@takosjp/yurucommu-core 3.0.0

package/src/backend/routes/communities/membership-invites.ts

@@ -0,0 +1,208 @@
+import type { Context, Hono } from "hono";
+import { and, count, desc, eq, gt, isNull, or } from "drizzle-orm";
+import { communityInvites } from "../../../db/index.ts";
+import type { Env, Variables } from "../../types.ts";
+import { formatUsername, generateId } from "../../federation-helpers.ts";
+import {
+  batchLoadActorInfo,
+  fetchCommunityId,
+  requireManager,
+} from "./membership-shared.ts";
+
+// Newest-first cap on the manager invite list (bounds response size).
+const INVITE_LIST_MAX = 200;
+// Cap on outstanding (unused, unexpired) invites per community so a manager
+// can't grow community_invites without bound.
+const MAX_OUTSTANDING_INVITES = 200;
+
+export function registerMembershipInviteRoutes(
+  communitiesRouter: Hono<{ Bindings: Env; Variables: Variables }>,
+) {
+  // GET /api/communities/:identifier/invites - List invites
+  communitiesRouter.get(
+    "/:identifier/invites",
+    async (c: Context<{ Bindings: Env; Variables: Variables }>) => {
+      const actor = c.get("actor");
+      if (!actor) return c.json({ error: "Unauthorized" }, 401);
+
+      const identifier = c.req.param("identifier")!;
+      const db = c.get("db");
+
+      const { community } = await fetchCommunityId(c, identifier);
+      if (!community) {
+        return c.json({ error: "Community not found" }, 404);
+      }
+
+      const manager = await requireManager(db, community.apId, actor.ap_id);
+      if (!manager) {
+        return c.json({ error: "Forbidden" }, 403);
+      }
+
+      // Cap the manager invite list (newest-first) so the response can't grow
+      // unbounded with invite-row count.
+      const invites = await db
+        .select()
+        .from(communityInvites)
+        .where(eq(communityInvites.communityApId, community.apId))
+        .orderBy(desc(communityInvites.createdAt))
+        .limit(INVITE_LIST_MAX);
+
+      const invitedByApIds = [
+        ...new Set(invites.map((inv) => inv.invitedByApId)),
+      ];
+      const actorInfoMap = await batchLoadActorInfo(db, invitedByApIds, false);
+
+      const result = invites.map((inv) => {
+        const invitedByInfo = actorInfoMap.get(inv.invitedByApId);
+        return {
+          id: inv.id,
+          invited_ap_id: inv.invitedApId,
+          invited_by: {
+            ap_id: inv.invitedByApId,
+            username: formatUsername(inv.invitedByApId),
+            preferred_username: invitedByInfo?.preferredUsername || null,
+            name: invitedByInfo?.name || null,
+          },
+          created_at: inv.createdAt,
+          expires_at: inv.expiresAt,
+          used_at: inv.usedAt,
+          used_by_ap_id: inv.usedByApId,
+          is_valid:
+            !inv.usedAt &&
+            (!inv.expiresAt || new Date(inv.expiresAt) > new Date()),
+        };
+      });
+
+      return c.json({ invites: result });
+    },
+  );
+
+  // POST /api/communities/:identifier/invites - Create invite
+  communitiesRouter.post(
+    "/:identifier/invites",
+    async (c: Context<{ Bindings: Env; Variables: Variables }>) => {
+      const actor = c.get("actor");
+      if (!actor) return c.json({ error: "Unauthorized" }, 401);
+
+      const identifier = c.req.param("identifier")!;
+      const db = c.get("db");
+      let invitedApId: string | null = null;
+      let expiresInHours: number | null = null;
+      try {
+        const body = await c.req.json<{
+          invited_ap_id?: string;
+          expires_in_hours?: number;
+        }>();
+        invitedApId =
+          typeof body.invited_ap_id === "string"
+            ? body.invited_ap_id.trim() || null
+            : null;
+        // Only accept a finite POSITIVE number. A non-numeric value (the JSON
+        // type isn't enforced at runtime) would flow into `new Date(now + h*…)`
+        // below as NaN and throw a RangeError on .toISOString() → 500.
+        expiresInHours =
+          typeof body.expires_in_hours === "number" &&
+          Number.isFinite(body.expires_in_hours) &&
+          body.expires_in_hours > 0
+            ? body.expires_in_hours
+            : null;
+      } catch {
+        invitedApId = null;
+        expiresInHours = null;
+      }
+
+      const { community } = await fetchCommunityId(c, identifier);
+      if (!community) {
+        return c.json({ error: "Community not found" }, 404);
+      }
+
+      const manager = await requireManager(db, community.apId, actor.ap_id);
+      if (!manager) {
+        return c.json({ error: "Forbidden" }, 403);
+      }
+
+      // Bound outstanding (unused, unexpired) invites per community so a manager
+      // can't loop create and grow community_invites without limit.
+      const nowIso = new Date().toISOString();
+      const outstanding = await db
+        .select({ n: count() })
+        .from(communityInvites)
+        .where(
+          and(
+            eq(communityInvites.communityApId, community.apId),
+            isNull(communityInvites.usedAt),
+            or(
+              isNull(communityInvites.expiresAt),
+              gt(communityInvites.expiresAt, nowIso),
+            ),
+          ),
+        )
+        .get();
+      if ((outstanding?.n ?? 0) >= MAX_OUTSTANDING_INVITES) {
+        return c.json({ error: "Too many outstanding invites" }, 429);
+      }
+
+      const inviteId = generateId();
+      const now = new Date();
+      const expiresAt = expiresInHours
+        ? new Date(
+            now.getTime() + expiresInHours * 60 * 60 * 1000,
+          ).toISOString()
+        : null;
+
+      await db.insert(communityInvites).values({
+        id: inviteId,
+        communityApId: community.apId,
+        invitedByApId: actor.ap_id,
+        invitedApId,
+        createdAt: now.toISOString(),
+        expiresAt,
+      });
+
+      return c.json({ invite_id: inviteId, expires_at: expiresAt });
+    },
+  );
+
+  // DELETE /api/communities/:identifier/invites/:inviteId - Revoke invite
+  communitiesRouter.delete(
+    "/:identifier/invites/:inviteId",
+    async (c: Context<{ Bindings: Env; Variables: Variables }>) => {
+      const actor = c.get("actor");
+      if (!actor) return c.json({ error: "Unauthorized" }, 401);
+
+      const identifier = c.req.param("identifier")!;
+      const inviteId = c.req.param("inviteId")!;
+      const db = c.get("db");
+
+      const { community } = await fetchCommunityId(c, identifier);
+      if (!community) {
+        return c.json({ error: "Community not found" }, 404);
+      }
+
+      const manager = await requireManager(db, community.apId, actor.ap_id);
+      if (!manager) {
+        return c.json({ error: "Forbidden" }, 403);
+      }
+
+      const invite = await db
+        .select()
+        .from(communityInvites)
+        .where(
+          and(
+            eq(communityInvites.id, inviteId),
+            eq(communityInvites.communityApId, community.apId),
+          ),
+        )
+        .get();
+      if (!invite) {
+        return c.json({ error: "Invite not found" }, 404);
+      }
+
+      await db
+        .delete(communityInvites)
+        .where(eq(communityInvites.id, inviteId));
+
+      return c.json({ success: true });
+    },
+  );
+}

package/src/backend/routes/communities/membership-join.ts

@@ -0,0 +1,335 @@
+import type { Context, Hono } from "hono";
+import { and, eq, gt, isNull, or, sql } from "drizzle-orm";
+import {
+  affectedRowCount,
+  communities,
+  communityInvites,
+  communityJoinRequests,
+  communityMembers,
+} from "../../../db/index.ts";
+import type { Env, Variables } from "../../types.ts";
+import {
+  fetchCommunityDetails,
+  isMemberBanned,
+  memberWhere,
+  removeMemberAtomic,
+  removeOwnerIfAnotherExists,
+  unbanMember,
+} from "./membership-shared.ts";
+import { isUniqueConstraintError } from "../../lib/parse-helpers.ts";
+import { logger } from "../../lib/logger.ts";
+
+const log = logger.child({ component: "communities.join" });
+
+/**
+ * Narrow view over the concrete D1/libsql drizzle client's atomic batch API.
+ * The shared `Database` union type does not surface `batch` (it lives on the
+ * concrete subclasses), so we reach it through a structural cast at the one
+ * call site that needs an atomic multi-statement write.
+ */
+type Batchable = {
+  batch(statements: readonly unknown[]): Promise<unknown>;
+};
+
+export function registerMembershipJoinRoutes(
+  communitiesRouter: Hono<{ Bindings: Env; Variables: Variables }>,
+) {
+  // POST /api/communities/:identifier/join - Join a community
+  communitiesRouter.post(
+    "/:identifier/join",
+    async (c: Context<{ Bindings: Env; Variables: Variables }>) => {
+      const actor = c.get("actor");
+      if (!actor) return c.json({ error: "Unauthorized" }, 401);
+
+      const identifier = c.req.param("identifier")!;
+      const db = c.get("db");
+
+      let inviteId: string | undefined;
+      try {
+        const body = await c.req.json<{ invite_id?: string }>();
+        inviteId = body.invite_id?.trim() || undefined;
+      } catch {
+        inviteId = undefined;
+      }
+
+      const { community } = await fetchCommunityDetails(c, identifier);
+      if (!community) {
+        return c.json({ error: "Community not found" }, 404);
+      }
+
+      // Check if already member
+      const existing = await db
+        .select()
+        .from(communityMembers)
+        .where(memberWhere(community.apId, actor.ap_id))
+        .get();
+      if (existing) {
+        return c.json({ error: "Already a member" }, 409);
+      }
+
+      const now = new Date().toISOString();
+
+      // A PRIVATE community must never be OPENLY self-joinable — open join would
+      // let ANY logged-in actor join and thereby read its members-only content,
+      // defeating the privacy. If an owner left joinPolicy="open" while flipping
+      // the community private, treat the join as "approval" (held pending) so the
+      // owner still gates who gets in. Invite-policy is unaffected.
+      const effectiveJoinPolicy =
+        community.visibility === "private" && community.joinPolicy === "open"
+          ? "approval"
+          : community.joinPolicy;
+
+      if (effectiveJoinPolicy === "approval") {
+        // Upsert: check if exists, then insert or update
+        const existingRequest = await db
+          .select()
+          .from(communityJoinRequests)
+          .where(
+            and(
+              eq(communityJoinRequests.communityApId, community.apId),
+              eq(communityJoinRequests.actorApId, actor.ap_id),
+            ),
+          )
+          .get();
+
+        if (existingRequest) {
+          await db
+            .update(communityJoinRequests)
+            .set({ status: "pending", createdAt: now, processedAt: null })
+            .where(
+              and(
+                eq(communityJoinRequests.communityApId, community.apId),
+                eq(communityJoinRequests.actorApId, actor.ap_id),
+              ),
+            );
+        } else {
+          // onConflictDoNothing so two concurrent first-time join requests by
+          // the same actor (double-click / retry) don't 500 the loser on the
+          // (communityApId, actorApId) composite PK — the request is idempotent
+          // (matches the invite-join / open-join branches' unique handling).
+          await db
+            .insert(communityJoinRequests)
+            .values({
+              communityApId: community.apId,
+              actorApId: actor.ap_id,
+              status: "pending",
+              createdAt: now,
+            })
+            .onConflictDoNothing();
+        }
+
+        return c.json({ success: true, status: "pending" });
+      }
+
+      if (effectiveJoinPolicy === "invite") {
+        if (!inviteId) {
+          return c.json(
+            { error: "Invite required", status: "invite_required" },
+            403,
+          );
+        }
+
+        try {
+          // Find the invite
+          const invite = await db
+            .select()
+            .from(communityInvites)
+            .where(
+              and(
+                eq(communityInvites.id, inviteId),
+                eq(communityInvites.communityApId, community.apId),
+                isNull(communityInvites.usedAt),
+                or(
+                  isNull(communityInvites.expiresAt),
+                  gt(communityInvites.expiresAt, now),
+                ),
+              ),
+            )
+            .get();
+
+          if (!invite) {
+            return c.json(
+              {
+                error: "Invalid or expired invite",
+                status: "invite_required",
+              },
+              403,
+            );
+          }
+          if (invite.invitedApId && invite.invitedApId !== actor.ap_id) {
+            return c.json(
+              {
+                error: "Invite not for this account",
+                status: "invite_required",
+              },
+              403,
+            );
+          }
+
+          // Claim the invite FIRST — this conditional single-use UPDATE is the
+          // race GATE. Only the writer that flips usedAt from NULL (affecting
+          // exactly one row) is allowed to materialize the membership; a racing
+          // loser sees 0 rows affected and is rejected, so it never leaves a
+          // phantom member row or an inflated memberCount behind.
+          const claimResult = await db
+            .update(communityInvites)
+            .set({ usedByApId: actor.ap_id, usedAt: now })
+            .where(
+              and(
+                eq(communityInvites.id, inviteId),
+                eq(communityInvites.communityApId, community.apId),
+                isNull(communityInvites.usedAt),
+                or(
+                  isNull(communityInvites.expiresAt),
+                  gt(communityInvites.expiresAt, now),
+                ),
+                or(
+                  isNull(communityInvites.invitedApId),
+                  eq(communityInvites.invitedApId, actor.ap_id),
+                ),
+              ),
+            );
+          if (affectedRowCount(claimResult) !== 1) {
+            // Lost the single-use claim race (or invite was used/expired
+            // between the read above and this write). Reject without touching
+            // membership or the count.
+            return c.json(
+              {
+                error: "Invalid or expired invite",
+                status: "invite_required",
+              },
+              403,
+            );
+          }
+
+          // Won the claim: create the member + bump the count atomically.
+          // D1 has no interactive transactions; group the member insert and
+          // the counter increment into a single batch so they cannot diverge.
+          // The `Database` union type does not surface `batch` (it is only on
+          // the concrete D1/libsql subclasses), so reach it through a narrow
+          // structural cast.
+          const memberInsert = db.insert(communityMembers).values({
+            communityApId: community.apId,
+            actorApId: actor.ap_id,
+            role: "member",
+            joinedAt: now,
+          });
+          const countBump = db
+            .update(communities)
+            .set({ memberCount: sql`${communities.memberCount} + 1` })
+            .where(eq(communities.apId, community.apId));
+          await (db as unknown as Batchable).batch([memberInsert, countBump]);
+
+          // Consuming a valid invite is an explicit re-admission — lift any ban.
+          await unbanMember(db, community.apId, actor.ap_id);
+          return c.json({ success: true, status: "joined" });
+        } catch (error) {
+          if (isUniqueConstraintError(error)) {
+            return c.json({ error: "Already a member" }, 409);
+          }
+          log.error("Failed to join with invite", {
+            event: "communities.join.invite_failed",
+            community: community.apId,
+            actor: actor.ap_id,
+            error,
+          });
+          return c.json({ error: "Failed to join community" }, 500);
+        }
+      }
+
+      // Durable ban: a removed member cannot self-rejoin via OPEN join (the
+      // auto-admit path the kick was meant to stop). Approval (a mod decides)
+      // and invite (explicit re-admission) paths above stay open and lift the
+      // ban on success, so a moderator can always let someone back in.
+      if (await isMemberBanned(db, community.apId, actor.ap_id)) {
+        return c.json(
+          {
+            error: "You have been removed from this community",
+            status: "banned",
+          },
+          403,
+        );
+      }
+
+      // Open join — create the member + bump the count atomically. D1 has no
+      // interactive transactions; group the member insert and the counter
+      // increment into a single batch so they cannot diverge on a mid-request
+      // failure (matching the invite-join path). The `Database` union type does
+      // not surface `batch` (it is only on the concrete D1/libsql subclasses),
+      // so reach it through a narrow structural cast.
+      try {
+        const memberInsert = db.insert(communityMembers).values({
+          communityApId: community.apId,
+          actorApId: actor.ap_id,
+          role: "member",
+          joinedAt: now,
+        });
+        const countBump = db
+          .update(communities)
+          .set({ memberCount: sql`${communities.memberCount} + 1` })
+          .where(eq(communities.apId, community.apId));
+        await (db as unknown as Batchable).batch([memberInsert, countBump]);
+
+        return c.json({ success: true, status: "joined" });
+      } catch (error) {
+        if (isUniqueConstraintError(error)) {
+          return c.json({ error: "Already a member" }, 409);
+        }
+        log.error("Failed to join community", {
+          event: "communities.join.failed",
+          community: community.apId,
+          actor: actor.ap_id,
+          error,
+        });
+        return c.json({ error: "Failed to join community" }, 500);
+      }
+    },
+  );
+
+  // POST /api/communities/:identifier/leave - Leave a community
+  communitiesRouter.post(
+    "/:identifier/leave",
+    async (c: Context<{ Bindings: Env; Variables: Variables }>) => {
+      const actor = c.get("actor");
+      if (!actor) return c.json({ error: "Unauthorized" }, 401);
+
+      const identifier = c.req.param("identifier")!;
+      const db = c.get("db");
+
+      const { community } = await fetchCommunityDetails(c, identifier);
+      if (!community) {
+        return c.json({ error: "Community not found" }, 404);
+      }
+
+      const membership = await db
+        .select()
+        .from(communityMembers)
+        .where(memberWhere(community.apId, actor.ap_id))
+        .get();
+      if (!membership) {
+        return c.json({ error: "Not a member" }, 400);
+      }
+
+      // Don't allow the last owner to leave. Enforced ATOMICALLY rather than as
+      // a count(owners) > 1 check then a separate delete — that is a TOCTOU two
+      // concurrent owners can both pass, leaving the community with ZERO owners.
+      // removeOwnerIfAnotherExists conditions the delete on another owner still
+      // existing and reports whether it removed.
+      if (membership.role === "owner") {
+        const removed = await removeOwnerIfAnotherExists(
+          db,
+          community.apId,
+          actor.ap_id,
+        );
+        if (!removed) {
+          return c.json({ error: "Cannot leave: you are the only owner" }, 400);
+        }
+        return c.json({ success: true });
+      }
+
+      await removeMemberAtomic(db, community.apId, actor.ap_id);
+
+      return c.json({ success: true });
+    },
+  );
+}