@storyshelf/app 0.5.3

package/dist/routers/profile.mjs

@@ -0,0 +1,276 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { hxRedirect } from "./htmx.mjs";
+import { flash } from "./flash.mjs";
+import { forwardToEngine } from "./auth.mjs";
+import { renderProfilePage } from "../pages/profile.mjs";
+import { NotificationSubscriptionModel, ProjectModel, UserModel } from "@storyshelf/core/models";
+import { SESSION_COOKIE } from "@storyshelf/core/types";
+import { MIN_PASSWORD_LENGTH, unsignedToken } from "@storyshelf/auth";
+import { eq, getTableColumns } from "drizzle-orm";
+//#region src/routers/profile.ts
+function field(form, name) {
+	const raw = form.get(name);
+	return typeof raw === "string" ? raw : "";
+}
+function toDbUser(row) {
+	if (!row) return;
+	return {
+		email: row.email,
+		name: row.name,
+		displayNameOverride: row.displayNameOverride,
+		authProvider: row.authProvider,
+		lastLoginAt: row.lastLoginAt,
+		createdAt: row.createdAt
+	};
+}
+async function loadProfileData(userId) {
+	const { db } = getStore();
+	const userRow = await new UserModel(db).get(userId);
+	const members = await db.list(db.tables.projectMembers, { where: eq(getTableColumns(db.tables.projectMembers)["userId"], userId) });
+	const projects = await db.list(db.tables.projects);
+	const byId = new Map(projects.map((project) => [project.id, project]));
+	const memberships = members.flatMap((member) => {
+		const project = byId.get(member.projectId);
+		return project ? [{
+			projectName: project.name,
+			projectSlug: project.slug,
+			role: member.role,
+			source: member.source
+		}] : [];
+	});
+	const subs = await new NotificationSubscriptionModel(db).listForUser(userId);
+	const subscribedIds = new Set(subs.filter((sub) => sub.enabled).map((sub) => sub.projectId));
+	return {
+		userRow,
+		memberships,
+		subscribedSlugs: [...byId.values()].filter((project) => subscribedIds.has(project.id)).map((project) => project.slug)
+	};
+}
+function readSessionToken(c) {
+	const header = c.req.header("cookie") ?? "";
+	for (const part of header.split(";")) {
+		const eqIndex = part.indexOf("=");
+		if (eqIndex !== -1 && part.slice(0, eqIndex).trim() === SESSION_COOKIE) return unsignedToken(part.slice(eqIndex + 1).trim());
+	}
+	return "";
+}
+/** Engine security overview for the profile page. */
+async function loadEngineSecurity(c, auth, user) {
+	const [sessions, passkeys, hasPassword] = await Promise.all([
+		auth.listSessions(user.id),
+		auth.listPasskeys(user.id),
+		auth.hasPassword(user.id)
+	]);
+	const current = readSessionToken(c);
+	return {
+		sessions: sessions.map((session) => ({
+			id: session.id,
+			ipAddress: session.ipAddress,
+			userAgent: session.userAgent,
+			createdAt: session.createdAt,
+			expiresAt: session.expiresAt,
+			current: session.token === current
+		})),
+		passkeys,
+		passkeysEnabled: auth.passkeysEnabled(),
+		hasPassword
+	};
+}
+async function profileView(c, user, auth, extra) {
+	const { userRow, memberships, subscribedSlugs } = await loadProfileData(user.id);
+	const security = await loadEngineSecurity(c, auth, user);
+	const html = await renderProfilePage({
+		user,
+		dbUser: toDbUser(userRow),
+		memberships,
+		subscribedSlugs,
+		isLocal: extra?.local ?? security.hasPassword,
+		security,
+		error: extra?.error
+	});
+	if (extra?.success) flash(c, extra.success);
+	c.header("Cache-Control", "no-store");
+	return c.html(html, extra?.status ?? 200);
+}
+/** Register the personal profile page and its mutations. */
+function registerProfile(app, auth) {
+	app.get("/profile", async (c) => {
+		const { user } = getStore();
+		if (!user) return c.redirect("/auth/login", 302);
+		return await profileView(c, user, auth);
+	});
+	app.post("/profile", async (c) => {
+		const { user } = getStore();
+		if (!user) return c.redirect("/auth/login", 302);
+		const displayName = field(await c.req.formData(), "displayName").trim();
+		if (!displayName) return profileView(c, user, auth, {
+			error: "Display name is required",
+			status: 400
+		});
+		await new UserModel(getStore().db).setDisplayNameOverride(user.id, displayName);
+		flash(c, "Profile updated");
+		return hxRedirect(c, "/profile");
+	});
+	registerPasswordRoute(app, auth);
+	registerSessionRoutes(app, auth);
+	registerPasskeyRoutes(app, auth);
+	registerNotificationsRoute(app, auth);
+}
+function registerNotificationsRoute(app, auth) {
+	app.post("/profile/notifications", async (c) => {
+		const { user } = getStore();
+		if (!user) return c.redirect("/auth/login", 302);
+		return await saveProfileNotifications(c, user, auth);
+	});
+}
+/** Toggle the viewer's own email subscription for one member project. */
+async function saveProfileNotifications(c, user, auth) {
+	const form = await c.req.formData();
+	const project = await memberProject(field(form, "slug"), user.id);
+	if (!project) return profileView(c, user, auth, {
+		error: "Unknown project",
+		status: 400
+	});
+	await applyProfileToggle(project.id, user.id, field(form, "enabled") === "1");
+	flash(c, "Notification preference saved");
+	return hxRedirect(c, "/profile");
+}
+/** Resolve a project the viewer belongs to (null otherwise). */
+async function memberProject(slug, userId) {
+	const project = await new ProjectModel(getStore().db).getBySlug(slug);
+	if (!project) return null;
+	const { memberships } = await loadProfileData(userId);
+	return memberships.some((membership) => membership.projectSlug === slug) ? project : null;
+}
+/** Enable (opt-in email) or disable (remove) a subscription. */
+async function applyProfileToggle(projectId, userId, enable) {
+	const model = new NotificationSubscriptionModel(getStore().db);
+	if (enable) {
+		await model.upsert(projectId, userId, { via: ["email"] });
+		return;
+	}
+	await model.remove(projectId, userId);
+}
+function registerPasswordRoute(app, auth) {
+	app.post("/profile/password", async (c) => {
+		const { user } = getStore();
+		if (!user) return c.redirect("/auth/login", 302);
+		return await handleEnginePasswordChange(c, auth, user);
+	});
+}
+function registerSessionRoutes(app, auth) {
+	app.post("/profile/sessions/revoke", async (c) => {
+		const { user } = getStore();
+		if (!user) return c.redirect("/auth/login", 302);
+		return await handleSessionRevoke(c, auth, user);
+	});
+	app.post("/profile/sessions/revoke-others", async (c) => {
+		const { user } = getStore();
+		if (!user) return c.redirect("/auth/login", 302);
+		return await handleRevokeOthers(c, auth, user);
+	});
+}
+function registerPasskeyRoutes(app, auth) {
+	app.post("/profile/passkeys/:passkeyId/delete", async (c) => {
+		const { user } = getStore();
+		if (!user) return c.redirect("/auth/login", 302);
+		return await handlePasskeyDelete(c, auth, user);
+	});
+}
+async function handleSessionRevoke(c, auth, user) {
+	const id = await readSessionId(c);
+	if (!id) return profileView(c, user, auth, {
+		error: "Missing session",
+		status: 400
+	});
+	const token = await resolveSessionToken(auth, user, id);
+	if (!token) return profileView(c, user, auth, {
+		error: "Could not revoke that session",
+		status: 400
+	});
+	if ((await forwardToEngine(c, auth, "/api/auth/revoke-session", { token })).status !== 200) return profileView(c, user, auth, {
+		error: "Could not revoke that session",
+		status: 400
+	});
+	return profileView(c, user, auth, { success: "Session revoked" });
+}
+async function readSessionId(c) {
+	return field(await c.req.formData(), "sessionId");
+}
+async function resolveSessionToken(auth, user, id) {
+	return (await auth.listSessions(user.id)).find((session) => session.id === id)?.token ?? null;
+}
+async function handleRevokeOthers(c, auth, user) {
+	if ((await forwardToEngine(c, auth, "/api/auth/revoke-other-sessions", {})).status !== 200) return profileView(c, user, auth, {
+		error: "Could not sign out other devices",
+		status: 400
+	});
+	return profileView(c, user, auth, { success: "Signed out of other devices" });
+}
+async function handlePasskeyDelete(c, auth, user) {
+	const id = c.req.param("passkeyId") ?? "";
+	if (!/^[A-Za-z0-9_-]{1,64}$/u.test(id)) return profileView(c, user, auth, {
+		error: "Unknown passkey",
+		status: 400
+	});
+	if ((await forwardToEngine(c, auth, "/api/auth/passkey/delete-passkey", { id })).status !== 200) return profileView(c, user, auth, {
+		error: "Could not remove that passkey",
+		status: 400
+	});
+	return profileView(c, user, auth, { success: "Passkey removed" });
+}
+async function engineErrorMessage(res, fallback) {
+	try {
+		const body = await res.json();
+		return typeof body.message === "string" && body.message ? body.message : fallback;
+	} catch {
+		return fallback;
+	}
+}
+/** Validate the password form and change it through the engine. */
+async function handleEnginePasswordChange(c, auth, user) {
+	const { current, next, error } = readPasswordChange(await c.req.formData());
+	if (error) return profileView(c, user, auth, {
+		error,
+		local: true,
+		status: 400
+	});
+	const res = await forwardToEngine(c, auth, "/api/auth/change-password", {
+		currentPassword: current,
+		newPassword: next,
+		revokeOtherSessions: true
+	});
+	if (res.status !== 200) return profileView(c, user, auth, {
+		error: await engineErrorMessage(res, "Password change failed"),
+		local: true,
+		status: 400
+	});
+	return profileView(c, user, auth, {
+		success: "Password changed",
+		local: true
+	});
+}
+function readPasswordChange(form) {
+	const next = field(form, "newPassword");
+	if (next !== field(form, "confirmPassword")) return {
+		current: "",
+		next: "",
+		error: "Passwords do not match"
+	};
+	if (next.length < MIN_PASSWORD_LENGTH) return {
+		current: "",
+		next: "",
+		error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters`
+	};
+	return {
+		current: field(form, "currentPassword"),
+		next
+	};
+}
+//#endregion
+export { registerProfile };
+
+//# sourceMappingURL=profile.mjs.map

package/dist/routers/profile.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.mjs","names":[],"sources":["../../src/routers/profile.ts"],"sourcesContent":["import type { Auth } from \"@storyshelf/auth\";\nimport { MIN_PASSWORD_LENGTH, unsignedToken } from \"@storyshelf/auth\";\nimport { NotificationSubscriptionModel, ProjectModel, UserModel } from \"@storyshelf/core/models\";\nimport type { Project } from \"@storyshelf/core/schema\";\nimport { SESSION_COOKIE, type AuthUser } from \"@storyshelf/core/types\";\nimport { eq, getTableColumns } from \"drizzle-orm\";\nimport type { Context } from \"hono\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { renderProfilePage } from \"../pages/profile.tsx\";\nimport { getStore } from \"../store.ts\";\nimport { forwardToEngine } from \"./auth.ts\";\nimport { flash } from \"./flash.ts\";\nimport { hxRedirect } from \"./htmx.ts\";\n\n/** User columns needed to render the profile page. */\ninterface ProfileRow {\n  email: string;\n  name: string;\n  displayNameOverride: string | null;\n  authProvider: string;\n  lastLoginAt: string | null;\n  createdAt: string;\n}\n\n/** Membership entry for the profile page. */\ninterface ProfileMembership {\n  projectName: string;\n  projectSlug: string;\n  role: string;\n  source: string;\n}\n\nfunction field(form: FormData, name: string): string {\n  const raw = form.get(name);\n  return typeof raw === \"string\" ? raw : \"\";\n}\n\nfunction toDbUser(row: ProfileRow | null): ProfilePage[\"dbUser\"] {\n  if (!row) {\n    return undefined;\n  }\n  return {\n    email: row.email,\n    name: row.name,\n    displayNameOverride: row.displayNameOverride,\n    authProvider: row.authProvider,\n    lastLoginAt: row.lastLoginAt,\n    createdAt: row.createdAt,\n  };\n}\n\ntype ProfilePage = Parameters<typeof renderProfilePage>[0];\n\nasync function loadProfileData(userId: string): Promise<{\n  userRow: ProfileRow | null;\n  memberships: ProfileMembership[];\n  subscribedSlugs: string[];\n}> {\n  const { db } = getStore();\n  const userRow = (await new UserModel(db).get(userId)) as unknown as ProfileRow | null;\n  const members = (await db.list(db.tables.projectMembers, {\n    where: eq(getTableColumns(db.tables.projectMembers)[\"userId\"] as never, userId),\n  })) as unknown as Array<{ projectId: string; role: string; source: string }>;\n  const projects = (await db.list(db.tables.projects)) as unknown as Array<{\n    id: string;\n    name: string;\n    slug: string;\n  }>;\n  const byId = new Map(projects.map((project) => [project.id, project]));\n  const memberships = members.flatMap((member) => {\n    const project = byId.get(member.projectId);\n    return project\n      ? [\n          {\n            projectName: project.name,\n            projectSlug: project.slug,\n            role: member.role,\n            source: member.source,\n          },\n        ]\n      : [];\n  });\n  const subs = await new NotificationSubscriptionModel(db).listForUser(userId);\n  const subscribedIds = new Set(subs.filter((sub) => sub.enabled).map((sub) => sub.projectId));\n  const subscribedSlugs = [...byId.values()]\n    .filter((project) => subscribedIds.has(project.id))\n    .map((project) => project.slug);\n  return { userRow, memberships, subscribedSlugs };\n}\n\nfunction readSessionToken(c: Context): string {\n  const header = c.req.header(\"cookie\") ?? \"\";\n  for (const part of header.split(\";\")) {\n    const eqIndex = part.indexOf(\"=\");\n    if (eqIndex !== -1 && part.slice(0, eqIndex).trim() === SESSION_COOKIE) {\n      // Engine cookies are signed (`token.signature`); the table holds the raw token.\n      return unsignedToken(part.slice(eqIndex + 1).trim());\n    }\n  }\n  return \"\";\n}\n\n/** Engine security overview for the profile page. */\nasync function loadEngineSecurity(\n  c: Context,\n  auth: Auth,\n  user: AuthUser,\n): Promise<NonNullable<ProfilePage[\"security\"]>> {\n  const [sessions, passkeys, hasPassword] = await Promise.all([\n    auth.listSessions(user.id),\n    auth.listPasskeys(user.id),\n    auth.hasPassword(user.id),\n  ]);\n  const current = readSessionToken(c);\n  return {\n    sessions: sessions.map((session) => ({\n      id: session.id,\n      ipAddress: session.ipAddress,\n      userAgent: session.userAgent,\n      createdAt: session.createdAt,\n      expiresAt: session.expiresAt,\n      current: session.token === current,\n    })),\n    passkeys,\n    passkeysEnabled: auth.passkeysEnabled(),\n    hasPassword,\n  };\n}\n\nasync function profileView(\n  c: Context,\n  user: AuthUser,\n  auth: Auth,\n  extra?: { error?: string; success?: string; local?: boolean; status?: 200 | 400 },\n): Promise<Response> {\n  const { userRow, memberships, subscribedSlugs } = await loadProfileData(user.id);\n  const security = await loadEngineSecurity(c, auth, user);\n  const html = await renderProfilePage({\n    user,\n    dbUser: toDbUser(userRow),\n    memberships,\n    subscribedSlugs,\n    isLocal: extra?.local ?? security.hasPassword,\n    security,\n    error: extra?.error,\n  });\n  if (extra?.success) {\n    flash(c, extra.success);\n  }\n  // Device tokens render into the page (per-device revoke forms): never store.\n  c.header(\"Cache-Control\", \"no-store\");\n  return c.html(html, extra?.status ?? 200);\n}\n\n/** Register the personal profile page and its mutations. */\nexport function registerProfile(app: ShelfRouter, auth: Auth): void {\n  app.get(\"/profile\", async (c) => {\n    const { user } = getStore();\n    if (!user) {\n      return c.redirect(\"/auth/login\", 302);\n    }\n    return await profileView(c, user, auth);\n  });\n\n  app.post(\"/profile\", async (c) => {\n    const { user } = getStore();\n    if (!user) {\n      return c.redirect(\"/auth/login\", 302);\n    }\n    const displayName = field(await c.req.formData(), \"displayName\").trim();\n    if (!displayName) {\n      return profileView(c, user, auth, { error: \"Display name is required\", status: 400 });\n    }\n    await new UserModel(getStore().db).setDisplayNameOverride(user.id, displayName);\n    flash(c, \"Profile updated\");\n    return hxRedirect(c, \"/profile\");\n  });\n\n  registerPasswordRoute(app, auth);\n  registerSessionRoutes(app, auth);\n  registerPasskeyRoutes(app, auth);\n  registerNotificationsRoute(app, auth);\n}\n\nfunction registerNotificationsRoute(app: ShelfRouter, auth: Auth): void {\n  app.post(\"/profile/notifications\", async (c) => {\n    const { user } = getStore();\n    if (!user) {\n      return c.redirect(\"/auth/login\", 302);\n    }\n    return await saveProfileNotifications(c, user, auth);\n  });\n}\n\n/** Toggle the viewer's own email subscription for one member project. */\nasync function saveProfileNotifications(c: Context, user: AuthUser, auth: Auth): Promise<Response> {\n  const form = await c.req.formData();\n  const project = await memberProject(field(form, \"slug\"), user.id);\n  if (!project) {\n    return profileView(c, user, auth, { error: \"Unknown project\", status: 400 });\n  }\n  await applyProfileToggle(project.id, user.id, field(form, \"enabled\") === \"1\");\n  flash(c, \"Notification preference saved\");\n  return hxRedirect(c, \"/profile\");\n}\n\n/** Resolve a project the viewer belongs to (null otherwise). */\nasync function memberProject(slug: string, userId: string): Promise<Project | null> {\n  const project = await new ProjectModel(getStore().db).getBySlug(slug);\n  if (!project) {\n    return null;\n  }\n  const { memberships } = await loadProfileData(userId);\n  const isMember = memberships.some((membership) => membership.projectSlug === slug);\n  return isMember ? project : null;\n}\n\n/** Enable (opt-in email) or disable (remove) a subscription. */\nasync function applyProfileToggle(\n  projectId: string,\n  userId: string,\n  enable: boolean,\n): Promise<void> {\n  const model = new NotificationSubscriptionModel(getStore().db);\n  if (enable) {\n    await model.upsert(projectId, userId, { via: [\"email\"] });\n    return;\n  }\n  await model.remove(projectId, userId);\n}\n\nfunction registerPasswordRoute(app: ShelfRouter, auth: Auth): void {\n  app.post(\"/profile/password\", async (c) => {\n    const { user } = getStore();\n    if (!user) {\n      return c.redirect(\"/auth/login\", 302);\n    }\n    return await handleEnginePasswordChange(c, auth, user);\n  });\n}\n\nfunction registerSessionRoutes(app: ShelfRouter, auth: Auth): void {\n  app.post(\"/profile/sessions/revoke\", async (c) => {\n    const { user } = getStore();\n    if (!user) {\n      return c.redirect(\"/auth/login\", 302);\n    }\n    return await handleSessionRevoke(c, auth, user);\n  });\n\n  app.post(\"/profile/sessions/revoke-others\", async (c) => {\n    const { user } = getStore();\n    if (!user) {\n      return c.redirect(\"/auth/login\", 302);\n    }\n    return await handleRevokeOthers(c, auth, user);\n  });\n}\n\nfunction registerPasskeyRoutes(app: ShelfRouter, auth: Auth): void {\n  app.post(\"/profile/passkeys/:passkeyId/delete\", async (c) => {\n    const { user } = getStore();\n    if (!user) {\n      return c.redirect(\"/auth/login\", 302);\n    }\n    return await handlePasskeyDelete(c, auth, user);\n  });\n}\n\nasync function handleSessionRevoke(c: Context, auth: Auth, user: AuthUser): Promise<Response> {\n  const id = await readSessionId(c);\n  if (!id) {\n    return profileView(c, user, auth, { error: \"Missing session\", status: 400 });\n  }\n  const token = await resolveSessionToken(auth, user, id);\n  if (!token) {\n    return profileView(c, user, auth, { error: \"Could not revoke that session\", status: 400 });\n  }\n  const res = await forwardToEngine(c, auth, \"/api/auth/revoke-session\", { token });\n  if (res.status !== 200) {\n    return profileView(c, user, auth, { error: \"Could not revoke that session\", status: 400 });\n  }\n  return profileView(c, user, auth, { success: \"Session revoked\" });\n}\n\nasync function readSessionId(c: Context): Promise<string> {\n  return field(await c.req.formData(), \"sessionId\");\n}\n\nasync function resolveSessionToken(auth: Auth, user: AuthUser, id: string): Promise<string | null> {\n  const sessions = await auth.listSessions(user.id);\n  return sessions.find((session) => session.id === id)?.token ?? null;\n}\n\nasync function handleRevokeOthers(c: Context, auth: Auth, user: AuthUser): Promise<Response> {\n  const res = await forwardToEngine(c, auth, \"/api/auth/revoke-other-sessions\", {});\n  if (res.status !== 200) {\n    return profileView(c, user, auth, { error: \"Could not sign out other devices\", status: 400 });\n  }\n  return profileView(c, user, auth, { success: \"Signed out of other devices\" });\n}\n\nasync function handlePasskeyDelete(c: Context, auth: Auth, user: AuthUser): Promise<Response> {\n  const id = c.req.param(\"passkeyId\") ?? \"\";\n  if (!/^[A-Za-z0-9_-]{1,64}$/u.test(id)) {\n    return profileView(c, user, auth, { error: \"Unknown passkey\", status: 400 });\n  }\n  const res = await forwardToEngine(c, auth, \"/api/auth/passkey/delete-passkey\", { id });\n  if (res.status !== 200) {\n    return profileView(c, user, auth, { error: \"Could not remove that passkey\", status: 400 });\n  }\n  return profileView(c, user, auth, { success: \"Passkey removed\" });\n}\n\nasync function engineErrorMessage(res: Response, fallback: string): Promise<string> {\n  try {\n    const body = (await res.json()) as { message?: unknown };\n    return typeof body.message === \"string\" && body.message ? body.message : fallback;\n  } catch {\n    return fallback;\n  }\n}\n\n/** Validate the password form and change it through the engine. */\nasync function handleEnginePasswordChange(\n  c: Context,\n  auth: Auth,\n  user: AuthUser,\n): Promise<Response> {\n  const { current, next, error } = readPasswordChange(await c.req.formData());\n  if (error) {\n    return profileView(c, user, auth, { error, local: true, status: 400 });\n  }\n  const res = await forwardToEngine(c, auth, \"/api/auth/change-password\", {\n    currentPassword: current,\n    newPassword: next,\n    revokeOtherSessions: true,\n  });\n  if (res.status !== 200) {\n    const message = await engineErrorMessage(res, \"Password change failed\");\n    return profileView(c, user, auth, { error: message, local: true, status: 400 });\n  }\n  return profileView(c, user, auth, { success: \"Password changed\", local: true });\n}\n\nfunction readPasswordChange(form: FormData): { current: string; next: string; error?: string } {\n  const next = field(form, \"newPassword\");\n  if (next !== field(form, \"confirmPassword\")) {\n    return { current: \"\", next: \"\", error: \"Passwords do not match\" };\n  }\n  if (next.length < MIN_PASSWORD_LENGTH) {\n    return {\n      current: \"\",\n      next: \"\",\n      error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters`,\n    };\n  }\n  return { current: field(form, \"currentPassword\"), next };\n}\n"],"mappings":";;;;;;;;;;;;;AAgCA,SAAS,MAAM,MAAgB,MAAsB;CACnD,MAAM,MAAM,KAAK,IAAI,IAAI;CACzB,OAAO,OAAO,QAAQ,WAAW,MAAM;AACzC;AAEA,SAAS,SAAS,KAA+C;CAC/D,IAAI,CAAC,KACH;CAEF,OAAO;EACL,OAAO,IAAI;EACX,MAAM,IAAI;EACV,qBAAqB,IAAI;EACzB,cAAc,IAAI;EAClB,aAAa,IAAI;EACjB,WAAW,IAAI;CACjB;AACF;AAIA,eAAe,gBAAgB,QAI5B;CACD,MAAM,EAAE,OAAO,SAAS;CACxB,MAAM,UAAW,MAAM,IAAI,UAAU,EAAE,CAAC,CAAC,IAAI,MAAM;CACnD,MAAM,UAAW,MAAM,GAAG,KAAK,GAAG,OAAO,gBAAgB,EACvD,OAAO,GAAG,gBAAgB,GAAG,OAAO,cAAc,CAAC,CAAC,WAAoB,MAAM,EAChF,CAAC;CACD,MAAM,WAAY,MAAM,GAAG,KAAK,GAAG,OAAO,QAAQ;CAKlD,MAAM,OAAO,IAAI,IAAI,SAAS,KAAK,YAAY,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC;CACrE,MAAM,cAAc,QAAQ,SAAS,WAAW;EAC9C,MAAM,UAAU,KAAK,IAAI,OAAO,SAAS;EACzC,OAAO,UACH,CACE;GACE,aAAa,QAAQ;GACrB,aAAa,QAAQ;GACrB,MAAM,OAAO;GACb,QAAQ,OAAO;EACjB,CACF,IACA,CAAC;CACP,CAAC;CACD,MAAM,OAAO,MAAM,IAAI,8BAA8B,EAAE,CAAC,CAAC,YAAY,MAAM;CAC3E,MAAM,gBAAgB,IAAI,IAAI,KAAK,QAAQ,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC;CAI3F,OAAO;EAAE;EAAS;EAAa,iBAHP,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CACvC,QAAQ,YAAY,cAAc,IAAI,QAAQ,EAAE,CAAC,CAAC,CAClD,KAAK,YAAY,QAAQ,IACiB;CAAE;AACjD;AAEA,SAAS,iBAAiB,GAAoB;CAC5C,MAAM,SAAS,EAAE,IAAI,OAAO,QAAQ,KAAK;CACzC,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,UAAU,KAAK,QAAQ,GAAG;EAChC,IAAI,YAAY,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,MAAM,gBAEtD,OAAO,cAAc,KAAK,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;CAEvD;CACA,OAAO;AACT;;AAGA,eAAe,mBACb,GACA,MACA,MAC+C;CAC/C,MAAM,CAAC,UAAU,UAAU,eAAe,MAAM,QAAQ,IAAI;EAC1D,KAAK,aAAa,KAAK,EAAE;EACzB,KAAK,aAAa,KAAK,EAAE;EACzB,KAAK,YAAY,KAAK,EAAE;CAC1B,CAAC;CACD,MAAM,UAAU,iBAAiB,CAAC;CAClC,OAAO;EACL,UAAU,SAAS,KAAK,aAAa;GACnC,IAAI,QAAQ;GACZ,WAAW,QAAQ;GACnB,WAAW,QAAQ;GACnB,WAAW,QAAQ;GACnB,WAAW,QAAQ;GACnB,SAAS,QAAQ,UAAU;EAC7B,EAAE;EACF;EACA,iBAAiB,KAAK,gBAAgB;EACtC;CACF;AACF;AAEA,eAAe,YACb,GACA,MACA,MACA,OACmB;CACnB,MAAM,EAAE,SAAS,aAAa,oBAAoB,MAAM,gBAAgB,KAAK,EAAE;CAC/E,MAAM,WAAW,MAAM,mBAAmB,GAAG,MAAM,IAAI;CACvD,MAAM,OAAO,MAAM,kBAAkB;EACnC;EACA,QAAQ,SAAS,OAAO;EACxB;EACA;EACA,SAAS,OAAO,SAAS,SAAS;EAClC;EACA,OAAO,OAAO;CAChB,CAAC;CACD,IAAI,OAAO,SACT,MAAM,GAAG,MAAM,OAAO;CAGxB,EAAE,OAAO,iBAAiB,UAAU;CACpC,OAAO,EAAE,KAAK,MAAM,OAAO,UAAU,GAAG;AAC1C;;AAGA,SAAgB,gBAAgB,KAAkB,MAAkB;CAClE,IAAI,IAAI,YAAY,OAAO,MAAM;EAC/B,MAAM,EAAE,SAAS,SAAS;EAC1B,IAAI,CAAC,MACH,OAAO,EAAE,SAAS,eAAe,GAAG;EAEtC,OAAO,MAAM,YAAY,GAAG,MAAM,IAAI;CACxC,CAAC;CAED,IAAI,KAAK,YAAY,OAAO,MAAM;EAChC,MAAM,EAAE,SAAS,SAAS;EAC1B,IAAI,CAAC,MACH,OAAO,EAAE,SAAS,eAAe,GAAG;EAEtC,MAAM,cAAc,MAAM,MAAM,EAAE,IAAI,SAAS,GAAG,aAAa,CAAC,CAAC,KAAK;EACtE,IAAI,CAAC,aACH,OAAO,YAAY,GAAG,MAAM,MAAM;GAAE,OAAO;GAA4B,QAAQ;EAAI,CAAC;EAEtF,MAAM,IAAI,UAAU,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,uBAAuB,KAAK,IAAI,WAAW;EAC9E,MAAM,GAAG,iBAAiB;EAC1B,OAAO,WAAW,GAAG,UAAU;CACjC,CAAC;CAED,sBAAsB,KAAK,IAAI;CAC/B,sBAAsB,KAAK,IAAI;CAC/B,sBAAsB,KAAK,IAAI;CAC/B,2BAA2B,KAAK,IAAI;AACtC;AAEA,SAAS,2BAA2B,KAAkB,MAAkB;CACtE,IAAI,KAAK,0BAA0B,OAAO,MAAM;EAC9C,MAAM,EAAE,SAAS,SAAS;EAC1B,IAAI,CAAC,MACH,OAAO,EAAE,SAAS,eAAe,GAAG;EAEtC,OAAO,MAAM,yBAAyB,GAAG,MAAM,IAAI;CACrD,CAAC;AACH;;AAGA,eAAe,yBAAyB,GAAY,MAAgB,MAA+B;CACjG,MAAM,OAAO,MAAM,EAAE,IAAI,SAAS;CAClC,MAAM,UAAU,MAAM,cAAc,MAAM,MAAM,MAAM,GAAG,KAAK,EAAE;CAChE,IAAI,CAAC,SACH,OAAO,YAAY,GAAG,MAAM,MAAM;EAAE,OAAO;EAAmB,QAAQ;CAAI,CAAC;CAE7E,MAAM,mBAAmB,QAAQ,IAAI,KAAK,IAAI,MAAM,MAAM,SAAS,MAAM,GAAG;CAC5E,MAAM,GAAG,+BAA+B;CACxC,OAAO,WAAW,GAAG,UAAU;AACjC;;AAGA,eAAe,cAAc,MAAc,QAAyC;CAClF,MAAM,UAAU,MAAM,IAAI,aAAa,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,IAAI;CACpE,IAAI,CAAC,SACH,OAAO;CAET,MAAM,EAAE,gBAAgB,MAAM,gBAAgB,MAAM;CAEpD,OADiB,YAAY,MAAM,eAAe,WAAW,gBAAgB,IAC/D,IAAI,UAAU;AAC9B;;AAGA,eAAe,mBACb,WACA,QACA,QACe;CACf,MAAM,QAAQ,IAAI,8BAA8B,SAAS,CAAC,CAAC,EAAE;CAC7D,IAAI,QAAQ;EACV,MAAM,MAAM,OAAO,WAAW,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;EACxD;CACF;CACA,MAAM,MAAM,OAAO,WAAW,MAAM;AACtC;AAEA,SAAS,sBAAsB,KAAkB,MAAkB;CACjE,IAAI,KAAK,qBAAqB,OAAO,MAAM;EACzC,MAAM,EAAE,SAAS,SAAS;EAC1B,IAAI,CAAC,MACH,OAAO,EAAE,SAAS,eAAe,GAAG;EAEtC,OAAO,MAAM,2BAA2B,GAAG,MAAM,IAAI;CACvD,CAAC;AACH;AAEA,SAAS,sBAAsB,KAAkB,MAAkB;CACjE,IAAI,KAAK,4BAA4B,OAAO,MAAM;EAChD,MAAM,EAAE,SAAS,SAAS;EAC1B,IAAI,CAAC,MACH,OAAO,EAAE,SAAS,eAAe,GAAG;EAEtC,OAAO,MAAM,oBAAoB,GAAG,MAAM,IAAI;CAChD,CAAC;CAED,IAAI,KAAK,mCAAmC,OAAO,MAAM;EACvD,MAAM,EAAE,SAAS,SAAS;EAC1B,IAAI,CAAC,MACH,OAAO,EAAE,SAAS,eAAe,GAAG;EAEtC,OAAO,MAAM,mBAAmB,GAAG,MAAM,IAAI;CAC/C,CAAC;AACH;AAEA,SAAS,sBAAsB,KAAkB,MAAkB;CACjE,IAAI,KAAK,uCAAuC,OAAO,MAAM;EAC3D,MAAM,EAAE,SAAS,SAAS;EAC1B,IAAI,CAAC,MACH,OAAO,EAAE,SAAS,eAAe,GAAG;EAEtC,OAAO,MAAM,oBAAoB,GAAG,MAAM,IAAI;CAChD,CAAC;AACH;AAEA,eAAe,oBAAoB,GAAY,MAAY,MAAmC;CAC5F,MAAM,KAAK,MAAM,cAAc,CAAC;CAChC,IAAI,CAAC,IACH,OAAO,YAAY,GAAG,MAAM,MAAM;EAAE,OAAO;EAAmB,QAAQ;CAAI,CAAC;CAE7E,MAAM,QAAQ,MAAM,oBAAoB,MAAM,MAAM,EAAE;CACtD,IAAI,CAAC,OACH,OAAO,YAAY,GAAG,MAAM,MAAM;EAAE,OAAO;EAAiC,QAAQ;CAAI,CAAC;CAG3F,KAAI,MADc,gBAAgB,GAAG,MAAM,4BAA4B,EAAE,MAAM,CAAC,EAAA,CACxE,WAAW,KACjB,OAAO,YAAY,GAAG,MAAM,MAAM;EAAE,OAAO;EAAiC,QAAQ;CAAI,CAAC;CAE3F,OAAO,YAAY,GAAG,MAAM,MAAM,EAAE,SAAS,kBAAkB,CAAC;AAClE;AAEA,eAAe,cAAc,GAA6B;CACxD,OAAO,MAAM,MAAM,EAAE,IAAI,SAAS,GAAG,WAAW;AAClD;AAEA,eAAe,oBAAoB,MAAY,MAAgB,IAAoC;CAEjG,QAAO,MADgB,KAAK,aAAa,KAAK,EAAE,EAAA,CAChC,MAAM,YAAY,QAAQ,OAAO,EAAE,CAAC,EAAE,SAAS;AACjE;AAEA,eAAe,mBAAmB,GAAY,MAAY,MAAmC;CAE3F,KAAI,MADc,gBAAgB,GAAG,MAAM,mCAAmC,CAAC,CAAC,EAAA,CACxE,WAAW,KACjB,OAAO,YAAY,GAAG,MAAM,MAAM;EAAE,OAAO;EAAoC,QAAQ;CAAI,CAAC;CAE9F,OAAO,YAAY,GAAG,MAAM,MAAM,EAAE,SAAS,8BAA8B,CAAC;AAC9E;AAEA,eAAe,oBAAoB,GAAY,MAAY,MAAmC;CAC5F,MAAM,KAAK,EAAE,IAAI,MAAM,WAAW,KAAK;CACvC,IAAI,CAAC,yBAAyB,KAAK,EAAE,GACnC,OAAO,YAAY,GAAG,MAAM,MAAM;EAAE,OAAO;EAAmB,QAAQ;CAAI,CAAC;CAG7E,KAAI,MADc,gBAAgB,GAAG,MAAM,oCAAoC,EAAE,GAAG,CAAC,EAAA,CAC7E,WAAW,KACjB,OAAO,YAAY,GAAG,MAAM,MAAM;EAAE,OAAO;EAAiC,QAAQ;CAAI,CAAC;CAE3F,OAAO,YAAY,GAAG,MAAM,MAAM,EAAE,SAAS,kBAAkB,CAAC;AAClE;AAEA,eAAe,mBAAmB,KAAe,UAAmC;CAClF,IAAI;EACF,MAAM,OAAQ,MAAM,IAAI,KAAK;EAC7B,OAAO,OAAO,KAAK,YAAY,YAAY,KAAK,UAAU,KAAK,UAAU;CAC3E,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAe,2BACb,GACA,MACA,MACmB;CACnB,MAAM,EAAE,SAAS,MAAM,UAAU,mBAAmB,MAAM,EAAE,IAAI,SAAS,CAAC;CAC1E,IAAI,OACF,OAAO,YAAY,GAAG,MAAM,MAAM;EAAE;EAAO,OAAO;EAAM,QAAQ;CAAI,CAAC;CAEvE,MAAM,MAAM,MAAM,gBAAgB,GAAG,MAAM,6BAA6B;EACtE,iBAAiB;EACjB,aAAa;EACb,qBAAqB;CACvB,CAAC;CACD,IAAI,IAAI,WAAW,KAEjB,OAAO,YAAY,GAAG,MAAM,MAAM;EAAE,OAAO,MADrB,mBAAmB,KAAK,wBAAwB;EAClB,OAAO;EAAM,QAAQ;CAAI,CAAC;CAEhF,OAAO,YAAY,GAAG,MAAM,MAAM;EAAE,SAAS;EAAoB,OAAO;CAAK,CAAC;AAChF;AAEA,SAAS,mBAAmB,MAAmE;CAC7F,MAAM,OAAO,MAAM,MAAM,aAAa;CACtC,IAAI,SAAS,MAAM,MAAM,iBAAiB,GACxC,OAAO;EAAE,SAAS;EAAI,MAAM;EAAI,OAAO;CAAyB;CAElE,IAAI,KAAK,SAAS,qBAChB,OAAO;EACL,SAAS;EACT,MAAM;EACN,OAAO,6BAA6B,oBAAoB;CAC1D;CAEF,OAAO;EAAE,SAAS,MAAM,MAAM,iBAAiB;EAAG;CAAK;AACzD"}

package/dist/routers/projects.mjs

@@ -0,0 +1,133 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { forbidden, requireSiteAdmin, resolveAuthorizedProject } from "./helpers.mjs";
+import { badRequest, forbidden as forbidden$1, notFound, projectCreateSchema, projectSchema, projectUpdateSchema, unauthorized } from "./schemas.mjs";
+import { createRoute, z } from "@hono/zod-openapi";
+import { LabelModel, MemberModel, ProjectModel } from "@storyshelf/core/models";
+//#region src/routers/projects.ts
+const VIEW_ROLES = [
+	"viewer",
+	"developer",
+	"approver",
+	"admin"
+];
+const ADMIN_ROLES = ["admin"];
+function requireSessionUser() {
+	if (!getStore().authEnabled) return;
+	if (!getStore().user) forbidden();
+}
+const listProjectsRoute = createRoute({
+	method: "get",
+	tags: ["Projects"],
+	summary: "List projects",
+	path: "/api/v1/projects",
+	responses: {
+		200: {
+			content: { "application/json": { schema: projectSchema.array() } },
+			description: "List projects"
+		},
+		...unauthorized
+	}
+});
+const createProjectRoute = createRoute({
+	method: "post",
+	tags: ["Projects"],
+	summary: "Create a project",
+	path: "/api/v1/projects",
+	request: { body: { content: { "application/json": { schema: projectCreateSchema } } } },
+	responses: {
+		201: {
+			content: { "application/json": { schema: projectSchema } },
+			description: "Created project"
+		},
+		...badRequest,
+		...forbidden$1,
+		...unauthorized
+	}
+});
+const getProjectRoute = createRoute({
+	method: "get",
+	tags: ["Projects"],
+	summary: "Get a project",
+	path: "/api/v1/projects/{slug}",
+	request: { params: z.object({ slug: z.string() }) },
+	responses: {
+		200: {
+			content: { "application/json": { schema: projectSchema } },
+			description: "Fetch a project"
+		},
+		...notFound,
+		...unauthorized
+	}
+});
+const updateProjectRoute = createRoute({
+	method: "patch",
+	tags: ["Projects"],
+	summary: "Update a project",
+	path: "/api/v1/projects/{slug}",
+	request: {
+		params: z.object({ slug: z.string() }),
+		body: { content: { "application/json": { schema: projectUpdateSchema } } }
+	},
+	responses: {
+		200: {
+			content: { "application/json": { schema: projectSchema } },
+			description: "Updated project"
+		},
+		...forbidden$1,
+		...notFound
+	}
+});
+const deleteProjectRoute = createRoute({
+	method: "delete",
+	tags: ["Projects"],
+	summary: "Delete a project",
+	path: "/api/v1/projects/{slug}",
+	request: { params: z.object({ slug: z.string() }) },
+	responses: {
+		204: { description: "Deleted project" },
+		...forbidden$1,
+		...notFound
+	}
+});
+/** Register the project list, create, fetch, update, and delete endpoints. */
+function registerProjects(app) {
+	app.openapi(listProjectsRoute, async (c) => {
+		requireSessionUser();
+		const projects = new ProjectModel(getStore().db);
+		return c.json(await projects.list());
+	});
+	app.openapi(createProjectRoute, async (c) => {
+		requireSiteAdmin(c);
+		const body = c.req.valid("json");
+		const project = await new ProjectModel(getStore().db).create(body);
+		await new LabelModel(getStore().db).seedFor(project.id);
+		const creator = getStore().user;
+		if (creator) await new MemberModel(getStore().db).set(project.id, creator.id, "admin");
+		return c.json(project, 201);
+	});
+	app.openapi(getProjectRoute, async (c) => {
+		const { slug } = c.req.valid("param");
+		const project = await resolveAuthorizedProject(c, slug, ...VIEW_ROLES);
+		return c.json(project);
+	});
+	app.openapi(updateProjectRoute, async (c) => {
+		const { slug } = c.req.valid("param");
+		const project = await resolveAuthorizedProject(c, slug, ...ADMIN_ROLES);
+		const updated = await new ProjectModel(getStore().db).update(project.id, c.req.valid("json"));
+		return c.json(updated);
+	});
+	app.openapi(deleteProjectRoute, async (c) => {
+		requireSiteAdmin(c);
+		const { slug } = c.req.valid("param");
+		const project = await resolveAuthorizedProject(c, slug, ...VIEW_ROLES);
+		await new ProjectModel(getStore().db).remove(project.id);
+		return c.body(null, 204);
+	});
+}
+//#endregion
+export { registerProjects };
+
+//# sourceMappingURL=projects.mjs.map

package/dist/routers/projects.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.mjs","names":["forbiddenResponse"],"sources":["../../src/routers/projects.ts"],"sourcesContent":["import { createRoute, z } from \"@hono/zod-openapi\";\nimport { LabelModel } from \"@storyshelf/core/models\";\nimport { MemberModel } from \"@storyshelf/core/models\";\nimport { ProjectModel } from \"@storyshelf/core/models\";\nimport type { ProjectRole } from \"@storyshelf/core/types\";\nimport type { ShelfRouter } from \"../app-types.ts\";\nimport { getStore } from \"../store.ts\";\nimport { forbidden, requireSiteAdmin, resolveAuthorizedProject } from \"./helpers.ts\";\nimport {\n  badRequest,\n  forbidden as forbiddenResponse,\n  notFound,\n  projectCreateSchema,\n  projectSchema,\n  projectUpdateSchema,\n  unauthorized,\n} from \"./schemas.ts\";\nconst VIEW_ROLES: readonly ProjectRole[] = [\"viewer\", \"developer\", \"approver\", \"admin\"];\nconst ADMIN_ROLES: readonly ProjectRole[] = [\"admin\"];\n\nfunction requireSessionUser(): void {\n  if (!getStore().authEnabled) {\n    return;\n  }\n  if (!getStore().user) {\n    forbidden();\n  }\n}\n\nconst listProjectsRoute = createRoute({\n  method: \"get\",\n  tags: [\"Projects\"],\n  summary: \"List projects\",\n  path: \"/api/v1/projects\",\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: projectSchema.array() } },\n      description: \"List projects\",\n    },\n    ...unauthorized,\n  },\n});\n\nconst createProjectRoute = createRoute({\n  method: \"post\",\n  tags: [\"Projects\"],\n  summary: \"Create a project\",\n  path: \"/api/v1/projects\",\n  request: { body: { content: { \"application/json\": { schema: projectCreateSchema } } } },\n  responses: {\n    201: {\n      content: { \"application/json\": { schema: projectSchema } },\n      description: \"Created project\",\n    },\n    ...badRequest,\n    ...forbiddenResponse,\n    ...unauthorized,\n  },\n});\n\nconst getProjectRoute = createRoute({\n  method: \"get\",\n  tags: [\"Projects\"],\n  summary: \"Get a project\",\n  path: \"/api/v1/projects/{slug}\",\n  request: { params: z.object({ slug: z.string() }) },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: projectSchema } },\n      description: \"Fetch a project\",\n    },\n    ...notFound,\n    ...unauthorized,\n  },\n});\n\nconst updateProjectRoute = createRoute({\n  method: \"patch\",\n  tags: [\"Projects\"],\n  summary: \"Update a project\",\n  path: \"/api/v1/projects/{slug}\",\n  request: {\n    params: z.object({ slug: z.string() }),\n    body: { content: { \"application/json\": { schema: projectUpdateSchema } } },\n  },\n  responses: {\n    200: {\n      content: { \"application/json\": { schema: projectSchema } },\n      description: \"Updated project\",\n    },\n    ...forbiddenResponse,\n    ...notFound,\n  },\n});\n\nconst deleteProjectRoute = createRoute({\n  method: \"delete\",\n  tags: [\"Projects\"],\n  summary: \"Delete a project\",\n  path: \"/api/v1/projects/{slug}\",\n  request: { params: z.object({ slug: z.string() }) },\n  responses: {\n    204: { description: \"Deleted project\" },\n    ...forbiddenResponse,\n    ...notFound,\n  },\n});\n\n/** Register the project list, create, fetch, update, and delete endpoints. */\nexport function registerProjects(app: ShelfRouter): void {\n  app.openapi(listProjectsRoute, async (c) => {\n    requireSessionUser();\n    const projects = new ProjectModel(getStore().db);\n    return c.json(await projects.list());\n  });\n\n  app.openapi(createProjectRoute, async (c) => {\n    requireSiteAdmin(c);\n    const body = c.req.valid(\"json\");\n    const projects = new ProjectModel(getStore().db);\n    const project = await projects.create(body);\n    await new LabelModel(getStore().db).seedFor(project.id);\n    const creator = getStore().user;\n    if (creator) {\n      await new MemberModel(getStore().db).set(project.id, creator.id, \"admin\");\n    }\n    return c.json(project, 201);\n  });\n\n  app.openapi(getProjectRoute, async (c) => {\n    const { slug } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...VIEW_ROLES);\n    return c.json(project);\n  });\n\n  app.openapi(updateProjectRoute, async (c) => {\n    const { slug } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...ADMIN_ROLES);\n    const updated = await new ProjectModel(getStore().db).update(project.id, c.req.valid(\"json\"));\n    return c.json(updated);\n  });\n\n  app.openapi(deleteProjectRoute, async (c) => {\n    requireSiteAdmin(c);\n    const { slug } = c.req.valid(\"param\");\n    const project = await resolveAuthorizedProject(c, slug, ...VIEW_ROLES);\n    await new ProjectModel(getStore().db).remove(project.id);\n    return c.body(null, 204);\n  });\n}\n"],"mappings":";;;;;;;;;AAiBA,MAAM,aAAqC;CAAC;CAAU;CAAa;CAAY;AAAO;AACtF,MAAM,cAAsC,CAAC,OAAO;AAEpD,SAAS,qBAA2B;CAClC,IAAI,CAAC,SAAS,CAAC,CAAC,aACd;CAEF,IAAI,CAAC,SAAS,CAAC,CAAC,MACd,UAAU;AAEd;AAEA,MAAM,oBAAoB,YAAY;CACpC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,cAAc,MAAM,EAAE,EAAE;GACjE,aAAa;EACf;EACA,GAAG;CACL;AACF,CAAC;AAED,MAAM,qBAAqB,YAAY;CACrC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE,EAAE,EAAE;CACtF,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,cAAc,EAAE;GACzD,aAAa;EACf;EACA,GAAG;EACH,GAAGA;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,kBAAkB,YAAY;CAClC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE;CAClD,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,cAAc,EAAE;GACzD,aAAa;EACf;EACA,GAAG;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,qBAAqB,YAAY;CACrC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS;EACP,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;EACrC,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE,EAAE;CAC3E;CACA,WAAW;EACT,KAAK;GACH,SAAS,EAAE,oBAAoB,EAAE,QAAQ,cAAc,EAAE;GACzD,aAAa;EACf;EACA,GAAGA;EACH,GAAG;CACL;AACF,CAAC;AAED,MAAM,qBAAqB,YAAY;CACrC,QAAQ;CACR,MAAM,CAAC,UAAU;CACjB,SAAS;CACT,MAAM;CACN,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE;CAClD,WAAW;EACT,KAAK,EAAE,aAAa,kBAAkB;EACtC,GAAGA;EACH,GAAG;CACL;AACF,CAAC;;AAGD,SAAgB,iBAAiB,KAAwB;CACvD,IAAI,QAAQ,mBAAmB,OAAO,MAAM;EAC1C,mBAAmB;EACnB,MAAM,WAAW,IAAI,aAAa,SAAS,CAAC,CAAC,EAAE;EAC/C,OAAO,EAAE,KAAK,MAAM,SAAS,KAAK,CAAC;CACrC,CAAC;CAED,IAAI,QAAQ,oBAAoB,OAAO,MAAM;EAC3C,iBAAiB,CAAC;EAClB,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;EAE/B,MAAM,UAAU,MAAM,IADD,aAAa,SAAS,CAAC,CAAC,EAChB,CAAC,CAAC,OAAO,IAAI;EAC1C,MAAM,IAAI,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;EACtD,MAAM,UAAU,SAAS,CAAC,CAAC;EAC3B,IAAI,SACF,MAAM,IAAI,YAAY,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,IAAI,QAAQ,IAAI,OAAO;EAE1E,OAAO,EAAE,KAAK,SAAS,GAAG;CAC5B,CAAC;CAED,IAAI,QAAQ,iBAAiB,OAAO,MAAM;EACxC,MAAM,EAAE,SAAS,EAAE,IAAI,MAAM,OAAO;EACpC,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,UAAU;EACrE,OAAO,EAAE,KAAK,OAAO;CACvB,CAAC;CAED,IAAI,QAAQ,oBAAoB,OAAO,MAAM;EAC3C,MAAM,EAAE,SAAS,EAAE,IAAI,MAAM,OAAO;EACpC,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,WAAW;EACtE,MAAM,UAAU,MAAM,IAAI,aAAa,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,IAAI,EAAE,IAAI,MAAM,MAAM,CAAC;EAC5F,OAAO,EAAE,KAAK,OAAO;CACvB,CAAC;CAED,IAAI,QAAQ,oBAAoB,OAAO,MAAM;EAC3C,iBAAiB,CAAC;EAClB,MAAM,EAAE,SAAS,EAAE,IAAI,MAAM,OAAO;EACpC,MAAM,UAAU,MAAM,yBAAyB,GAAG,MAAM,GAAG,UAAU;EACrE,MAAM,IAAI,aAAa,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,QAAQ,EAAE;EACvD,OAAO,EAAE,KAAK,MAAM,GAAG;CACzB,CAAC;AACH"}

package/dist/routers/review-next.mjs

@@ -0,0 +1,47 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { getStore } from "../store.mjs";
+import { hxRefresh, isHxRequest } from "./htmx.mjs";
+import { isOpenSnapshot } from "./baseline-guard.mjs";
+import { SnapshotModel } from "@storyshelf/core/models";
+//#region src/routers/review-next.ts
+/**
+* The next snapshot still waiting for a decision after `currentId`, in list
+* order, wrapping to the start. Null when nothing else is open.
+*/
+function nextOpenSnapshotId(snapshots, currentId) {
+	const index = snapshots.findIndex((snap) => snap.id === currentId);
+	return [...snapshots.slice(index + 1), ...snapshots.slice(0, Math.max(index, 0))].find((snap) => snap.id !== currentId && isOpenSnapshot(snap))?.id ?? null;
+}
+/** Whether HTMX issued the request from a build's review page (`.../diff`). */
+function fromReviewPage(c) {
+	try {
+		return new URL(c.req.header("HX-Current-URL") ?? "").pathname.endsWith("/diff");
+	} catch {
+		return false;
+	}
+}
+/** Where a decision on `snapshotId` should send the reviewer, or null to just reload. */
+async function advanceTarget(target) {
+	const next = nextOpenSnapshotId(await new SnapshotModel(getStore().db).listByBuild(target.buildId), target.snapshotId);
+	return next === null ? null : `/projects/${target.slug}/builds/${target.buildId}/diff?snapshot=${next}`;
+}
+/**
+* After a single-snapshot decision, send HTMX clients on the review page to
+* the next open snapshot (so a reviewer can clear a build with `a`/`r`).
+* Elsewhere, or when nothing is left, reload the current page.
+*/
+async function hxAdvance(c, target) {
+	if (!isHxRequest(c)) return;
+	const url = fromReviewPage(c) ? await advanceTarget(target) : null;
+	if (url === null) {
+		hxRefresh(c);
+		return;
+	}
+	c.header("HX-Redirect", url);
+}
+//#endregion
+export { hxAdvance, nextOpenSnapshotId };
+
+//# sourceMappingURL=review-next.mjs.map

package/dist/routers/review-next.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-next.mjs","names":[],"sources":["../../src/routers/review-next.ts"],"sourcesContent":["import { SnapshotModel } from \"@storyshelf/core/models\";\nimport type { Snapshot } from \"@storyshelf/core/schema\";\nimport type { Context } from \"hono\";\nimport { getStore } from \"../store.ts\";\nimport { isOpenSnapshot } from \"./baseline-guard.ts\";\nimport { hxRefresh, isHxRequest } from \"./htmx.ts\";\n\n/**\n * The next snapshot still waiting for a decision after `currentId`, in list\n * order, wrapping to the start. Null when nothing else is open.\n */\nexport function nextOpenSnapshotId(snapshots: Snapshot[], currentId: string): string | null {\n  const index = snapshots.findIndex((snap) => snap.id === currentId);\n  const ordered = [...snapshots.slice(index + 1), ...snapshots.slice(0, Math.max(index, 0))];\n  return ordered.find((snap) => snap.id !== currentId && isOpenSnapshot(snap))?.id ?? null;\n}\n\n/** Whether HTMX issued the request from a build's review page (`.../diff`). */\nfunction fromReviewPage(c: Context): boolean {\n  try {\n    return new URL(c.req.header(\"HX-Current-URL\") ?? \"\").pathname.endsWith(\"/diff\");\n  } catch {\n    return false;\n  }\n}\n\n/** Where a decision on `snapshotId` should send the reviewer, or null to just reload. */\nasync function advanceTarget(target: {\n  slug: string;\n  buildId: string;\n  snapshotId: string;\n}): Promise<string | null> {\n  const snapshots = await new SnapshotModel(getStore().db).listByBuild(target.buildId);\n  const next = nextOpenSnapshotId(snapshots, target.snapshotId);\n  return next === null\n    ? null\n    : `/projects/${target.slug}/builds/${target.buildId}/diff?snapshot=${next}`;\n}\n\n/**\n * After a single-snapshot decision, send HTMX clients on the review page to\n * the next open snapshot (so a reviewer can clear a build with `a`/`r`).\n * Elsewhere, or when nothing is left, reload the current page.\n */\nexport async function hxAdvance(\n  c: Context,\n  target: { slug: string; buildId: string; snapshotId: string },\n): Promise<void> {\n  if (!isHxRequest(c)) {\n    return;\n  }\n  const url = fromReviewPage(c) ? await advanceTarget(target) : null;\n  if (url === null) {\n    hxRefresh(c);\n    return;\n  }\n  c.header(\"HX-Redirect\", url);\n}\n"],"mappings":";;;;;;;;;;;;AAWA,SAAgB,mBAAmB,WAAuB,WAAkC;CAC1F,MAAM,QAAQ,UAAU,WAAW,SAAS,KAAK,OAAO,SAAS;CAEjE,OAAO,CADU,GAAG,UAAU,MAAM,QAAQ,CAAC,GAAG,GAAG,UAAU,MAAM,GAAG,KAAK,IAAI,OAAO,CAAC,CAAC,CAC3E,CAAC,CAAC,MAAM,SAAS,KAAK,OAAO,aAAa,eAAe,IAAI,CAAC,CAAC,EAAE,MAAM;AACtF;;AAGA,SAAS,eAAe,GAAqB;CAC3C,IAAI;EACF,OAAO,IAAI,IAAI,EAAE,IAAI,OAAO,gBAAgB,KAAK,EAAE,CAAC,CAAC,SAAS,SAAS,OAAO;CAChF,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,eAAe,cAAc,QAIF;CAEzB,MAAM,OAAO,mBAAmB,MADR,IAAI,cAAc,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,OAAO,OAAO,GACxC,OAAO,UAAU;CAC5D,OAAO,SAAS,OACZ,OACA,aAAa,OAAO,KAAK,UAAU,OAAO,QAAQ,iBAAiB;AACzE;;;;;;AAOA,eAAsB,UACpB,GACA,QACe;CACf,IAAI,CAAC,YAAY,CAAC,GAChB;CAEF,MAAM,MAAM,eAAe,CAAC,IAAI,MAAM,cAAc,MAAM,IAAI;CAC9D,IAAI,QAAQ,MAAM;EAChB,UAAU,CAAC;EACX;CACF;CACA,EAAE,OAAO,eAAe,GAAG;AAC7B"}