@takosjp/yurucommu-core 3.0.0

package/src/backend/routes/communities/routes.ts

@@ -0,0 +1,624 @@
+import { Hono } from "hono";
+import {
+  and,
+  asc,
+  count,
+  desc,
+  eq,
+  inArray,
+  isNull,
+  or,
+  sql,
+} from "drizzle-orm";
+import {
+  communities,
+  communityJoinRequests,
+  communityMembers,
+  mediaUploads,
+  objects,
+} from "../../../db/index.ts";
+import type { Database } from "../../../db/index.ts";
+import type { Env, Variables } from "../../types.ts";
+import {
+  communityApId,
+  generateKeyPair,
+  parseLimit,
+  parseOffset,
+} from "../../federation-helpers.ts";
+import {
+  fetchCommunityId,
+  memberWhere,
+  requireManager,
+} from "./membership-shared.ts";
+import { isUniqueConstraintError } from "../../lib/parse-helpers.ts";
+import { communityRequiresMembership } from "../../lib/community-visibility.ts";
+import { reapReplacedMediaUrl } from "../posts/delete-cascade.ts";
+
+/**
+ * Narrow view over the concrete D1/libsql drizzle client's atomic batch API.
+ * The shared `Database` union type does not surface `batch` (it lives on the
+ * concrete subclasses), so we reach it through a structural cast at the call
+ * sites that need an atomic multi-statement write.
+ */
+type Batchable = {
+  batch(statements: readonly unknown[]): Promise<unknown>;
+};
+
+const communitiesRouter = new Hono<{ Bindings: Env; Variables: Variables }>();
+
+function isValidCommunityIconUrl(value: string): boolean {
+  const trimmed = value.trim();
+  if (trimmed.startsWith("/media/")) return true;
+  try {
+    const parsed = new URL(trimmed);
+    return parsed.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * A local `/media/...` icon URL must reference an upload the SETTER owns.
+ * Otherwise a user could point their community's icon at another user's
+ * (possibly private) blob, and the media-authorization layer would treat the
+ * icon reference as a public grant — a cross-user media IDOR. External
+ * (https) URLs are not local blobs, so this gate only applies to `/media/`.
+ * Mirrors reapReplacedMediaUrl's uploader-scoped lookup.
+ */
+async function isOwnLocalMediaUrl(
+  db: Database,
+  url: string,
+  ownerApId: string,
+): Promise<boolean> {
+  if (!url.startsWith("/media/")) return false;
+  const filename = url.slice("/media/".length);
+  if (!filename || filename.includes("/") || filename.includes("..")) {
+    return false;
+  }
+  const r2Key = `uploads/${filename}`;
+  const owned = await db
+    .select({ id: mediaUploads.id })
+    .from(mediaUploads)
+    .where(
+      and(
+        eq(mediaUploads.r2Key, r2Key),
+        eq(mediaUploads.uploaderApId, ownerApId),
+      ),
+    )
+    .get();
+  return !!owned;
+}
+
+const RESERVED_NAMES = new Set([
+  "admin",
+  "administrator",
+  "system",
+  "root",
+  "moderator",
+  "mod",
+  "community",
+  "communities",
+  "group",
+  "groups",
+  "user",
+  "users",
+  "api",
+  "ap",
+  "activitypub",
+  "webfinger",
+  "well_known",
+  "settings",
+  "config",
+  "configuration",
+  "help",
+  "support",
+  "about",
+  "terms",
+  "privacy",
+  "legal",
+  "dmca",
+  "copyright",
+  "login",
+  "logout",
+  "register",
+  "signup",
+  "signin",
+  "auth",
+  "null",
+  "undefined",
+  "true",
+  "false",
+  "test",
+  "demo",
+]);
+
+function validateCommunityName(name: string | undefined): string | null {
+  if (!name || name.trim().length < 2) {
+    return "Name must be at least 2 characters";
+  }
+  const trimmed = name.trim();
+  if (trimmed.length > 32) return "Name must be at most 32 characters";
+  if (!/^[a-zA-Z0-9_]+$/.test(trimmed)) {
+    return "Name can only contain letters, numbers, and underscores";
+  }
+  if (RESERVED_NAMES.has(trimmed.toLowerCase())) return "This name is reserved";
+  if (/^\d+$/.test(trimmed)) return "Name cannot be all numbers";
+  if (trimmed.startsWith("_") || trimmed.endsWith("_")) {
+    return "Name cannot start or end with underscore";
+  }
+  return null;
+}
+
+// Cosmetic community profile caps. The handle (`name`/preferredUsername) is
+// strictly validated above, but display_name and summary were stored raw with
+// no server-side bound — a direct API caller could persist an arbitrarily large
+// summary that then bloats every federated actor fetch. Mirror the client
+// CreateScopeModal maxlengths (64 / 500) so create and update agree.
+const MAX_COMMUNITY_DISPLAY_NAME_LENGTH = 64;
+const MAX_COMMUNITY_SUMMARY_LENGTH = 500;
+
+function validateCommunityProfile(
+  displayName: string | undefined,
+  summary: string | undefined,
+): string | null {
+  if (
+    displayName !== undefined &&
+    displayName.length > MAX_COMMUNITY_DISPLAY_NAME_LENGTH
+  ) {
+    return `Display name must be at most ${MAX_COMMUNITY_DISPLAY_NAME_LENGTH} characters`;
+  }
+  if (summary !== undefined && summary.length > MAX_COMMUNITY_SUMMARY_LENGTH) {
+    return `Summary must be at most ${MAX_COMMUNITY_SUMMARY_LENGTH} characters`;
+  }
+  return null;
+}
+
+// GET /api/communities - List all communities
+communitiesRouter.get("/", async (c) => {
+  const actor = c.get("actor");
+  const db = c.get("db");
+  // Capped at 90: this page's communityApIds are re-queried via `inArray` for
+  // membership/pending-join enrichment, and Cloudflare D1 allows at most 100
+  // bound parameters per query (the unclamped fallback must be <=90 too). Offset
+  // paginates the rest.
+  const limit = parseLimit(c.req.query("limit"), 90, 90);
+  const offset = parseOffset(c.req.query("offset"), 0, 10000);
+
+  const actorApIdVal = actor?.ap_id || "";
+
+  // Discovery list visibility: never expose deleted communities, and never leak
+  // a PRIVATE community (its name/summary/member-count/existence) to someone who
+  // is not a member — `visibility !== 'public'` is the members-only gate enforced
+  // on content/member-list reads elsewhere, so it must gate discovery too. A
+  // logged-in viewer additionally sees the private communities they belong to;
+  // anonymous callers see only public ones.
+  const memberCommunityIds = db
+    .select({ id: communityMembers.communityApId })
+    .from(communityMembers)
+    .where(eq(communityMembers.actorApId, actorApIdVal));
+  const visibilityFilter = actorApIdVal
+    ? or(
+        eq(communities.visibility, "public"),
+        inArray(communities.apId, memberCommunityIds),
+      )
+    : eq(communities.visibility, "public");
+
+  // Project only the columns the response renders — never pull the public/
+  // PRIVATE key PEM material (communities.publicKeyPem/privateKeyPem) into the
+  // worker on this hot list path.
+  const communitiesList = await db
+    .select({
+      apId: communities.apId,
+      preferredUsername: communities.preferredUsername,
+      name: communities.name,
+      summary: communities.summary,
+      iconUrl: communities.iconUrl,
+      visibility: communities.visibility,
+      joinPolicy: communities.joinPolicy,
+      postPolicy: communities.postPolicy,
+      memberCount: communities.memberCount,
+      createdAt: communities.createdAt,
+      lastMessageAt: communities.lastMessageAt,
+    })
+    .from(communities)
+    .where(and(isNull(communities.deletedAt), visibilityFilter))
+    .orderBy(
+      sql`CASE WHEN ${communities.lastMessageAt} IS NULL THEN 1 ELSE 0 END`,
+      desc(communities.lastMessageAt),
+      asc(communities.createdAt),
+    )
+    .limit(limit)
+    .offset(offset);
+
+  // Batch load membership (with role) and join request status for current actor
+  // to avoid N+1. member_role is needed so the client can build accurate scopes
+  // (atoms/scope.ts) instead of asserting a bogus role for joined communities.
+  const communityApIds = communitiesList.map((c) => c.apId);
+  const memberRoleMap = new Map<string, string>();
+  const pendingRequestSet = new Set<string>();
+
+  if (actorApIdVal && communityApIds.length > 0) {
+    const [memberships, joinRequests] = await Promise.all([
+      db
+        .select({
+          communityApId: communityMembers.communityApId,
+          role: communityMembers.role,
+        })
+        .from(communityMembers)
+        .where(
+          and(
+            eq(communityMembers.actorApId, actorApIdVal),
+            inArray(communityMembers.communityApId, communityApIds),
+          ),
+        ),
+      db
+        .select({ communityApId: communityJoinRequests.communityApId })
+        .from(communityJoinRequests)
+        .where(
+          and(
+            eq(communityJoinRequests.actorApId, actorApIdVal),
+            inArray(communityJoinRequests.communityApId, communityApIds),
+            eq(communityJoinRequests.status, "pending"),
+          ),
+        ),
+    ]);
+
+    for (const m of memberships) memberRoleMap.set(m.communityApId, m.role);
+    for (const r of joinRequests) pendingRequestSet.add(r.communityApId);
+  }
+
+  const result = communitiesList.map((community) => {
+    const memberRole = memberRoleMap.get(community.apId) ?? null;
+    const isMember = memberRole !== null;
+    const joinStatus =
+      !isMember && pendingRequestSet.has(community.apId) ? "pending" : null;
+
+    return {
+      ap_id: community.apId,
+      name: community.preferredUsername,
+      display_name: community.name,
+      summary: community.summary,
+      icon_url: community.iconUrl,
+      visibility: community.visibility,
+      join_policy: community.joinPolicy,
+      post_policy: community.postPolicy,
+      member_count: community.memberCount,
+      created_at: community.createdAt,
+      last_message_at: community.lastMessageAt,
+      is_member: isMember,
+      member_role: memberRole,
+      join_status: joinStatus,
+    };
+  });
+
+  return c.json({ communities: result });
+});
+
+// POST /api/communities - Create a new community
+communitiesRouter.post("/", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "Unauthorized" }, 401);
+
+  const db = c.get("db");
+
+  const body = await c.req.json<{
+    name: string;
+    display_name?: string;
+    summary?: string;
+  }>();
+
+  // Type-check before trimming: `?.` only guards null/undefined, so a non-string
+  // `name` (e.g. a JSON number) would throw a TypeError → 500. undefined falls
+  // through to validateCommunityName, which rejects it with a 400.
+  const name = typeof body.name === "string" ? body.name.trim() : undefined;
+  const nameError = validateCommunityName(name);
+  if (nameError) return c.json({ error: nameError }, 400);
+  const profileError = validateCommunityProfile(
+    body.display_name,
+    body.summary,
+  );
+  if (profileError) return c.json({ error: profileError }, 400);
+
+  // name is guaranteed non-null after validateCommunityName passes
+  const validName = name!;
+  const baseUrl = c.env.APP_URL;
+  const apId = communityApId(baseUrl, validName);
+  const now = new Date().toISOString();
+
+  const inboxUrl = `${apId}/inbox`;
+  const outbox = `${apId}/outbox`;
+  const followersUrl = `${apId}/followers`;
+
+  const { publicKeyPem, privateKeyPem } = await generateKeyPair();
+
+  // Create community and owner member. D1 has no interactive transactions, so
+  // group the community insert (which carries memberCount: 1) and the owner
+  // membership insert into a single atomic batch — otherwise a mid-write failure
+  // could leave an owner-less community (or a member row without its community).
+  // The `Database` union type does not surface `batch` (it is only on the
+  // concrete D1/libsql subclasses), so reach it through a narrow structural cast.
+  try {
+    const communityInsert = db.insert(communities).values({
+      apId,
+      preferredUsername: validName,
+      name: body.display_name || validName,
+      summary: body.summary || "",
+      inbox: inboxUrl,
+      outbox,
+      followersUrl,
+      publicKeyPem,
+      privateKeyPem,
+      visibility: "public",
+      joinPolicy: "open",
+      postPolicy: "members",
+      memberCount: 1,
+      createdBy: actor.ap_id,
+      createdAt: now,
+    });
+
+    const ownerMemberInsert = db.insert(communityMembers).values({
+      communityApId: apId,
+      actorApId: actor.ap_id,
+      role: "owner",
+      joinedAt: now,
+    });
+
+    await (db as unknown as Batchable).batch([
+      communityInsert,
+      ownerMemberInsert,
+    ]);
+  } catch (error) {
+    if (isUniqueConstraintError(error)) {
+      return c.json({ error: "Community name already taken" }, 409);
+    }
+    throw error;
+  }
+
+  return c.json(
+    {
+      community: {
+        ap_id: apId,
+        name: body.name,
+        display_name: body.display_name || body.name,
+        summary: body.summary || "",
+        icon_url: null,
+        visibility: "public",
+        join_policy: "open",
+        post_policy: "members",
+        member_count: 1,
+        created_at: now,
+        is_member: true,
+      },
+    },
+    201,
+  );
+});
+
+// GET /api/communities/:name - Get community by name or ap_id
+communitiesRouter.get("/:identifier", async (c) => {
+  const identifier = c.req.param("identifier");
+  const actor = c.get("actor");
+  const db = c.get("db");
+  const baseUrl = c.env.APP_URL;
+
+  const apId = identifier.startsWith("http")
+    ? identifier
+    : communityApId(baseUrl, identifier);
+
+  const community = await db
+    .select()
+    .from(communities)
+    .where(
+      or(
+        eq(communities.apId, apId),
+        eq(communities.preferredUsername, identifier),
+      ),
+    )
+    .get();
+
+  if (!community || community.deletedAt) {
+    return c.json({ error: "Community not found" }, 404);
+  }
+
+  // Check membership and join status
+  let isMember = false;
+  let memberRole: string | null = null;
+  let joinStatus: string | null = null;
+
+  if (actor) {
+    const membership = await db
+      .select()
+      .from(communityMembers)
+      .where(memberWhere(community.apId, actor.ap_id))
+      .get();
+    if (membership) {
+      isMember = true;
+      memberRole = membership.role;
+    } else {
+      const joinRequest = await db
+        .select()
+        .from(communityJoinRequests)
+        .where(
+          and(
+            eq(communityJoinRequests.communityApId, community.apId),
+            eq(communityJoinRequests.actorApId, actor.ap_id),
+          ),
+        )
+        .get();
+      if (joinRequest?.status === "pending") {
+        joinStatus = "pending";
+      }
+    }
+  }
+
+  // A private community reveals only its IDENTITY (name/display/icon/policy) to a
+  // non-member — enough to render the "private, join with an invite" page — but
+  // never its size / activity / summary / owner. This matches the discovery list,
+  // which hides private communities from non-members entirely; without it, anyone
+  // who guesses the name could read a private community's member/post counts and
+  // description by direct fetch.
+  const restricted =
+    communityRequiresMembership(community.visibility) && !isMember;
+
+  // member_count is the maintained `communities.memberCount` column (kept atomic
+  // by addMemberAtomic/removeMemberAtomic). post_count has no denorm column, so it
+  // is counted (indexed range via objects_comm_published_idx) — but only when the
+  // viewer is allowed to see it.
+  const postCount = restricted
+    ? 0
+    : (
+        await db
+          .select({ count: count() })
+          .from(objects)
+          .where(eq(objects.communityApId, community.apId))
+          .get()
+      )?.count || 0;
+
+  return c.json({
+    community: {
+      ap_id: community.apId,
+      name: community.preferredUsername,
+      display_name: community.name,
+      summary: restricted ? null : community.summary,
+      icon_url: community.iconUrl,
+      visibility: community.visibility,
+      join_policy: community.joinPolicy,
+      post_policy: community.postPolicy,
+      member_count: restricted ? 0 : community.memberCount || 0,
+      post_count: postCount,
+      created_by: restricted ? null : community.createdBy,
+      created_at: community.createdAt,
+      is_member: isMember,
+      member_role: memberRole,
+      join_status: joinStatus,
+    },
+  });
+});
+
+// PATCH /api/communities/:identifier/settings - Update community settings
+communitiesRouter.patch("/:identifier/settings", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "Unauthorized" }, 401);
+
+  const identifier = c.req.param("identifier");
+  const db = c.get("db");
+
+  const { community } = await fetchCommunityId(c, identifier);
+  if (!community) {
+    return c.json({ error: "Community not found" }, 404);
+  }
+
+  const manager = await requireManager(db, community.apId, actor.ap_id);
+  if (!manager) {
+    return c.json({ error: "Forbidden" }, 403);
+  }
+
+  const body = await c.req.json<{
+    display_name?: string;
+    summary?: string;
+    icon_url?: string;
+    visibility?: "public" | "private";
+    join_policy?: "open" | "approval" | "invite";
+    post_policy?: "anyone" | "members" | "mods" | "owners";
+  }>();
+
+  const profileError = validateCommunityProfile(
+    body.display_name,
+    body.summary,
+  );
+  if (profileError) return c.json({ error: profileError }, 400);
+
+  const updates: Record<string, string | null> = {};
+
+  if (body.display_name !== undefined) {
+    updates.name = body.display_name;
+  }
+  if (body.summary !== undefined) {
+    updates.summary = body.summary;
+  }
+  if (body.icon_url !== undefined) {
+    if (
+      body.icon_url === null ||
+      (typeof body.icon_url === "string" && body.icon_url.trim().length === 0)
+    ) {
+      updates.iconUrl = null;
+    } else if (typeof body.icon_url !== "string") {
+      return c.json({ error: "Invalid icon_url" }, 400);
+    } else if (!isValidCommunityIconUrl(body.icon_url)) {
+      return c.json({ error: "Invalid icon_url scheme" }, 400);
+    } else if (
+      body.icon_url.trim().startsWith("/media/") &&
+      !(await isOwnLocalMediaUrl(db, body.icon_url.trim(), actor.ap_id))
+    ) {
+      // Reject pointing the icon at a /media blob the setter does not own
+      // (cross-user media IDOR — see isOwnLocalMediaUrl).
+      return c.json(
+        { error: "icon_url must reference your own uploaded media" },
+        400,
+      );
+    } else {
+      updates.iconUrl = body.icon_url.trim();
+    }
+  }
+  if (body.visibility !== undefined) {
+    if (!["public", "private"].includes(body.visibility)) {
+      return c.json({ error: "Invalid visibility" }, 400);
+    }
+    updates.visibility = body.visibility;
+  }
+  if (body.join_policy !== undefined) {
+    if (!["open", "approval", "invite"].includes(body.join_policy)) {
+      return c.json({ error: "Invalid join_policy" }, 400);
+    }
+    updates.joinPolicy = body.join_policy;
+  }
+  if (body.post_policy !== undefined) {
+    if (!["anyone", "members", "mods", "owners"].includes(body.post_policy)) {
+      return c.json({ error: "Invalid post_policy" }, 400);
+    }
+    updates.postPolicy = body.post_policy;
+  }
+
+  if (Object.keys(updates).length === 0) {
+    return c.json({ error: "No fields to update" }, 400);
+  }
+
+  // Governance fields (visibility / join_policy / post_policy) change who can
+  // read, join, and post — flipping private→public exposes all member-only
+  // content + the full roster. Restrict these to the OWNER (a moderator may
+  // still edit the cosmetic name / summary / icon), mirroring role changes
+  // which are owner-only.
+  const changesGovernance =
+    updates.visibility !== undefined ||
+    updates.joinPolicy !== undefined ||
+    updates.postPolicy !== undefined;
+  if (changesGovernance && manager.role !== "owner") {
+    return c.json({ error: "Owner role required" }, 403);
+  }
+
+  // Capture the prior icon URL (if it is being replaced) so its now-orphaned
+  // /media blob can be reaped after the update — community icons attach to no
+  // object and no GC path otherwise reclaims a replaced one.
+  let priorIconUrl: string | null = null;
+  if (updates.iconUrl !== undefined) {
+    const current = await db
+      .select({ iconUrl: communities.iconUrl })
+      .from(communities)
+      .where(eq(communities.apId, community.apId))
+      .get();
+    priorIconUrl = current?.iconUrl ?? null;
+  }
+
+  await db
+    .update(communities)
+    .set(updates)
+    .where(eq(communities.apId, community.apId));
+
+  if (priorIconUrl && priorIconUrl !== updates.iconUrl) {
+    await reapReplacedMediaUrl(db, priorIconUrl, actor.ap_id, c.env.MEDIA);
+  }
+
+  return c.json({ success: true });
+});
+
+export default communitiesRouter;

package/src/backend/routes/communities.ts

@@ -0,0 +1,21 @@
+import { Hono } from "hono";
+import type { Env, Variables } from "../types.ts";
+import baseRoutes from "./communities/routes.ts";
+import { registerMembershipInviteRoutes } from "./communities/membership-invites.ts";
+import { registerMembershipJoinRoutes } from "./communities/membership-join.ts";
+import { registerMembershipMemberRoutes } from "./communities/membership-members.ts";
+import { registerMembershipRequestRoutes } from "./communities/membership-requests.ts";
+import messageRoutes from "./communities/messages.ts";
+
+const communities = new Hono<{ Bindings: Env; Variables: Variables }>();
+
+communities.route("/", baseRoutes);
+
+registerMembershipJoinRoutes(communities);
+registerMembershipRequestRoutes(communities);
+registerMembershipInviteRoutes(communities);
+registerMembershipMemberRoutes(communities);
+
+communities.route("/", messageRoutes);
+
+export default communities;