@studious-lms/server 1.26.0 → 1.28.0

package/dist/services/adminSpam.d.ts

@@ -0,0 +1,76 @@
+import type { Prisma } from '@prisma/client';
+export type SpamReason = 'BLOCKED_DOMAIN' | 'BOT_PATTERN' | 'DISPOSABLE_DOMAIN' | 'NEVER_VERIFIED_INACTIVE';
+export type SpamSignals = {
+    suspected: boolean;
+    reasons: SpamReason[];
+};
+export declare function spamRules(): {
+    blockedDomains: string[];
+    botPatterns: string[];
+    disposableDomains: string[];
+};
+export type ClassifiableUser = {
+    username: string;
+    email: string;
+    verified: boolean;
+    _count?: {
+        teacherIn: number;
+        studentIn: number;
+        submissions?: number;
+    };
+};
+export declare function classifyEmail(email: string | null | undefined, username?: string | null): SpamSignals;
+export declare function classifyUser(user: ClassifiableUser): SpamSignals;
+/**
+ * Prisma filter matching the rule-based part of {@link classifyUser}. The
+ * `NEVER_VERIFIED_INACTIVE` reason is intentionally excluded: brand new real
+ * signups look identical to it, so it only annotates rows and never drives
+ * list filtering or counts.
+ */
+export declare function suspectedUserWhere(): Prisma.UserWhereInput;
+export declare function notSuspectedUserWhere(): Prisma.UserWhereInput;
+export declare function countSuspectedUsers(): Promise<number>;
+export declare function listUserEmailDomainsForAdmin(input: {
+    limit: number;
+    suspectedOnly: boolean;
+}): Promise<{
+    items: {
+        domain: string;
+        total: number;
+        verified: number;
+        suspected: boolean;
+    }[];
+}>;
+export declare function getSpamOverviewForAdmin(): Promise<{
+    rules: {
+        blockedDomains: string[];
+        botPatterns: string[];
+        disposableDomains: string[];
+    };
+    totalUsers: number;
+    suspectedUsers: number;
+    suspectedVerified: number;
+    cleanUsers: number;
+    domains: {
+        domain: string;
+        total: number;
+        verified: number;
+        suspected: boolean;
+    }[];
+    recent: {
+        signals: SpamSignals;
+        id: string;
+        username: string;
+        email: string;
+        verified: boolean;
+        profile: {
+            createdAt: Date;
+        } | null;
+        _count: {
+            teacherIn: number;
+            studentIn: number;
+            submissions: number;
+        };
+    }[];
+}>;
+//# sourceMappingURL=adminSpam.d.ts.map

package/dist/services/adminSpam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminSpam.d.ts","sourceRoot":"/","sources":["services/adminSpam.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAG7C,MAAM,MAAM,UAAU,GAClB,gBAAgB,GAChB,aAAa,GACb,mBAAmB,GACnB,yBAAyB,CAAC;AAE9B,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB,CAAC;AA4BF,wBAAgB,SAAS;;;;EASxB;AAWD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE,CAAC;AAEF,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,WAAW,CAwBb;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,CAchE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,cAAc,CAkB1D;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,cAAc,CAE7D;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAE3D;AAID,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;CACxB;;;;;;;GA4BA;AAED,wBAAsB,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0C5C"}

package/dist/services/adminSpam.js

@@ -0,0 +1,163 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f1ebc28d-0fbe-5aac-8263-22c204e2adf3")}catch(e){}}();
+import { prisma } from '../lib/prisma.js';
+const DEFAULT_BLOCKED_DOMAINS = ['riverside.edu'];
+const DEFAULT_BOT_PATTERNS = ['devin', 'automation-bot', 'qa-bot'];
+const DEFAULT_DISPOSABLE_DOMAINS = [
+    'mailinator.com',
+    'guerrillamail.com',
+    'yopmail.com',
+    'tempmail.com',
+    'temp-mail.org',
+    '10minutemail.com',
+    'trashmail.com',
+    'sharklasers.com',
+    'dispostable.com',
+];
+function fromEnv(name, fallback) {
+    const raw = process.env[name];
+    if (!raw)
+        return fallback;
+    const parsed = raw
+        .split(',')
+        .map((entry) => entry.trim().toLowerCase())
+        .filter(Boolean);
+    return parsed.length > 0 ? parsed : fallback;
+}
+export function spamRules() {
+    return {
+        blockedDomains: fromEnv('ADMIN_SPAM_DOMAINS', DEFAULT_BLOCKED_DOMAINS),
+        botPatterns: fromEnv('ADMIN_SPAM_BOT_PATTERNS', DEFAULT_BOT_PATTERNS),
+        disposableDomains: fromEnv('ADMIN_SPAM_DISPOSABLE_DOMAINS', DEFAULT_DISPOSABLE_DOMAINS),
+    };
+}
+function domainOf(email) {
+    const at = email.lastIndexOf('@');
+    return at === -1 ? '' : email.slice(at + 1).trim().toLowerCase();
+}
+function matchesDomain(domain, listed) {
+    return domain === listed || domain.endsWith(`.${listed}`);
+}
+export function classifyEmail(email, username) {
+    const rules = spamRules();
+    const normalisedEmail = (email ?? '').toLowerCase();
+    const normalisedUsername = (username ?? '').toLowerCase();
+    const domain = domainOf(normalisedEmail);
+    const reasons = [];
+    if (rules.blockedDomains.some((listed) => matchesDomain(domain, listed))) {
+        reasons.push('BLOCKED_DOMAIN');
+    }
+    if (rules.disposableDomains.some((listed) => matchesDomain(domain, listed))) {
+        reasons.push('DISPOSABLE_DOMAIN');
+    }
+    if (rules.botPatterns.some((pattern) => normalisedEmail.includes(pattern) ||
+        (normalisedUsername.length > 0 && normalisedUsername.includes(pattern)))) {
+        reasons.push('BOT_PATTERN');
+    }
+    return { suspected: reasons.length > 0, reasons };
+}
+export function classifyUser(user) {
+    const reasons = [...classifyEmail(user.email, user.username).reasons];
+    const counts = user._count;
+    if (!user.verified &&
+        counts &&
+        counts.teacherIn === 0 &&
+        counts.studentIn === 0 &&
+        (counts.submissions ?? 0) === 0) {
+        reasons.push('NEVER_VERIFIED_INACTIVE');
+    }
+    return { suspected: reasons.length > 0, reasons };
+}
+/**
+ * Prisma filter matching the rule-based part of {@link classifyUser}. The
+ * `NEVER_VERIFIED_INACTIVE` reason is intentionally excluded: brand new real
+ * signups look identical to it, so it only annotates rows and never drives
+ * list filtering or counts.
+ */
+export function suspectedUserWhere() {
+    const rules = spamRules();
+    const domains = [...rules.blockedDomains, ...rules.disposableDomains];
+    return {
+        OR: [
+            ...domains.map((domain) => ({
+                email: { endsWith: `@${domain}`, mode: 'insensitive' },
+            })),
+            ...domains.map((domain) => ({
+                email: { endsWith: `.${domain}`, mode: 'insensitive' },
+            })),
+            ...rules.botPatterns.flatMap((pattern) => [
+                { username: { contains: pattern, mode: 'insensitive' } },
+                { email: { contains: pattern, mode: 'insensitive' } },
+            ]),
+        ],
+    };
+}
+export function notSuspectedUserWhere() {
+    return { NOT: suspectedUserWhere() };
+}
+export async function countSuspectedUsers() {
+    return prisma.user.count({ where: suspectedUserWhere() });
+}
+export async function listUserEmailDomainsForAdmin(input) {
+    const rows = await prisma.$queryRaw `
+    SELECT lower(split_part(email, '@', 2)) AS domain,
+           count(*) AS total,
+           count(*) FILTER (WHERE verified) AS verified
+    FROM "User"
+    GROUP BY 1
+    ORDER BY count(*) DESC, 1 ASC
+    LIMIT ${Math.min(input.limit, 200)}
+  `;
+    const rules = spamRules();
+    const items = rows.map((row) => {
+        const domain = row.domain ?? '';
+        const suspected = rules.blockedDomains.some((listed) => matchesDomain(domain, listed)) ||
+            rules.disposableDomains.some((listed) => matchesDomain(domain, listed));
+        return {
+            domain: domain || '(none)',
+            total: Number(row.total),
+            verified: Number(row.verified),
+            suspected,
+        };
+    });
+    return {
+        items: input.suspectedOnly ? items.filter((item) => item.suspected) : items,
+    };
+}
+export async function getSpamOverviewForAdmin() {
+    const rules = spamRules();
+    const suspectedWhere = suspectedUserWhere();
+    const [totalUsers, suspectedUsers, suspectedVerified, domains, recent,] = await Promise.all([
+        prisma.user.count(),
+        prisma.user.count({ where: suspectedWhere }),
+        prisma.user.count({ where: { AND: [suspectedWhere, { verified: true }] } }),
+        listUserEmailDomainsForAdmin({ limit: 200, suspectedOnly: true }),
+        prisma.user.findMany({
+            where: suspectedWhere,
+            orderBy: { username: 'asc' },
+            take: 50,
+            select: {
+                id: true,
+                username: true,
+                email: true,
+                verified: true,
+                profile: { select: { createdAt: true } },
+                _count: { select: { teacherIn: true, studentIn: true, submissions: true } },
+            },
+        }),
+    ]);
+    return {
+        rules,
+        totalUsers,
+        suspectedUsers,
+        suspectedVerified,
+        cleanUsers: totalUsers - suspectedUsers,
+        domains: domains.items,
+        recent: recent.map((user) => ({
+            ...user,
+            signals: classifyUser(user),
+        })),
+    };
+}
+//# sourceMappingURL=adminSpam.js.map
+//# debugId=f1ebc28d-0fbe-5aac-8263-22c204e2adf3

package/dist/services/adminSpam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminSpam.js","sources":["services/adminSpam.ts"],"sourceRoot":"/","sourcesContent":["import type { Prisma } from '@prisma/client';\nimport { prisma } from '../lib/prisma.js';\n\nexport type SpamReason =\n  | 'BLOCKED_DOMAIN'\n  | 'BOT_PATTERN'\n  | 'DISPOSABLE_DOMAIN'\n  | 'NEVER_VERIFIED_INACTIVE';\n\nexport type SpamSignals = {\n  suspected: boolean;\n  reasons: SpamReason[];\n};\n\nconst DEFAULT_BLOCKED_DOMAINS = ['riverside.edu'];\n\nconst DEFAULT_BOT_PATTERNS = ['devin', 'automation-bot', 'qa-bot'];\n\nconst DEFAULT_DISPOSABLE_DOMAINS = [\n  'mailinator.com',\n  'guerrillamail.com',\n  'yopmail.com',\n  'tempmail.com',\n  'temp-mail.org',\n  '10minutemail.com',\n  'trashmail.com',\n  'sharklasers.com',\n  'dispostable.com',\n];\n\nfunction fromEnv(name: string, fallback: string[]): string[] {\n  const raw = process.env[name];\n  if (!raw) return fallback;\n  const parsed = raw\n    .split(',')\n    .map((entry) => entry.trim().toLowerCase())\n    .filter(Boolean);\n  return parsed.length > 0 ? parsed : fallback;\n}\n\nexport function spamRules() {\n  return {\n    blockedDomains: fromEnv('ADMIN_SPAM_DOMAINS', DEFAULT_BLOCKED_DOMAINS),\n    botPatterns: fromEnv('ADMIN_SPAM_BOT_PATTERNS', DEFAULT_BOT_PATTERNS),\n    disposableDomains: fromEnv(\n      'ADMIN_SPAM_DISPOSABLE_DOMAINS',\n      DEFAULT_DISPOSABLE_DOMAINS,\n    ),\n  };\n}\n\nfunction domainOf(email: string): string {\n  const at = email.lastIndexOf('@');\n  return at === -1 ? '' : email.slice(at + 1).trim().toLowerCase();\n}\n\nfunction matchesDomain(domain: string, listed: string): boolean {\n  return domain === listed || domain.endsWith(`.${listed}`);\n}\n\nexport type ClassifiableUser = {\n  username: string;\n  email: string;\n  verified: boolean;\n  _count?: { teacherIn: number; studentIn: number; submissions?: number };\n};\n\nexport function classifyEmail(\n  email: string | null | undefined,\n  username?: string | null,\n): SpamSignals {\n  const rules = spamRules();\n  const normalisedEmail = (email ?? '').toLowerCase();\n  const normalisedUsername = (username ?? '').toLowerCase();\n  const domain = domainOf(normalisedEmail);\n  const reasons: SpamReason[] = [];\n\n  if (rules.blockedDomains.some((listed) => matchesDomain(domain, listed))) {\n    reasons.push('BLOCKED_DOMAIN');\n  }\n  if (rules.disposableDomains.some((listed) => matchesDomain(domain, listed))) {\n    reasons.push('DISPOSABLE_DOMAIN');\n  }\n  if (\n    rules.botPatterns.some(\n      (pattern) =>\n        normalisedEmail.includes(pattern) ||\n        (normalisedUsername.length > 0 && normalisedUsername.includes(pattern)),\n    )\n  ) {\n    reasons.push('BOT_PATTERN');\n  }\n\n  return { suspected: reasons.length > 0, reasons };\n}\n\nexport function classifyUser(user: ClassifiableUser): SpamSignals {\n  const reasons = [...classifyEmail(user.email, user.username).reasons];\n  const counts = user._count;\n  if (\n    !user.verified &&\n    counts &&\n    counts.teacherIn === 0 &&\n    counts.studentIn === 0 &&\n    (counts.submissions ?? 0) === 0\n  ) {\n    reasons.push('NEVER_VERIFIED_INACTIVE');\n  }\n\n  return { suspected: reasons.length > 0, reasons };\n}\n\n/**\n * Prisma filter matching the rule-based part of {@link classifyUser}. The\n * `NEVER_VERIFIED_INACTIVE` reason is intentionally excluded: brand new real\n * signups look identical to it, so it only annotates rows and never drives\n * list filtering or counts.\n */\nexport function suspectedUserWhere(): Prisma.UserWhereInput {\n  const rules = spamRules();\n  const domains = [...rules.blockedDomains, ...rules.disposableDomains];\n\n  return {\n    OR: [\n      ...domains.map((domain) => ({\n        email: { endsWith: `@${domain}`, mode: 'insensitive' as const },\n      })),\n      ...domains.map((domain) => ({\n        email: { endsWith: `.${domain}`, mode: 'insensitive' as const },\n      })),\n      ...rules.botPatterns.flatMap((pattern) => [\n        { username: { contains: pattern, mode: 'insensitive' as const } },\n        { email: { contains: pattern, mode: 'insensitive' as const } },\n      ]),\n    ],\n  };\n}\n\nexport function notSuspectedUserWhere(): Prisma.UserWhereInput {\n  return { NOT: suspectedUserWhere() };\n}\n\nexport async function countSuspectedUsers(): Promise<number> {\n  return prisma.user.count({ where: suspectedUserWhere() });\n}\n\ntype DomainRow = { domain: string | null; total: bigint; verified: bigint };\n\nexport async function listUserEmailDomainsForAdmin(input: {\n  limit: number;\n  suspectedOnly: boolean;\n}) {\n  const rows = await prisma.$queryRaw<DomainRow[]>`\n    SELECT lower(split_part(email, '@', 2)) AS domain,\n           count(*) AS total,\n           count(*) FILTER (WHERE verified) AS verified\n    FROM \"User\"\n    GROUP BY 1\n    ORDER BY count(*) DESC, 1 ASC\n    LIMIT ${Math.min(input.limit, 200)}\n  `;\n\n  const rules = spamRules();\n  const items = rows.map((row) => {\n    const domain = row.domain ?? '';\n    const suspected =\n      rules.blockedDomains.some((listed) => matchesDomain(domain, listed)) ||\n      rules.disposableDomains.some((listed) => matchesDomain(domain, listed));\n    return {\n      domain: domain || '(none)',\n      total: Number(row.total),\n      verified: Number(row.verified),\n      suspected,\n    };\n  });\n\n  return {\n    items: input.suspectedOnly ? items.filter((item) => item.suspected) : items,\n  };\n}\n\nexport async function getSpamOverviewForAdmin() {\n  const rules = spamRules();\n  const suspectedWhere = suspectedUserWhere();\n\n  const [\n    totalUsers,\n    suspectedUsers,\n    suspectedVerified,\n    domains,\n    recent,\n  ] = await Promise.all([\n    prisma.user.count(),\n    prisma.user.count({ where: suspectedWhere }),\n    prisma.user.count({ where: { AND: [suspectedWhere, { verified: true }] } }),\n    listUserEmailDomainsForAdmin({ limit: 200, suspectedOnly: true }),\n    prisma.user.findMany({\n      where: suspectedWhere,\n      orderBy: { username: 'asc' },\n      take: 50,\n      select: {\n        id: true,\n        username: true,\n        email: true,\n        verified: true,\n        profile: { select: { createdAt: true } },\n        _count: { select: { teacherIn: true, studentIn: true, submissions: true } },\n      },\n    }),\n  ]);\n\n  return {\n    rules,\n    totalUsers,\n    suspectedUsers,\n    suspectedVerified,\n    cleanUsers: totalUsers - suspectedUsers,\n    domains: domains.items,\n    recent: recent.map((user) => ({\n      ...user,\n      signals: classifyUser(user),\n    })),\n  };\n}\n"],"names":[],"mappings":";;AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAa1C,MAAM,uBAAuB,GAAG,CAAC,eAAe,CAAC,CAAC;AAElD,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;AAEnE,MAAM,0BAA0B,GAAG;IACjC,gBAAgB;IAChB,mBAAmB;IACnB,aAAa;IACb,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,iBAAiB;IACjB,iBAAiB;CAClB,CAAC;AAEF,SAAS,OAAO,CAAC,IAAY,EAAE,QAAkB;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,oBAAoB,EAAE,uBAAuB,CAAC;QACtE,WAAW,EAAE,OAAO,CAAC,yBAAyB,EAAE,oBAAoB,CAAC;QACrE,iBAAiB,EAAE,OAAO,CACxB,+BAA+B,EAC/B,0BAA0B,CAC3B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,MAAc;IACnD,OAAO,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AAC5D,CAAC;AASD,MAAM,UAAU,aAAa,CAC3B,KAAgC,EAChC,QAAwB;IAExB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,kBAAkB,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IACzC,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpC,CAAC;IACD,IACE,KAAK,CAAC,WAAW,CAAC,IAAI,CACpB,CAAC,OAAO,EAAE,EAAE,CACV,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC;QACjC,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAC1E,EACD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAsB;IACjD,MAAM,OAAO,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IACE,CAAC,IAAI,CAAC,QAAQ;QACd,MAAM;QACN,MAAM,CAAC,SAAS,KAAK,CAAC;QACtB,MAAM,CAAC,SAAS,KAAK,CAAC;QACtB,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,CAAC,EAC/B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,EAAE,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAEtE,OAAO;QACL,EAAE,EAAE;YACF,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC1B,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,MAAM,EAAE,EAAE,IAAI,EAAE,aAAsB,EAAE;aAChE,CAAC,CAAC;YACH,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC1B,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,MAAM,EAAE,EAAE,IAAI,EAAE,aAAsB,EAAE;aAChE,CAAC,CAAC;YACH,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBACxC,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,aAAsB,EAAE,EAAE;gBACjE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,aAAsB,EAAE,EAAE;aAC/D,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,EAAE,GAAG,EAAE,kBAAkB,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAGlD;IACC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAa;;;;;;;YAOtC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC;GACnC,CAAC;IAEF,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAChC,MAAM,SAAS,GACb,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACpE,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,OAAO;YACL,MAAM,EAAE,MAAM,IAAI,QAAQ;YAC1B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YACxB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9B,SAAS;SACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG,kBAAkB,EAAE,CAAC;IAE5C,MAAM,CACJ,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,OAAO,EACP,MAAM,EACP,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE;QACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3E,4BAA4B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnB,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC5B,IAAI,EAAE,EAAE;YACR,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;gBACxC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;aAC5E;SACF,CAAC;KACH,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,UAAU;QACV,cAAc;QACd,iBAAiB;QACjB,UAAU,EAAE,UAAU,GAAG,cAAc;QACvC,OAAO,EAAE,OAAO,CAAC,KAAK;QACtB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5B,GAAG,IAAI;YACP,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC;SAC5B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC","debug_id":"f1ebc28d-0fbe-5aac-8263-22c204e2adf3"}

package/dist/services/adminSql.d.ts

@@ -0,0 +1,36 @@
+export declare const SQL_MAX_ROWS = 500;
+export declare const SQL_TIMEOUT_MS = 10000;
+/**
+ * Validates that `sql` is a single read-only statement and returns it without
+ * its trailing semicolon. Throws a `BAD_REQUEST` otherwise.
+ */
+export declare function assertReadOnlySql(sql: string): string;
+/** Wraps row-returning statements so the row cap is enforced by the database. */
+export declare function buildBoundedQuery(statement: string, limit: number): string;
+/** JSON-safe values: Prisma returns bigints, dates, buffers and Decimals raw. */
+export declare function serializeValue(value: unknown): unknown;
+export type AdminSqlResult = {
+    columns: string[];
+    rows: Record<string, unknown>[];
+    rowCount: number;
+    truncated: boolean;
+    durationMs: number;
+};
+export declare function runAdminSql(input: {
+    sql: string;
+    limit?: number;
+    userId?: string;
+}): Promise<AdminSqlResult>;
+export type AdminSqlTable = {
+    table: string;
+    columns: {
+        name: string;
+        type: string;
+        nullable: boolean;
+    }[];
+};
+/** Schema browser for the console sidebar. */
+export declare function listSqlSchemaForAdmin(): Promise<{
+    tables: AdminSqlTable[];
+}>;
+//# sourceMappingURL=adminSql.d.ts.map

package/dist/services/adminSql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminSql.d.ts","sourceRoot":"/","sources":["services/adminSql.ts"],"names":[],"mappings":"AA2DA,eAAO,MAAM,YAAY,MAAM,CAAC;AAChC,eAAO,MAAM,cAAc,QAAS,CAAC;AAcrC;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAyBrD;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAI1E;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CActD;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,wBAAsB,WAAW,CAAC,KAAK,EAAE;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuC1B;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAC9D,CAAC;AAEF,8CAA8C;AAC9C,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,CAAC,CAyBlF"}

package/dist/services/adminSql.js

@@ -0,0 +1,172 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="45b19f90-7667-5cbe-b383-62162ed3eb2a")}catch(e){}}();
+import { TRPCError } from '@trpc/server';
+import { prisma } from '../lib/prisma.js';
+import { logger } from '../utils/logger.js';
+/**
+ * Read-only SQL console backing `admin.runSql`.
+ *
+ * Three independent guards, because a single one is not enough:
+ * 1. the statement is parsed/validated here (single read statement only),
+ * 2. it runs inside a `READ ONLY` transaction so the database rejects writes,
+ * 3. a statement timeout and row cap bound the blast radius of a bad query.
+ */
+const READ_STARTERS = ['select', 'with', 'explain', 'show', 'table', 'values'];
+/** Statement keywords that must never appear, including inside CTEs. */
+const FORBIDDEN_KEYWORDS = [
+    'insert',
+    'update',
+    'delete',
+    'merge',
+    'upsert',
+    'drop',
+    'alter',
+    'create',
+    'truncate',
+    'grant',
+    'revoke',
+    'comment',
+    'copy',
+    'vacuum',
+    'analyze',
+    'reindex',
+    'cluster',
+    'refresh',
+    'lock',
+    'listen',
+    'notify',
+    'call',
+    'do',
+    'set',
+    'reset',
+    'begin',
+    'commit',
+    'rollback',
+    'savepoint',
+    'prepare',
+    'execute',
+    'deallocate',
+    'discard',
+    'import',
+    'security',
+    'pg_read_file',
+    'pg_read_binary_file',
+    'pg_ls_dir',
+    'dblink',
+    'pg_sleep',
+];
+export const SQL_MAX_ROWS = 500;
+export const SQL_TIMEOUT_MS = 10000;
+function stripCommentsAndStrings(sql) {
+    return sql
+        .replace(/--[^\n]*/g, ' ')
+        .replace(/\/\*[\s\S]*?\*\//g, ' ')
+        .replace(/'(?:[^']|'')*'/g, "''")
+        .replace(/"(?:[^"]|"")*"/g, '""');
+}
+function badRequest(message) {
+    return new TRPCError({ code: 'BAD_REQUEST', message });
+}
+/**
+ * Validates that `sql` is a single read-only statement and returns it without
+ * its trailing semicolon. Throws a `BAD_REQUEST` otherwise.
+ */
+export function assertReadOnlySql(sql) {
+    const statement = sql.trim().replace(/;\s*$/, '').trim();
+    if (!statement)
+        throw badRequest('Query is empty.');
+    const sanitized = stripCommentsAndStrings(statement).toLowerCase();
+    if (sanitized.includes(';')) {
+        throw badRequest('Only a single statement may be executed.');
+    }
+    const firstWord = sanitized.trim().split(/\s+/)[0]?.replace(/^\(+/, '') ?? '';
+    if (!READ_STARTERS.includes(firstWord)) {
+        throw badRequest(`Only ${READ_STARTERS.map((word) => word.toUpperCase()).join('/')} queries are allowed.`);
+    }
+    const forbidden = FORBIDDEN_KEYWORDS.find((keyword) => new RegExp(`\\b${keyword}\\b`).test(sanitized));
+    if (forbidden) {
+        throw badRequest(`Keyword "${forbidden.toUpperCase()}" is not allowed in the SQL console.`);
+    }
+    return statement;
+}
+/** Wraps row-returning statements so the row cap is enforced by the database. */
+export function buildBoundedQuery(statement, limit) {
+    const firstWord = stripCommentsAndStrings(statement).trim().toLowerCase().split(/\s+/)[0] ?? '';
+    if (firstWord === 'explain' || firstWord === 'show')
+        return statement;
+    return `SELECT * FROM (${statement}) AS admin_sql_console LIMIT ${limit}`;
+}
+/** JSON-safe values: Prisma returns bigints, dates, buffers and Decimals raw. */
+export function serializeValue(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value === 'bigint')
+        return value.toString();
+    if (value instanceof Date)
+        return value.toISOString();
+    if (Buffer.isBuffer(value))
+        return `\\x${value.toString('hex')}`;
+    if (Array.isArray(value))
+        return value.map(serializeValue);
+    if (typeof value === 'object') {
+        const source = value;
+        if (typeof source.toFixed === 'function')
+            return String(value);
+        return Object.fromEntries(Object.entries(source).map(([key, entry]) => [key, serializeValue(entry)]));
+    }
+    return value;
+}
+export async function runAdminSql(input) {
+    const limit = Math.min(Math.max(input.limit ?? SQL_MAX_ROWS, 1), SQL_MAX_ROWS);
+    const statement = assertReadOnlySql(input.sql);
+    const query = buildBoundedQuery(statement, limit + 1);
+    logger.warn('Admin SQL console query', { userId: input.userId, sql: statement, limit });
+    const started = Date.now();
+    let rows;
+    try {
+        rows = await prisma.$transaction(async (tx) => {
+            await tx.$executeRawUnsafe('SET TRANSACTION READ ONLY');
+            await tx.$executeRawUnsafe(`SET LOCAL statement_timeout = ${SQL_TIMEOUT_MS}`);
+            return (await tx.$queryRawUnsafe(query));
+        });
+    }
+    catch (error) {
+        throw new TRPCError({
+            code: 'BAD_REQUEST',
+            message: error instanceof Error ? error.message : 'Query failed',
+            cause: error,
+        });
+    }
+    const durationMs = Date.now() - started;
+    const truncated = rows.length > limit;
+    const capped = truncated ? rows.slice(0, limit) : rows;
+    return {
+        columns: capped.length > 0 ? Object.keys(capped[0]) : [],
+        rows: capped.map((row) => Object.fromEntries(Object.entries(row).map(([key, value]) => [key, serializeValue(value)]))),
+        rowCount: capped.length,
+        truncated,
+        durationMs,
+    };
+}
+/** Schema browser for the console sidebar. */
+export async function listSqlSchemaForAdmin() {
+    const rows = (await prisma.$queryRawUnsafe(`
+    SELECT table_name, column_name, data_type, is_nullable
+    FROM information_schema.columns
+    WHERE table_schema = 'public'
+    ORDER BY table_name, ordinal_position
+  `));
+    const tables = new Map();
+    for (const row of rows) {
+        const table = tables.get(row.table_name) ?? { table: row.table_name, columns: [] };
+        table.columns.push({
+            name: row.column_name,
+            type: row.data_type,
+            nullable: row.is_nullable === 'YES',
+        });
+        tables.set(row.table_name, table);
+    }
+    return { tables: [...tables.values()] };
+}
+//# sourceMappingURL=adminSql.js.map
+//# debugId=45b19f90-7667-5cbe-b383-62162ed3eb2a

package/dist/services/adminSql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminSql.js","sources":["services/adminSql.ts"],"sourceRoot":"/","sourcesContent":["import { TRPCError } from '@trpc/server';\nimport { prisma } from '../lib/prisma.js';\nimport { logger } from '../utils/logger.js';\n\n/**\n * Read-only SQL console backing `admin.runSql`.\n *\n * Three independent guards, because a single one is not enough:\n * 1. the statement is parsed/validated here (single read statement only),\n * 2. it runs inside a `READ ONLY` transaction so the database rejects writes,\n * 3. a statement timeout and row cap bound the blast radius of a bad query.\n */\n\nconst READ_STARTERS = ['select', 'with', 'explain', 'show', 'table', 'values'];\n\n/** Statement keywords that must never appear, including inside CTEs. */\nconst FORBIDDEN_KEYWORDS = [\n  'insert',\n  'update',\n  'delete',\n  'merge',\n  'upsert',\n  'drop',\n  'alter',\n  'create',\n  'truncate',\n  'grant',\n  'revoke',\n  'comment',\n  'copy',\n  'vacuum',\n  'analyze',\n  'reindex',\n  'cluster',\n  'refresh',\n  'lock',\n  'listen',\n  'notify',\n  'call',\n  'do',\n  'set',\n  'reset',\n  'begin',\n  'commit',\n  'rollback',\n  'savepoint',\n  'prepare',\n  'execute',\n  'deallocate',\n  'discard',\n  'import',\n  'security',\n  'pg_read_file',\n  'pg_read_binary_file',\n  'pg_ls_dir',\n  'dblink',\n  'pg_sleep',\n];\n\nexport const SQL_MAX_ROWS = 500;\nexport const SQL_TIMEOUT_MS = 10_000;\n\nfunction stripCommentsAndStrings(sql: string): string {\n  return sql\n    .replace(/--[^\\n]*/g, ' ')\n    .replace(/\\/\\*[\\s\\S]*?\\*\\//g, ' ')\n    .replace(/'(?:[^']|'')*'/g, \"''\")\n    .replace(/\"(?:[^\"]|\"\")*\"/g, '\"\"');\n}\n\nfunction badRequest(message: string): TRPCError {\n  return new TRPCError({ code: 'BAD_REQUEST', message });\n}\n\n/**\n * Validates that `sql` is a single read-only statement and returns it without\n * its trailing semicolon. Throws a `BAD_REQUEST` otherwise.\n */\nexport function assertReadOnlySql(sql: string): string {\n  const statement = sql.trim().replace(/;\\s*$/, '').trim();\n  if (!statement) throw badRequest('Query is empty.');\n\n  const sanitized = stripCommentsAndStrings(statement).toLowerCase();\n\n  if (sanitized.includes(';')) {\n    throw badRequest('Only a single statement may be executed.');\n  }\n\n  const firstWord = sanitized.trim().split(/\\s+/)[0]?.replace(/^\\(+/, '') ?? '';\n  if (!READ_STARTERS.includes(firstWord)) {\n    throw badRequest(\n      `Only ${READ_STARTERS.map((word) => word.toUpperCase()).join('/')} queries are allowed.`,\n    );\n  }\n\n  const forbidden = FORBIDDEN_KEYWORDS.find((keyword) =>\n    new RegExp(`\\\\b${keyword}\\\\b`).test(sanitized),\n  );\n  if (forbidden) {\n    throw badRequest(`Keyword \"${forbidden.toUpperCase()}\" is not allowed in the SQL console.`);\n  }\n\n  return statement;\n}\n\n/** Wraps row-returning statements so the row cap is enforced by the database. */\nexport function buildBoundedQuery(statement: string, limit: number): string {\n  const firstWord = stripCommentsAndStrings(statement).trim().toLowerCase().split(/\\s+/)[0] ?? '';\n  if (firstWord === 'explain' || firstWord === 'show') return statement;\n  return `SELECT * FROM (${statement}) AS admin_sql_console LIMIT ${limit}`;\n}\n\n/** JSON-safe values: Prisma returns bigints, dates, buffers and Decimals raw. */\nexport function serializeValue(value: unknown): unknown {\n  if (value === null || value === undefined) return null;\n  if (typeof value === 'bigint') return value.toString();\n  if (value instanceof Date) return value.toISOString();\n  if (Buffer.isBuffer(value)) return `\\\\x${value.toString('hex')}`;\n  if (Array.isArray(value)) return value.map(serializeValue);\n  if (typeof value === 'object') {\n    const source = value as Record<string, unknown>;\n    if (typeof source.toFixed === 'function') return String(value);\n    return Object.fromEntries(\n      Object.entries(source).map(([key, entry]) => [key, serializeValue(entry)]),\n    );\n  }\n  return value;\n}\n\nexport type AdminSqlResult = {\n  columns: string[];\n  rows: Record<string, unknown>[];\n  rowCount: number;\n  truncated: boolean;\n  durationMs: number;\n};\n\nexport async function runAdminSql(input: {\n  sql: string;\n  limit?: number;\n  userId?: string;\n}): Promise<AdminSqlResult> {\n  const limit = Math.min(Math.max(input.limit ?? SQL_MAX_ROWS, 1), SQL_MAX_ROWS);\n  const statement = assertReadOnlySql(input.sql);\n  const query = buildBoundedQuery(statement, limit + 1);\n\n  logger.warn('Admin SQL console query', { userId: input.userId, sql: statement, limit });\n\n  const started = Date.now();\n  let rows: Record<string, unknown>[];\n  try {\n    rows = await prisma.$transaction(async (tx) => {\n      await tx.$executeRawUnsafe('SET TRANSACTION READ ONLY');\n      await tx.$executeRawUnsafe(`SET LOCAL statement_timeout = ${SQL_TIMEOUT_MS}`);\n      return (await tx.$queryRawUnsafe(query)) as Record<string, unknown>[];\n    });\n  } catch (error) {\n    throw new TRPCError({\n      code: 'BAD_REQUEST',\n      message: error instanceof Error ? error.message : 'Query failed',\n      cause: error,\n    });\n  }\n\n  const durationMs = Date.now() - started;\n  const truncated = rows.length > limit;\n  const capped = truncated ? rows.slice(0, limit) : rows;\n\n  return {\n    columns: capped.length > 0 ? Object.keys(capped[0]) : [],\n    rows: capped.map(\n      (row) =>\n        Object.fromEntries(\n          Object.entries(row).map(([key, value]) => [key, serializeValue(value)]),\n        ) as Record<string, unknown>,\n    ),\n    rowCount: capped.length,\n    truncated,\n    durationMs,\n  };\n}\n\nexport type AdminSqlTable = {\n  table: string;\n  columns: { name: string; type: string; nullable: boolean }[];\n};\n\n/** Schema browser for the console sidebar. */\nexport async function listSqlSchemaForAdmin(): Promise<{ tables: AdminSqlTable[] }> {\n  const rows = (await prisma.$queryRawUnsafe(`\n    SELECT table_name, column_name, data_type, is_nullable\n    FROM information_schema.columns\n    WHERE table_schema = 'public'\n    ORDER BY table_name, ordinal_position\n  `)) as {\n    table_name: string;\n    column_name: string;\n    data_type: string;\n    is_nullable: string;\n  }[];\n\n  const tables = new Map<string, AdminSqlTable>();\n  for (const row of rows) {\n    const table = tables.get(row.table_name) ?? { table: row.table_name, columns: [] };\n    table.columns.push({\n      name: row.column_name,\n      type: row.data_type,\n      nullable: row.is_nullable === 'YES',\n    });\n    tables.set(row.table_name, table);\n  }\n\n  return { tables: [...tables.values()] };\n}\n"],"names":[],"mappings":";;AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C;;;;;;;GAOG;AAEH,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAE/E,wEAAwE;AACxE,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,OAAO;IACP,QAAQ;IACR,SAAS;IACT,MAAM;IACN,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,KAAK;IACL,OAAO;IACP,OAAO;IACP,QAAQ;IACR,UAAU;IACV,WAAW;IACX,SAAS;IACT,SAAS;IACT,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,UAAU;IACV,cAAc;IACd,qBAAqB;IACrB,WAAW;IACX,QAAQ;IACR,UAAU;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAC;AAChC,MAAM,CAAC,MAAM,cAAc,GAAG,KAAM,CAAC;AAErC,SAAS,uBAAuB,CAAC,GAAW;IAC1C,OAAO,GAAG;SACP,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;SACzB,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC;SACjC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC;SAChC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,SAAS;QAAE,MAAM,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAEpD,MAAM,SAAS,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnE,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,UAAU,CAAC,0CAA0C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,UAAU,CACd,QAAQ,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACpD,IAAI,MAAM,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAC/C,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,UAAU,CAAC,YAAY,SAAS,CAAC,WAAW,EAAE,sCAAsC,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,KAAa;IAChE,MAAM,SAAS,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChG,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACtE,OAAO,kBAAkB,SAAS,gCAAgC,KAAK,EAAE,CAAC;AAC5E,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IACvD,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACjE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAIjC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAEtD,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAExF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,IAA+B,CAAC;IACpC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC5C,MAAM,EAAE,CAAC,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;YACxD,MAAM,EAAE,CAAC,iBAAiB,CAAC,iCAAiC,cAAc,EAAE,CAAC,CAAC;YAC9E,OAAO,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAA8B,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc;YAChE,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACxD,IAAI,EAAE,MAAM,CAAC,GAAG,CACd,CAAC,GAAG,EAAE,EAAE,CACN,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAC7C,CAC/B;QACD,QAAQ,EAAE,MAAM,CAAC,MAAM;QACvB,SAAS;QACT,UAAU;KACX,CAAC;AACJ,CAAC;AAOD,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,eAAe,CAAC;;;;;GAK1C,CAAC,CAKC,CAAC;IAEJ,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACnF,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,GAAG,CAAC,WAAW;YACrB,IAAI,EAAE,GAAG,CAAC,SAAS;YACnB,QAAQ,EAAE,GAAG,CAAC,WAAW,KAAK,KAAK;SACpC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC1C,CAAC","debug_id":"45b19f90-7667-5cbe-b383-62162ed3eb2a"}

package/dist/services/adminTelemetry.d.ts

@@ -0,0 +1,56 @@
+export type DailyPoint = {
+    date: string;
+    signups: number;
+    logins: number;
+    assignments: number;
+    submissions: number;
+    messages: number;
+};
+/**
+ * Per-day platform activity for the last `days` days, zero-filled so the admin
+ * chart always has one point per day even when nothing happened.
+ */
+export declare function getActivitySeriesForAdmin(input: {
+    days: number;
+}): Promise<{
+    points: DailyPoint[];
+}>;
+/** Content inventory plus AI/job health, i.e. "what is actually on the platform". */
+export declare function getContentTelemetryForAdmin(): Promise<{
+    content: {
+        assignments: number;
+        assignmentsLast7d: number;
+        submissions: number;
+        submissionsLast7d: number;
+        gradedSubmissions: number;
+        announcements: number;
+        announcementsLast7d: number;
+        discussions: number;
+        messages: number;
+        messagesLast7d: number;
+        worksheets: number;
+        events: number;
+        modules: number;
+        files: number;
+        storageBytes: number;
+    };
+    ai: {
+        calls7d: number;
+        failures7d: number;
+        tokens7d: number;
+        byModel: {
+            model: string;
+            calls: number;
+            tokens: number;
+        }[];
+    };
+    jobs: {
+        failedLast24h: number;
+        byType: {
+            total: number;
+            failed: number;
+            type: string;
+        }[];
+    };
+}>;
+//# sourceMappingURL=adminTelemetry.d.ts.map

package/dist/services/adminTelemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminTelemetry.d.ts","sourceRoot":"/","sources":["services/adminTelemetry.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAkCF;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CA6BpC;AAED,qFAAqF;AACrF,wBAAsB,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAkEH,MAAM;oBAAU,MAAM;;;;GA6CnE"}