.get('name') || 'default')
+        if (!channelMap[channel]) {
+          channelMap[channel] = { connections: 0, messages: 0 }
+        }
+        channelMap[channel].connections++
+        channelMap[channel].messages += Number(conn.get('message_count') || 0)
+      }
+
+      const channels = Object.entries(channelMap).map(([name, data]) => ({
+        name,
+        connections: data.connections,
+        messages: `${data.messages}/min`,
+      }))
+
+      return {
+        channels,
+        stats: {
+          activeConnections: totalConnections,
+          messagesPerMinute: '-',
+          avgLatency: '-',
+        },
+      }
+    }
+    catch {
+      return {
+        channels: [],
+        stats: {
+          activeConnections: 0,
+          messagesPerMinute: '0',
+          avgLatency: '-',
+        },
+      }
+    }
+  },
+})

package/app/Actions/Dashboard/Releases/ReleaseIndexAction.ts

@@ -0,0 +1,21 @@
+import { Action } from '@stacksjs/actions'
+
+export default new Action({
+  name: 'ReleaseIndexAction',
+  description: 'Returns the list of releases with download stats.',
+  method: 'GET',
+  async handle() {
+    return {
+      data: [
+        { version: '0.72.0', codename: 'Nebula', size: '2.4 MB', path: '/releases/0.72.0', createdAt: '2024-03-15T10:00:00Z' },
+        { version: '0.71.0', codename: 'Aurora', size: '2.3 MB', path: '/releases/0.71.0', createdAt: '2024-03-01T10:00:00Z' },
+        { version: '0.70.0', codename: 'Zenith', size: '2.2 MB', path: '/releases/0.70.0', createdAt: '2024-02-15T10:00:00Z' },
+      ],
+      stats: {
+        labels: Array.from({ length: 30 }, (_, i) => new Date(Date.now() - (29 - i) * 86400000).toISOString().split('T')[0]),
+        downloads: Array.from({ length: 30 }, () => Math.floor(Math.random() * 500) + 100),
+        releaseTimes: Array.from({ length: 30 }, () => Math.floor(Math.random() * 30) + 5),
+      },
+    }
+  },
+})

package/app/Actions/Dashboard/Requests/GetAverageRequestTime.ts

@@ -0,0 +1,12 @@
+import { Action } from '@stacksjs/actions'
+// import { Library } from '@stacksjs/orm'
+
+export default new Action({
+  name: 'GetAverageReleaseTime',
+  description: 'Gets the average release time of your library.',
+  apiResponse: true,
+
+  async handle() {
+    // return Library.averageReleaseTime()
+  },
+})

package/app/Actions/Dashboard/Requests/GetRequestCount.ts

@@ -0,0 +1,12 @@
+import { Action } from '@stacksjs/actions'
+// import { Request } from '@stacksjs/orm'
+
+export default new Action({
+  name: 'GetRequestCount',
+  description: 'Gets the total number of requests.',
+  apiResponse: true,
+
+  async handle() {
+    // return Request.count()
+  },
+})

package/app/Actions/Dashboard/Requests/GetRequestSuccessRate.ts

@@ -0,0 +1,12 @@
+import { Action } from '@stacksjs/actions'
+// import { Request } from '@stacksjs/orm'
+
+export default new Action({
+  name: 'GetRequestSuccessRate',
+  description: 'Gets the request success rate of your application.',
+  apiResponse: true,
+
+  async handle() {
+    // return Request.successRate()
+  },
+})

package/app/Actions/Dashboard/Requests/GetRequests.ts

@@ -0,0 +1,12 @@
+import { Action } from '@stacksjs/actions'
+// import { Request } from '@stacksjs/orm'
+
+export default new Action({
+  name: 'GetRequests',
+  description: 'Gets your requests.',
+  apiResponse: true,
+
+  async handle() {
+    // return Request.all()
+  },
+})

package/app/Actions/Dashboard/Search/GlobalSearchAction.ts

@@ -0,0 +1,26 @@
+import { Action } from '@stacksjs/actions'
+
+export default new Action({
+  name: 'GlobalSearchAction',
+  description: 'Returns global search results grouped by model.',
+  method: 'GET',
+  async handle(request: RequestInstance) {
+    const q = request?.get('q') || ''
+
+    if (!q) return { results: {} }
+
+    return {
+      results: {
+        users: [
+          { id: 1, title: 'Chris Breuer', subtitle: 'chris@stacks.dev', href: '/data/users', icon: 'i-hugeicons-user-02' },
+        ],
+        posts: [
+          { id: 1, title: 'Getting Started with Stacks', subtitle: 'Published 2 days ago', href: '/content/posts', icon: 'i-hugeicons-note-edit' },
+        ],
+        products: [
+          { id: 1, title: 'Premium Plan', subtitle: '$99/mo', href: '/commerce/products', icon: 'i-hugeicons-shopping-bag-02' },
+        ],
+      },
+    }
+  },
+})