@twango/twiki 0.0.0-stage → 0.1.1

package/site/tooling/vite-content.ts

@@ -0,0 +1,240 @@
+import { existsSync, type FSWatcher } from 'node:fs';
+import path from 'node:path';
+import type { Plugin } from 'vite';
+import { prepareContent } from './pipeline';
+import { contentRepositories, watchContentGitDirectory } from './lib/dev-git-state';
+import { rebuildQueue } from './lib/rebuild-queue';
+import { resolveRuntimeDataImport } from './lib/runtime-data-modules';
+import { resolveProject, projectSourceVisible } from './lib/project-config';
+
+export function content(): Plugin {
+	return {
+		name: 'wisconsin-content',
+		enforce: 'pre',
+		resolveId(source) {
+			return resolveRuntimeDataImport(source, this.environment.config);
+		},
+		config: {
+			order: 'pre',
+			async handler(_config, environment) {
+				if (
+					environment.command === 'build' &&
+					process.env.WISCONSIN_SKIP_CONTENT !== '1' &&
+					process.env.npm_lifecycle_event !== 'prepare'
+				)
+					await prepareContent(true);
+			}
+		},
+		async configureServer(server) {
+			await prepareContent(true, undefined, true);
+			const project = resolveProject(server.config.root);
+			const repo = project.root;
+			const directory = project.contentDir;
+			let closed = false;
+			let failure: Error | undefined;
+			let changedInputs = new Set<string>();
+			let forceRebuild = false;
+			let gitTopologyChanged = true;
+			const gitWatchers = new Map<
+				string,
+				{ watcher: FSWatcher; recursive: boolean; files: Set<string>; repositories: Set<string> }
+			>();
+			const queue = rebuildQueue(async () => {
+				if (closed) return;
+				try {
+					const inputs = changedInputs;
+					changedInputs = new Set();
+					const reuse = !forceRebuild && !failure;
+					forceRebuild = false;
+					if (gitTopologyChanged) {
+						refreshGitWatchers();
+						gitTopologyChanged = false;
+					}
+					// Git can refresh an index or another worktree's ref without changing
+					// our inputs. Validate its snapshot; content events and failure
+					// recovery still force reconciliation.
+					const changed = await prepareContent(reuse, inputs, true);
+					const recovered = Boolean(failure);
+					failure = undefined;
+					if (!changed?.size && !recovered) return;
+					const reader = path.resolve(server.config.root, 'src/lib/server/content.ts');
+					const generated = path.resolve(server.config.root, 'src/lib/generated') + path.sep;
+					for (const environment of Object.values(server.environments)) {
+						for (const module of environment.moduleGraph.getModulesByFile(reader) ?? [])
+							environment.moduleGraph.invalidateModule(module);
+						for (const file of changed ?? []) {
+							if (!file.startsWith(generated)) continue;
+							for (const module of environment.moduleGraph.getModulesByFile(file) ?? [])
+								await environment.reloadModule(module);
+						}
+					}
+					const assetRoot = path.resolve(server.config.root, 'build/generated/assets') + path.sep;
+					const changedAsset = [...(changed ?? [])].some(
+						(file) =>
+							file.startsWith(assetRoot) && !file.startsWith(assetRoot + '_files' + path.sep)
+					);
+					// Browsers cache image/PDF URLs independently of SvelteKit's page data.
+					if (changedAsset) server.ws.send({ type: 'full-reload' });
+					else server.ws.send({ type: 'custom', event: 'wisconsin:content', data: { recovered } });
+				} catch (error) {
+					failure = error instanceof Error ? error : new Error(String(error));
+					changedInputs.add(repo); // Recovery must reconcile every course after a partial failure.
+					forceRebuild = true;
+					gitTopologyChanged = true;
+					server.config.logger.error(failure.message);
+					server.ws.send({
+						type: 'error',
+						err: { message: failure.message, stack: failure.stack ?? '' }
+					});
+				}
+			});
+			const rebuild = (file: string) => {
+				forceRebuild = true;
+				changedInputs.add(file);
+				queue.schedule();
+			};
+			const rebuildGit = (repository: string) => {
+				changedInputs.add(repository);
+				queue.schedule();
+			};
+			const changed = (event: string, file: string) => {
+				if (!['add', 'change', 'unlink'].includes(event)) return;
+				if (file === project.configFile) {
+					void server.restart().catch((error) => server.config.logger.error(String(error)));
+					return;
+				}
+				if (
+					file === path.join(repo, '.gitmodules') ||
+					(file.startsWith(directory + path.sep) &&
+						['.gitmodules', '.git'].includes(path.basename(file)))
+				) {
+					gitTopologyChanged = true;
+					rebuild(file);
+					return;
+				}
+				if (
+					!file.startsWith(directory + path.sep) ||
+					!projectSourceVisible(project, path.relative(directory, file).split(path.sep).join('/'))
+				)
+					return;
+				// Hidden paths never enter the content catalog; Git metadata is watched separately.
+				if (
+					path
+						.relative(directory, file)
+						.split(path.sep)
+						.some((part) => part.startsWith('.'))
+				)
+					return;
+				rebuild(file);
+			};
+			server.watcher.add([
+				directory,
+				path.join(repo, '.gitmodules'),
+				...(project.configFile ? [project.configFile] : [])
+			]);
+			server.watcher.on('all', changed);
+			function refreshGitWatchers() {
+				const wanted = new Map<
+					string,
+					{ recursive: boolean; files: Set<string>; repositories: Set<string> }
+				>();
+				const add = (directory: string, file: string, repository: string, recursive = false) => {
+					const entry = wanted.get(directory) ?? {
+						recursive,
+						files: new Set<string>(),
+						repositories: new Set<string>()
+					};
+					entry.recursive ||= recursive;
+					entry.files.add(file);
+					entry.repositories.add(repository);
+					wanted.set(directory, entry);
+				};
+				for (const repository of contentRepositories(repo)) {
+					for (const file of [
+						repository.index,
+						repository.config,
+						repository.worktreeConfig,
+						path.join(repository.gitDirectory, 'HEAD'),
+						path.join(repository.commonDirectory, 'packed-refs'),
+						path.join(repository.commonDirectory, 'refs')
+					])
+						add(path.dirname(file), path.basename(file), repository.directory);
+					const refs = path.join(repository.commonDirectory, 'refs');
+					if (existsSync(refs)) add(refs, '', repository.directory, true);
+				}
+				for (const [directory, entry] of gitWatchers) {
+					if (!wanted.has(directory) || wanted.get(directory)!.recursive !== entry.recursive) {
+						entry.watcher.close();
+						gitWatchers.delete(directory);
+					}
+				}
+				for (const [directory, entry] of wanted) {
+					const previous = gitWatchers.get(directory);
+					if (previous) {
+						previous.files = entry.files;
+						previous.repositories = entry.repositories;
+						continue;
+					}
+					// Watch metadata directories shallowly; recurse only through refs,
+					// never through the shared object store.
+					const watcher = watchContentGitDirectory(
+						directory,
+						entry.recursive,
+						() => gitWatchers.get(directory)?.files ?? new Set(),
+						() => {
+							const current = gitWatchers.get(directory);
+							if (closed || !current) return;
+							gitTopologyChanged = true;
+							for (const repository of current.repositories) rebuildGit(repository);
+						}
+					);
+					if (!watcher) continue;
+					watcher.on('error', () => {
+						const current = gitWatchers.get(directory);
+						watcher.close();
+						gitWatchers.delete(directory);
+						if (closed) return;
+						gitTopologyChanged = true;
+						for (const repository of current?.repositories ?? []) rebuildGit(repository);
+					});
+					gitWatchers.set(directory, { ...entry, watcher });
+				}
+			}
+			refreshGitWatchers();
+			gitTopologyChanged = false;
+			server.middlewares.use((request, response, next) => {
+				void queue
+					.wait()
+					.then(async () => {
+						if (failure) return next(failure);
+						// Keep optional renderers and history builders off the startup path.
+						const pathname = new URL(request.url ?? '/', 'http://localhost').pathname;
+						if (pathname.startsWith('/__content/history')) {
+							const { serveDevHistory } = await import('./lib/dev-history');
+							if (serveDevHistory(request, response, server.config.root, repo)) return;
+						}
+						if (pathname.startsWith('/_og/')) {
+							const { serveDevSocialImage } = await import('./lib/dev-social-images');
+							if (await serveDevSocialImage(request, response, server.config.root)) return;
+						}
+						next();
+					})
+					.catch(next);
+			});
+			server.httpServer?.once('close', () => {
+				closed = true;
+
+				server.watcher.off('all', changed);
+				for (const { watcher } of gitWatchers.values()) watcher.close();
+			});
+		},
+		hotUpdate({ file }) {
+			if (
+				file.includes('/src/lib/generated/') ||
+				file.includes('/build/generated/') ||
+				file.startsWith(path.resolve('static') + path.sep)
+			)
+				return [];
+		}
+	};
+}

package/site/tooling/wrangler-paths.js

@@ -0,0 +1,25 @@
+import { existsSync, lstatSync, mkdirSync, readlinkSync, renameSync, symlinkSync } from 'node:fs';
+import path from 'node:path';
+
+/** Keep Wrangler's hardcoded temporary paths under the IDE-excluded build directory.
+ * @param {string} site
+ */
+export function prepareWranglerPaths(site) {
+	const legacy = path.join(site, '.wrangler');
+	const target = path.join(site, 'build/.wrangler');
+	mkdirSync(path.dirname(target), { recursive: true });
+	const stat = lstatSync(legacy, { throwIfNoEntry: false });
+	if (stat?.isSymbolicLink()) {
+		if (path.resolve(site, readlinkSync(legacy)) !== target)
+			throw new Error('Unexpected .wrangler symlink; refusing to replace local state');
+	} else if (stat) {
+		if (existsSync(target))
+			throw new Error(
+				'Both .wrangler and build/.wrangler exist; refusing to overwrite local state'
+			);
+		renameSync(legacy, target);
+	}
+	mkdirSync(target, { recursive: true });
+	if (!stat?.isSymbolicLink()) symlinkSync('build/.wrangler', legacy, 'dir');
+	return target;
+}

package/site/tooling/wrangler.ts

@@ -0,0 +1,19 @@
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { prepareWranglerPaths } from './wrangler-paths.js';
+
+const site = path.resolve(import.meta.dirname, '..');
+const directory = prepareWranglerPaths(site);
+const child = spawn('bunx', ['wrangler', ...process.argv.slice(2)], {
+	cwd: site,
+	stdio: 'inherit',
+	env: { ...process.env, WRANGLER_CACHE_DIR: path.join(directory, 'cache') }
+});
+for (const signal of ['SIGINT', 'SIGTERM'] as const) process.on(signal, () => child.kill(signal));
+child.on('error', (error) => {
+	console.error(error);
+	process.exitCode = 1;
+});
+child.on('exit', (code) => {
+	process.exitCode = code ?? 1;
+});

package/site/tsconfig.json

@@ -0,0 +1,16 @@
+{
+	"extends": "./build/.svelte-kit/tsconfig.json",
+	"compilerOptions": {
+		"types": ["node", "bun"],
+		"rewriteRelativeImportExtensions": true,
+		"allowJs": true,
+		"checkJs": true,
+		"esModuleInterop": true,
+		"forceConsistentCasingInFileNames": true,
+		"resolveJsonModule": true,
+		"skipLibCheck": true,
+		"sourceMap": true,
+		"strict": true,
+		"moduleResolution": "bundler"
+	}
+}

package/site/vite.config.ts

@@ -0,0 +1,40 @@
+import { statSync } from 'node:fs';
+import { isAbsolute } from 'node:path';
+import tailwindcss from '@tailwindcss/vite';
+import { sveltekit } from '@sveltejs/kit/vite';
+import { defineConfig, searchForWorkspaceRoot } from 'vite';
+import { content } from './tooling/vite-content';
+import { applicationAssetUrls } from './tooling/lib/application-asset-urls';
+
+const dependencyPaths: unknown = JSON.parse(process.env.TWIKI_DEPENDENCY_PATHS ?? '[]');
+if (
+	!Array.isArray(dependencyPaths) ||
+	!dependencyPaths.every(
+		(value): value is string =>
+			typeof value === 'string' && isAbsolute(value) && statSync(value).isDirectory()
+	)
+)
+	throw new Error('TWIKI_DEPENDENCY_PATHS must contain absolute dependency directories');
+
+export default defineConfig({
+	plugins: [content(), tailwindcss(), sveltekit(), applicationAssetUrls()],
+	// The file viewer imports WebR lazily. Discover it at startup so opening
+	// a file does not trigger dependency optimization and reset the page.
+	optimizeDeps: { include: ['webr'] },
+	// Gzip size reporting recompresses bundles solely for the build log.
+	build: { reportCompressedSize: false },
+	server: {
+		// CLI staging keeps dependencies in the installed package, outside the consumer runtime.
+		// Preserve Vite's workspace boundary and allow only that resolved dependency tree.
+		fs: {
+			allow: [
+				searchForWorkspaceRoot(process.cwd()),
+				...dependencyPaths,
+				...(process.env.TWIKI_DEPENDENCY_DIR ? [process.env.TWIKI_DEPENDENCY_DIR] : [])
+			]
+		},
+		watch: {
+			ignored: ['**/site/build/**']
+		}
+	}
+});

package/site/worker/access.ts

@@ -0,0 +1,57 @@
+import { and, desc, eq, isNotNull, or } from 'drizzle-orm';
+import { database } from '../database';
+import { account, siteAccess } from '../database/schema';
+import type { AuthEnv } from './auth';
+import type { D1Database } from '@cloudflare/workers-types';
+
+export async function isOwner(binding: D1Database, userId: string, ownerId: string) {
+	return Boolean(
+		await database(binding)
+			.select({ id: account.id })
+			.from(account)
+			.where(
+				and(
+					eq(account.userId, userId),
+					eq(account.providerId, 'github'),
+					eq(account.accountId, ownerId)
+				)
+			)
+			.get()
+	);
+}
+
+export async function isGithubAllowed(env: AuthEnv, githubId: string) {
+	return (
+		githubId === env.OWNER_GITHUB_ID ||
+		Boolean(
+			await database(env.DB)
+				.select({ id: siteAccess.githubId })
+				.from(siteAccess)
+				.where(eq(siteAccess.githubId, githubId))
+				.get()
+		)
+	);
+}
+
+export async function accessForUser(
+	env: AuthEnv,
+	userId: string
+): Promise<'owner' | 'member' | null> {
+	const owner = eq(account.accountId, env.OWNER_GITHUB_ID);
+	const match = await database(env.DB)
+		.select({ accountId: account.accountId })
+		.from(account)
+		.leftJoin(siteAccess, eq(siteAccess.githubId, account.accountId))
+		.where(
+			and(
+				eq(account.userId, userId),
+				eq(account.providerId, 'github'),
+				or(owner, isNotNull(siteAccess.githubId))
+			)
+		)
+		.orderBy(desc(owner))
+		.limit(1)
+		.get();
+	if (!match) return null;
+	return match.accountId === env.OWNER_GITHUB_ID ? 'owner' : 'member';
+}

package/site/worker/analytics.ts

@@ -0,0 +1,100 @@
+export interface AnalyticsOptions {
+	siteId: string;
+	endpoint: string;
+}
+/** Opt-in analytics relay; never forwards vault authentication upstream. */
+export async function proxyAnalytics(
+	request: Request,
+	fetcher: typeof fetch = fetch,
+	options?: AnalyticsOptions
+) {
+	if (!options) return new Response('Not found', { status: 404 });
+	if (!/^[0-9]+$/.test(options.siteId))
+		return new Response('Invalid analytics configuration', { status: 503 });
+	let upstream: URL;
+	try {
+		upstream = new URL(options.endpoint);
+		if (
+			upstream.protocol !== 'https:' ||
+			upstream.username ||
+			upstream.password ||
+			upstream.search ||
+			upstream.hash
+		)
+			throw Error();
+	} catch {
+		return new Response('Invalid analytics configuration', { status: 503 });
+	}
+	const endpoints = new Map([
+		[
+			'/api/analytics/site/tracking-config/' + options.siteId,
+			{ method: 'GET', upstream: '/site/tracking-config/' + options.siteId }
+		],
+		['/api/analytics/track', { method: 'POST', upstream: '/track' }],
+		['/api/analytics/identify', { method: 'POST', upstream: '/identify' }]
+	]);
+	const url = new URL(request.url);
+	const endpoint = endpoints.get(url.pathname);
+	if (!endpoint) return new Response('Not found', { status: 404 });
+	if (request.method !== endpoint.method)
+		return new Response('Method not allowed', { status: 405, headers: { Allow: endpoint.method } });
+	const origin = request.headers.get('origin');
+	if ((origin && origin !== url.origin) || request.headers.get('sec-fetch-site') === 'cross-site')
+		return new Response('Forbidden', { status: 403 });
+
+	let body: string | undefined;
+	if (request.method === 'POST') {
+		try {
+			body = await request.text();
+			const payload = JSON.parse(body);
+			if (String(payload?.site_id) !== options.siteId)
+				return new Response('Invalid site', { status: 400 });
+		} catch {
+			return new Response('Invalid JSON', { status: 400 });
+		}
+	}
+
+	// Preserve browser metadata for bot detection, without forwarding site credentials.
+	const headers = new Headers();
+	for (const [name, value] of request.headers) {
+		if (
+			['accept', 'accept-encoding', 'accept-language', 'user-agent', 'referer', 'origin'].includes(
+				name
+			) ||
+			name.startsWith('sec-fetch-') ||
+			name.startsWith('sec-ch-')
+		)
+			headers.set(name, value);
+	}
+	if (body !== undefined) headers.set('Content-Type', 'application/json');
+	const ip = request.headers.get('cf-connecting-ip');
+	if (ip) headers.set('X-Forwarded-For', ip);
+
+	try {
+		const response = await fetcher(upstream.href.replace(/\/$/, '') + endpoint.upstream, {
+			method: endpoint.method,
+			headers,
+			body,
+			redirect: 'manual',
+			signal: AbortSignal.timeout(5000)
+		});
+		// workerd supports manual redirects, but not fetch's redirect: 'error' mode.
+		if (response.status >= 300 && response.status < 400)
+			return new Response('Analytics upstream redirected', {
+				status: 502,
+				headers: { 'Cache-Control': 'no-store' }
+			});
+		return new Response(response.body, {
+			status: response.status,
+			headers: {
+				'Content-Type': response.headers.get('Content-Type') ?? 'application/json',
+				'Cache-Control': 'no-store'
+			}
+		});
+	} catch {
+		return new Response('Analytics unavailable', {
+			status: 502,
+			headers: { 'Cache-Control': 'no-store' }
+		});
+	}
+}

package/site/worker/auth-routes.ts

@@ -0,0 +1,78 @@
+import type { createAuth } from './auth';
+import { loginPage, returnPath } from './login';
+
+type Auth = ReturnType<typeof createAuth>;
+
+const endpoints = new Set([
+	'/api/auth/sign-in/social',
+	'/api/auth/callback/github',
+	'/api/auth/get-session',
+	'/api/auth/sign-out',
+	'/api/auth/error'
+]);
+
+export function copyCookies(source: Headers, target: Headers) {
+	for (const cookie of source.getSetCookie()) target.append('Set-Cookie', cookie);
+}
+
+export function redirect(location: string, cookies?: Headers) {
+	const headers = new Headers({ Location: location });
+	if (cookies) copyCookies(cookies, headers);
+	return new Response(null, { status: 303, headers });
+}
+
+export function handleAuthEndpoint(request: Request, auth: Auth) {
+	const { pathname } = new URL(request.url);
+	if (!endpoints.has(pathname)) return new Response('Not found', { status: 404 });
+	if (pathname === '/api/auth/error') return redirect('/login?error=1');
+	return auth.handler(request);
+}
+
+function sameOrigin(request: Request) {
+	return (
+		request.headers.get('origin') === new URL(request.url).origin &&
+		request.headers.get('sec-fetch-site') !== 'cross-site'
+	);
+}
+
+function postAuth(request: Request, auth: Auth, path: string, body: object) {
+	const headers = new Headers(request.headers);
+	headers.set('Content-Type', 'application/json');
+	headers.delete('content-length');
+	return auth.handler(
+		new Request(new URL(path, request.url), {
+			method: 'POST',
+			headers,
+			body: JSON.stringify(body)
+		})
+	);
+}
+
+function formError(response: Response, next: string) {
+	const page = loginPage(next, true);
+	const result = new Response(page.body, { status: response.status, headers: page.headers });
+	const retryAfter = response.headers.get('x-retry-after');
+	if (retryAfter) result.headers.set('Retry-After', retryAfter);
+	copyCookies(response.headers, result.headers);
+	return result;
+}
+
+export async function signIn(request: Request, auth: Auth) {
+	if (!sameOrigin(request)) return new Response('Forbidden', { status: 403 });
+	const next = returnPath((await request.formData()).get('next'));
+	const response = await postAuth(request, auth, '/api/auth/sign-in/social', {
+		provider: 'github',
+		callbackURL: next,
+		errorCallbackURL: '/login?error=1'
+	});
+	if (!response.ok) return formError(response, next);
+	const { url } = (await response.json()) as { url: string };
+	return redirect(url, response.headers);
+}
+
+export async function signOut(request: Request, auth: Auth) {
+	if (!sameOrigin(request)) return new Response('Forbidden', { status: 403 });
+	const response = await postAuth(request, auth, '/api/auth/sign-out', {});
+	if (!response.ok) return formError(response, '/login');
+	return redirect('/login', response.headers);
+}

package/site/worker/auth.ts

@@ -0,0 +1,78 @@
+import { betterAuth } from 'better-auth/minimal';
+import { drizzleAdapter } from '@better-auth/drizzle-adapter';
+import { APIError } from 'better-auth/api';
+import type { D1Database } from '@cloudflare/workers-types';
+import { accessForUser, isGithubAllowed } from './access';
+import { database } from '../database';
+export { isOwner } from './access';
+
+export interface AuthEnv {
+	DB: D1Database;
+	ORIGIN: string;
+	DISABLE_ANALYTICS?: string;
+	TWIKI_AUTH_MODE?: 'none' | 'github';
+	TWIKI_SITE_NAME?: string;
+	TWIKI_SITE_DESCRIPTION?: string;
+	TWIKI_ANALYTICS_SITE_ID?: string;
+	TWIKI_ANALYTICS_ENDPOINT?: string;
+	GITHUB_CLIENT_ID: string;
+	GITHUB_CLIENT_SECRET: string;
+	BETTER_AUTH_SECRET: string;
+	OWNER_GITHUB_ID: string;
+}
+
+export function createAuth(env: AuthEnv) {
+	if (
+		!env.DB ||
+		!env.ORIGIN ||
+		!env.GITHUB_CLIENT_ID ||
+		!env.GITHUB_CLIENT_SECRET ||
+		!env.BETTER_AUTH_SECRET ||
+		env.BETTER_AUTH_SECRET.length < 32 ||
+		!/^\d+$/.test(env.OWNER_GITHUB_ID ?? '')
+	) {
+		throw new Error('Authentication configuration is incomplete');
+	}
+	return betterAuth({
+		appName: env.TWIKI_SITE_NAME ?? 'twiki',
+		baseURL: env.ORIGIN,
+		secret: env.BETTER_AUTH_SECRET,
+		database: drizzleAdapter(database(env.DB), { provider: 'sqlite' }),
+		trustedOrigins: [env.ORIGIN],
+		emailAndPassword: { enabled: false },
+		// OAuth mapping requires an input field; auth-routes.ts blocks client profile updates.
+		user: { additionalFields: { githubUsername: { type: 'string', required: false } } },
+		account: { accountLinking: { enabled: false }, encryptOAuthTokens: true },
+		session: { cookieCache: { enabled: false }, expiresIn: 60 * 60 * 24 * 7 },
+		rateLimit: { enabled: true, storage: 'database' },
+		advanced: {
+			useSecureCookies: new URL(env.ORIGIN).protocol === 'https:',
+			ipAddress: { ipAddressHeaders: ['cf-connecting-ip'] }
+		},
+		socialProviders: {
+			github: {
+				clientId: env.GITHUB_CLIENT_ID,
+				clientSecret: env.GITHUB_CLIENT_SECRET,
+				// Refresh renamed GitHub accounts and populate usernames for existing users.
+				overrideUserInfoOnSignIn: true,
+				async mapProfileToUser(profile) {
+					if (!(await isGithubAllowed(env, String(profile.id)))) {
+						throw new APIError('FORBIDDEN', { message: 'This account does not have access.' });
+					}
+					return { githubUsername: profile.login };
+				}
+			}
+		},
+		databaseHooks: {
+			account: {
+				create: {
+					before: async (account) =>
+						account.providerId === 'github' && (await isGithubAllowed(env, account.accountId))
+				}
+			},
+			session: {
+				create: { before: async (session) => Boolean(await accessForUser(env, session.userId)) }
+			}
+		}
+	});
+}