nixamp 0.15.0 → 0.16.0

package/dist/live-api.js

@@ -0,0 +1,447 @@
+import { tokenFrom } from "./accounts.js";
+import { INVITATION_STATES, LIVE_EVENT_STATUSES, LiveEventError, } from "./live-events.js";
+import { LAYOUT_SCOPES, LayoutError, PANEL_REGISTRY, presetLayout, } from "./layouts.js";
+import { HAND_RAISE_STATES, RoomError } from "./rooms.js";
+const CORS = {
+    "access-control-allow-origin": "*",
+    "access-control-allow-methods": "GET, POST, PATCH, DELETE, OPTIONS",
+    "access-control-allow-headers": "content-type, authorization, if-match",
+};
+function json(response, code, body) {
+    const value = JSON.stringify(body);
+    response.writeHead(code, {
+        ...CORS,
+        "content-type": "application/json; charset=utf-8",
+        "content-length": Buffer.byteLength(value),
+        "cache-control": "no-store",
+    });
+    response.end(value);
+}
+async function body(request) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        const buffer = chunk;
+        size += buffer.length;
+        if (size > 64 * 1024)
+            throw new LiveEventError("body too large", 413);
+        chunks.push(buffer);
+    }
+    try {
+        const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error("object required");
+        return parsed;
+    }
+    catch (error) {
+        if (error instanceof LiveEventError)
+            throw error;
+        throw new LiveEventError("bad JSON", 400);
+    }
+}
+function reference(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        throw new LiveEventError("bad event reference", 400);
+    }
+}
+function requestedVersion(request, input) {
+    const header = request.headers["if-match"];
+    const raw = Array.isArray(header) ? header[0] : header;
+    const fromHeader = raw ? Number(raw.replace(/^W\//, "").replace(/^"|"$/g, "")) : NaN;
+    return Number.isInteger(fromHeader) && fromHeader > 0 ? fromHeader : Number(input["version"]);
+}
+function accountName(account) {
+    return account.email.split("@")[0]?.replace(/[._-]+/g, " ").trim() || "Someone";
+}
+function permissionsFor(event, account) {
+    if (account?.id === event.ownerId || event.moderatorIds.includes(account?.id ?? "")) {
+        return [
+            "event.update",
+            "event.start",
+            "event.end",
+            "event.invite",
+            "event.moderate",
+            "room.listen",
+            "room.chat",
+            "room.raise_hand",
+            "room.speak",
+            "recording.start",
+            "recording.stop",
+            "recording.publish",
+            "layout.read",
+            "layout.update",
+            "panel.add",
+            "panel.update",
+            "panel.remove",
+        ];
+    }
+    return account
+        ? ["room.listen", "room.chat", "room.raise_hand", "layout.read"]
+        : ["room.listen", "layout.read"];
+}
+function layoutFor(event, account) {
+    const name = event.ownerId === account?.id || event.moderatorIds.includes(account?.id ?? "")
+        ? "backtoschool-host"
+        : account
+            ? "backtoschool-member"
+            : "backtoschool-viewer";
+    return presetLayout(event.layoutId ?? name) ?? presetLayout(name);
+}
+function view(event, account) {
+    return { event, permissions: permissionsFor(event, account), layout: layoutFor(event, account) };
+}
+async function signedIn(request, accounts) {
+    return accounts?.whoIs(tokenFrom(request.headers)) ?? null;
+}
+async function requiredAccount(request, response, options) {
+    const account = await signedIn(request, options.accounts);
+    if (!account)
+        json(response, 401, { error: "sign in first" });
+    return account;
+}
+async function eventAccess(request, response, url, options, event) {
+    if (!event) {
+        json(response, 404, { error: "event not found" });
+        return false;
+    }
+    const account = await signedIn(request, options.accounts);
+    const invited = await options.events.invitationAllows(event.id, url.searchParams.get("invite") ?? "");
+    if (!(await options.events.canAccess(event, account?.id)) && !invited) {
+        json(response, 404, { error: "event not found" });
+        return false;
+    }
+    return account;
+}
+async function manage(request, response, options, event) {
+    const account = await requiredAccount(request, response, options);
+    if (!account)
+        return null;
+    if (!options.events.canManage(event, account.id)) {
+        json(response, 403, { error: "only hosts and moderators can do that" });
+        return null;
+    }
+    return account;
+}
+export async function handleLiveApi(request, response, url, options) {
+    const path = url.pathname;
+    if (!path.startsWith("/api/v1/events") &&
+        !path.startsWith("/api/v1/invitations/") &&
+        !path.startsWith("/api/v1/layouts") &&
+        !path.startsWith("/api/v1/layout-presets"))
+        return false;
+    try {
+        if (path === "/api/v1/events") {
+            if (request.method === "GET") {
+                const account = await signedIn(request, options.accounts);
+                const statusValue = url.searchParams.get("status") ?? undefined;
+                if (statusValue && !LIVE_EVENT_STATUSES.includes(statusValue)) {
+                    throw new LiveEventError(`status must be one of ${LIVE_EVENT_STATUSES.join(", ")}`, 422);
+                }
+                const mine = url.searchParams.get("mine") === "true";
+                if (mine && !account) {
+                    json(response, 401, { error: "sign in to see your events" });
+                    return true;
+                }
+                const requestedLimit = Number(url.searchParams.get("limit") ?? 30);
+                if (!Number.isInteger(requestedLimit) || requestedLimit < 1) {
+                    throw new LiveEventError("limit must be a positive integer", 422);
+                }
+                const events = await options.events.list({
+                    ...(mine && account ? { ownerId: account.id } : {}),
+                    ...(statusValue ? { status: statusValue } : {}),
+                    ...(url.searchParams.get("topic") ? { topic: url.searchParams.get("topic") } : {}),
+                    ...(url.searchParams.get("from") ? { from: url.searchParams.get("from") } : {}),
+                    limit: requestedLimit,
+                });
+                json(response, 200, { events });
+                return true;
+            }
+            if (request.method === "POST") {
+                const account = await requiredAccount(request, response, options);
+                if (!account)
+                    return true;
+                const input = await body(request);
+                const event = await options.events.create(account.id, { ...input, title: input["title"] });
+                json(response, 201, view(event, account));
+                return true;
+            }
+            json(response, 405, { error: "GET or POST" });
+            return true;
+        }
+        const invitationMatch = /^\/api\/v1\/invitations\/([^/]+)\/(accept|decline)$/.exec(path);
+        if (invitationMatch) {
+            if (request.method !== "POST") {
+                json(response, 405, { error: "POST only" });
+                return true;
+            }
+            const account = await requiredAccount(request, response, options);
+            if (!account)
+                return true;
+            const invitation = await options.events.respond(reference(invitationMatch[1]), account.id, invitationMatch[2] === "accept" ? "accepted" : "declined");
+            json(response, 200, { invitation });
+            return true;
+        }
+        const presetMatch = /^\/api\/v1\/layout-presets\/([^/]+)$/.exec(path);
+        if (presetMatch) {
+            if (request.method !== "GET") {
+                json(response, 405, { error: "GET only" });
+                return true;
+            }
+            const layout = presetLayout(reference(presetMatch[1]));
+            json(response, layout ? 200 : 404, layout ? { layout, registry: PANEL_REGISTRY } : { error: "layout preset not found" });
+            return true;
+        }
+        if (path === "/api/v1/layouts" && options.layouts) {
+            if (request.method !== "POST") {
+                json(response, 405, { error: "POST only" });
+                return true;
+            }
+            const account = await requiredAccount(request, response, options);
+            if (!account)
+                return true;
+            const input = await body(request);
+            const scope = String(input["scope"] ?? "");
+            if (!LAYOUT_SCOPES.includes(scope) || !["user", "event"].includes(scope)) {
+                throw new LayoutError("regular users may create user or event layouts", 403);
+            }
+            if (scope === "event") {
+                const event = await options.events.get(String(input["scopeId"] ?? ""));
+                if (!event || !options.events.canManage(event, account.id)) {
+                    throw new LayoutError("only an event host can create its layout", 403);
+                }
+            }
+            json(response, 201, {
+                layout: await options.layouts.create({
+                    ...input,
+                    name: input["name"],
+                    scope: input["scope"],
+                }, account.id),
+            });
+            return true;
+        }
+        const layoutMatch = /^\/api\/v1\/layouts\/([^/]+)(?:\/(panels)(?:\/([^/]+))?|\/(reset))?$/.exec(path);
+        if (layoutMatch && options.layouts) {
+            const layoutId = reference(layoutMatch[1]);
+            if (request.method === "GET" && !layoutMatch[2] && !layoutMatch[4]) {
+                const layout = await options.layouts.get(layoutId);
+                if (!layout) {
+                    json(response, 404, { error: "layout not found" });
+                    return true;
+                }
+                const account = await signedIn(request, options.accounts);
+                if (layout.ownerId && layout.ownerId !== account?.id) {
+                    json(response, 404, { error: "layout not found" });
+                    return true;
+                }
+                json(response, 200, { layout, registry: PANEL_REGISTRY });
+                return true;
+            }
+            const account = await requiredAccount(request, response, options);
+            if (!account)
+                return true;
+            const input = request.method === "DELETE" ? {} : await body(request);
+            const version = requestedVersion(request, input);
+            let layout;
+            if (layoutMatch[4] && request.method === "POST") {
+                layout = await options.layouts.reset(layoutId, String(input["preset"] ?? ""), version, account.id);
+            }
+            else if (layoutMatch[2] && !layoutMatch[3] && request.method === "POST") {
+                layout = await options.layouts.addPanel(layoutId, input["panel"] ?? input, version, account.id);
+            }
+            else if (layoutMatch[2] && layoutMatch[3] && request.method === "PATCH") {
+                layout = await options.layouts.updatePanel(layoutId, reference(layoutMatch[3]), input["panel"] ?? input, version, account.id);
+            }
+            else if (layoutMatch[2] && layoutMatch[3] && request.method === "DELETE") {
+                layout = await options.layouts.removePanel(layoutId, reference(layoutMatch[3]), version, account.id);
+            }
+            else if (!layoutMatch[2] && !layoutMatch[4] && request.method === "PATCH") {
+                layout = await options.layouts.update(layoutId, input["panels"], version, account.id);
+            }
+            else {
+                json(response, 405, { error: "method not allowed" });
+                return true;
+            }
+            json(response, 200, { layout });
+            return true;
+        }
+        const eventMatch = /^\/api\/v1\/events\/([^/]+)(?:\/(invitations|chat|hand-raises)(?:\/([^/]+))?|\/(start|end|cancel|archive))?$/.exec(path);
+        if (!eventMatch) {
+            json(response, 404, { error: "no such endpoint" });
+            return true;
+        }
+        const eventRef = reference(eventMatch[1]);
+        const event = await options.events.get(eventRef);
+        const collection = eventMatch[2];
+        const child = eventMatch[3] ? reference(eventMatch[3]) : undefined;
+        const action = eventMatch[4];
+        if (!collection && !action) {
+            if (request.method === "GET") {
+                const account = await eventAccess(request, response, url, options, event);
+                if (account === false || !event)
+                    return true;
+                json(response, 200, view(event, account));
+                return true;
+            }
+            const account = await requiredAccount(request, response, options);
+            if (!account)
+                return true;
+            if (request.method === "PATCH") {
+                const input = await body(request);
+                const updated = await options.events.update(eventRef, account.id, {
+                    ...input,
+                    version: requestedVersion(request, input),
+                });
+                json(response, 200, view(updated, account));
+                return true;
+            }
+            if (request.method === "DELETE") {
+                const removed = await options.events.remove(eventRef, account.id);
+                json(response, removed ? 200 : 404, removed ? { ok: true } : { error: "event not found" });
+                return true;
+            }
+            json(response, 405, { error: "GET, PATCH or DELETE" });
+            return true;
+        }
+        if (!event) {
+            json(response, 404, { error: "event not found" });
+            return true;
+        }
+        if (action) {
+            if (request.method !== "POST") {
+                json(response, 405, { error: "POST only" });
+                return true;
+            }
+            const account = await manage(request, response, options, event);
+            if (!account)
+                return true;
+            const input = await body(request);
+            const target = {
+                start: "live",
+                end: "ended",
+                cancel: "cancelled",
+                archive: "archived",
+            };
+            const updated = await options.events.transition(event.id, event.ownerId, target[action], requestedVersion(request, input));
+            json(response, 200, view(updated, account));
+            return true;
+        }
+        if (collection === "invitations") {
+            const account = await manage(request, response, options, event);
+            if (!account)
+                return true;
+            if (request.method === "GET" && !child) {
+                json(response, 200, { invitations: await options.events.invitations(event.id, account.id) });
+                return true;
+            }
+            if (request.method === "POST" && !child) {
+                const input = await body(request);
+                const invitation = await options.events.invite(event.id, account.id, input);
+                const inviteUrl = `${(options.site ?? "").replace(/\/$/, "")}/live/${event.slug}?invite=${encodeURIComponent(invitation.token)}`;
+                let sent = false;
+                if (invitation.email && options.email) {
+                    sent = await options.email(invitation.email, {
+                        title: `You are invited to ${event.title}`,
+                        body: `You are invited as a ${invitation.role} to ${event.title}.`,
+                        url: inviteUrl,
+                    });
+                }
+                json(response, 201, { invitation, inviteUrl, sent });
+                return true;
+            }
+            if (request.method === "DELETE" && child) {
+                const revoked = await options.events.revoke(event.id, child, account.id);
+                json(response, revoked ? 200 : 404, revoked ? { ok: true } : { error: "invitation not found" });
+                return true;
+            }
+            json(response, 405, { error: "GET, POST or DELETE" });
+            return true;
+        }
+        if (collection === "chat" && options.rooms) {
+            const account = await eventAccess(request, response, url, options, event);
+            if (account === false)
+                return true;
+            if (request.method === "GET" && !child) {
+                json(response, 200, { messages: await options.rooms.chat(event.id, url.searchParams.get("after") ?? undefined) });
+                return true;
+            }
+            if (request.method === "POST" && !child) {
+                if (!event.chatEnabled)
+                    throw new RoomError("chat is off for this event", 409);
+                if (!account) {
+                    json(response, 401, { error: "sign in to chat" });
+                    return true;
+                }
+                const input = await body(request);
+                json(response, 201, { message: await options.rooms.post(event.id, account.id, accountName(account), input["body"]) });
+                return true;
+            }
+            if (request.method === "DELETE" && child) {
+                const moderator = await manage(request, response, options, event);
+                if (!moderator)
+                    return true;
+                const removed = await options.rooms.removeMessage(event.id, child);
+                json(response, removed ? 200 : 404, removed ? { ok: true } : { error: "message not found" });
+                return true;
+            }
+            json(response, 405, { error: "GET, POST or DELETE" });
+            return true;
+        }
+        if (collection === "hand-raises" && options.rooms) {
+            if (request.method === "POST" && !child) {
+                if (!event.handRaiseEnabled)
+                    throw new RoomError("hand raising is off for this event", 409);
+                const account = await eventAccess(request, response, url, options, event);
+                if (account === false)
+                    return true;
+                if (!account) {
+                    json(response, 401, { error: "sign in to raise your hand" });
+                    return true;
+                }
+                json(response, 200, { handRaise: await options.rooms.raiseHand(event.id, account.id, accountName(account)) });
+                return true;
+            }
+            const account = await manage(request, response, options, event);
+            if (!account)
+                return true;
+            if (request.method === "GET" && !child) {
+                json(response, 200, { handRaises: await options.rooms.handRaises(event.id) });
+                return true;
+            }
+            if (request.method === "PATCH" && child) {
+                const input = await body(request);
+                const state = input["state"];
+                if (typeof state !== "string" || !HAND_RAISE_STATES.includes(state)) {
+                    throw new RoomError(`state must be one of ${HAND_RAISE_STATES.join(", ")}`, 422);
+                }
+                json(response, 200, { handRaise: await options.rooms.setHandRaise(event.id, child, state) });
+                return true;
+            }
+            json(response, 405, { error: "GET, POST or PATCH" });
+            return true;
+        }
+        json(response, 404, { error: "no such endpoint" });
+        return true;
+    }
+    catch (error) {
+        if (error instanceof LiveEventError || error instanceof LayoutError || error instanceof RoomError) {
+            json(response, error.status, { error: error.message });
+            return true;
+        }
+        json(response, 500, { error: "the live event service failed" });
+        return true;
+    }
+}
+export function liveApiPath(path) {
+    return path.startsWith("/api/v1/events") ||
+        path.startsWith("/api/v1/invitations/") ||
+        path.startsWith("/api/v1/layouts") ||
+        path.startsWith("/api/v1/layout-presets");
+}
+export function invitationState(value) {
+    return typeof value === "string" && INVITATION_STATES.includes(value)
+        ? value
+        : null;
+}

package/dist/live-events.d.ts

@@ -0,0 +1,107 @@
+import type { Queryable } from "./follows.ts";
+export declare const LIVE_EVENT_STATUSES: readonly ["draft", "scheduled", "starting", "live", "ended", "cancelled", "archived"];
+export declare const LIVE_EVENT_VISIBILITIES: readonly ["public", "unlisted", "private"];
+export declare const INVITATION_ROLES: readonly ["listener", "speaker", "moderator"];
+export declare const INVITATION_STATES: readonly ["pending", "accepted", "declined", "revoked", "expired"];
+export type LiveEventStatus = (typeof LIVE_EVENT_STATUSES)[number];
+export type LiveEventVisibility = (typeof LIVE_EVENT_VISIBILITIES)[number];
+export type InvitationRole = (typeof INVITATION_ROLES)[number];
+export type InvitationState = (typeof INVITATION_STATES)[number];
+export interface LiveEvent {
+    id: string;
+    slug: string;
+    ownerId: string;
+    title: string;
+    description?: string;
+    topic?: string;
+    startsAt?: string;
+    endsAt?: string;
+    timezone: string;
+    expectedDurationMinutes?: number;
+    status: LiveEventStatus;
+    visibility: LiveEventVisibility;
+    roomId: string;
+    inviteeIds: string[];
+    speakerIds: string[];
+    moderatorIds: string[];
+    chatEnabled: boolean;
+    handRaiseEnabled: boolean;
+    recordingEnabled: boolean;
+    recordingId?: string;
+    layoutId?: string;
+    version: number;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface EventInvitation {
+    id: string;
+    eventId: string;
+    inviterId: string;
+    inviteeId?: string;
+    email?: string;
+    role: InvitationRole;
+    state: InvitationState;
+    expiresAt?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface CreatedInvitation extends EventInvitation {
+    token: string;
+}
+export interface CreateLiveEventInput {
+    title: unknown;
+    description?: unknown;
+    topic?: unknown;
+    startsAt?: unknown;
+    endsAt?: unknown;
+    timezone?: unknown;
+    expectedDurationMinutes?: unknown;
+    visibility?: unknown;
+    chatEnabled?: unknown;
+    handRaiseEnabled?: unknown;
+    recordingEnabled?: unknown;
+    layoutId?: unknown;
+}
+export interface UpdateLiveEventInput extends Partial<CreateLiveEventInput> {
+    version: unknown;
+    status?: unknown;
+    recordingId?: unknown;
+}
+export interface EventListQuery {
+    ownerId?: string;
+    status?: LiveEventStatus;
+    topic?: string;
+    from?: string;
+    limit?: number;
+}
+export declare class LiveEventError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export declare function eventSlug(value: unknown): string;
+export declare function canTransition(from: LiveEventStatus, to: LiveEventStatus): boolean;
+export declare class LiveEvents {
+    private readonly db;
+    private ready;
+    constructor(db: Queryable);
+    private ensure;
+    create(ownerId: string, input: CreateLiveEventInput): Promise<LiveEvent>;
+    list(query?: EventListQuery): Promise<LiveEvent[]>;
+    get(reference: string): Promise<LiveEvent | null>;
+    byRoom(roomId: string): Promise<LiveEvent | null>;
+    canAccess(event: LiveEvent, accountId: string | undefined): Promise<boolean>;
+    invitationAllows(eventId: string, token: string): Promise<boolean>;
+    canManage(event: LiveEvent, accountId: string | undefined): boolean;
+    update(reference: string, ownerId: string, input: UpdateLiveEventInput): Promise<LiveEvent>;
+    transition(reference: string, ownerId: string, status: LiveEventStatus, version: number): Promise<LiveEvent>;
+    remove(reference: string, ownerId: string): Promise<boolean>;
+    invite(eventId: string, inviterId: string, input: {
+        inviteeId?: unknown;
+        email?: unknown;
+        role?: unknown;
+        expiresAt?: unknown;
+    }): Promise<CreatedInvitation>;
+    invitations(eventId: string, accountId: string): Promise<EventInvitation[]>;
+    respond(token: string, accountId: string, state: "accepted" | "declined"): Promise<EventInvitation>;
+    revoke(eventId: string, invitationId: string, accountId: string): Promise<boolean>;
+}