omegga 1.5.2 → 1.6.0

package/dist/webserver/backend/router/user.js

@@ -1,10 +1,39 @@
 "use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const v4 = require("zod/v4");
+const permissions = require("../permissions.js");
+const scopes = require("../scopes.js");
 const trpc = require("../trpc.js");
+const PermissionSetSchema = v4.z.object({
+  root: v4.z.enum(["all", "read", "off"]),
+  domains: v4.z.record(v4.z.string(), v4.z.enum(["all", "read", "none"])),
+  scopes: v4.z.record(v4.z.string(), v4.z.boolean())
+});
 const userRouter = trpc.router({
   user: trpc.router({
-    list: trpc.protectedProcedure().input(
+    list: trpc.protectedProcedure(scopes.ScopeName.UserList).input(
       v4.z.object({
         page: v4.z.number().optional().default(0),
         search: v4.z.string().optional().default(""),
@@ -16,15 +45,42 @@ const userRouter = trpc.router({
       const { page, search, sort, direction } = input;
       const resp = await database.getUsers({ page, search, sort, direction });
       const now = Date.now();
-      resp.users = resp.users.map(({ hash: _, ...user }) => ({
-        ...user,
-        hash: "",
-        seenAgo: user.lastOnline ? now - user.lastOnline : Infinity,
-        createdAgo: now - user.created
-      }));
+      resp.users = resp.users.map(
+        ({
+          hash: _h,
+          totpSecret: _ts,
+          recoveryCodes: _rc,
+          passkeys: _pk,
+          permissions: _perms,
+          ...user
+        }) => ({
+          ...user,
+          hash: "",
+          permissions: permissions.decodePermissions(_perms),
+          totpEnabled: user.totpEnabled ?? false,
+          passkeyCount: _pk?.length ?? 0,
+          seenAgo: user.lastOnline ? now - user.lastOnline : Infinity,
+          createdAgo: now - user.created
+        })
+      );
       return resp;
     }),
-    create: trpc.protectedProcedure().input(
+    self: trpc.protectedProcedure(scopes.ScopeName.SessionInfo).query(async ({ ctx }) => {
+      const now = Date.now();
+      return {
+        username: ctx.user.username || "Admin",
+        isOwner: ctx.user.isOwner,
+        isBanned: ctx.user.isBanned ?? false,
+        lastOnline: ctx.user.lastOnline ?? 0,
+        created: ctx.user.created ?? 0,
+        seenAgo: ctx.user.lastOnline ? now - ctx.user.lastOnline : Infinity,
+        createdAgo: now - (ctx.user.created ?? now),
+        permissions: ctx.user.permissions,
+        totpEnabled: ctx.user.totpEnabled ?? false,
+        passkeyCount: ctx.user.passkeys?.length ?? 0
+      };
+    }),
+    create: trpc.protectedProcedure(scopes.ScopeName.UserCreate).input(
       v4.z.object({
         username: v4.z.string(),
         password: v4.z.string()
@@ -33,7 +89,6 @@ const userRouter = trpc.router({
       const { database } = trpc.getContextDeps();
       const { username, password } = input;
       const { log, error } = ctx;
-      if (!ctx.user.isOwner) return "missing permission";
       if (typeof username !== "string" || typeof password !== "string")
         return "username/password not a string";
       if (!username.match(/^\w{0,32}$/)) return "username is not allowed";
@@ -62,17 +117,29 @@ const userRouter = trpc.router({
       log(`created new user "${username.yellow}"`);
       return "";
     }),
-    passwd: trpc.protectedProcedure().input(
+    // self-service: any authenticated user can change their own password
+    // changing another user's password requires user.passwd permission (enforced here)
+    passwd: trpc.protectedProcedure(scopes.ScopeName.SessionInfo).input(
       v4.z.object({
         username: v4.z.string(),
-        password: v4.z.string()
+        password: v4.z.string(),
+        currentPassword: v4.z.string().optional()
       })
     ).mutation(async ({ input, ctx }) => {
       const { database } = trpc.getContextDeps();
       const { username, password } = input;
       const { log, error } = ctx;
-      if (!ctx.user.isOwner && username !== ctx.user.username)
-        return "missing permission";
+      const isSelf = username === ctx.user.username;
+      if (isSelf) {
+        if (!input.currentPassword) return "current password required";
+        const bcryptLib = await import("bcryptjs");
+        if (!await bcryptLib.compare(input.currentPassword, ctx.user.hash))
+          return "incorrect current password";
+      } else {
+        const defaults = await database.getDefaultPermissions();
+        if (!permissions.userHasScope(ctx.user, scopes.ScopeName.UserPasswd, defaults))
+          return "missing permission";
+      }
       if (typeof username !== "string" || typeof password !== "string")
         return "username/password not a string";
       if (!username.match(/^\w{0,32}$/)) return "username is not allowed";
@@ -86,6 +153,101 @@ const userRouter = trpc.router({
       }
       log(`changed password for "${username.yellow}"`);
       return "";
+    }),
+    ban: trpc.protectedProcedure(scopes.ScopeName.UserBan).input(
+      v4.z.object({
+        username: v4.z.string(),
+        banned: v4.z.boolean()
+      })
+    ).mutation(async ({ input, ctx }) => {
+      const { database } = trpc.getContextDeps();
+      const { username, banned } = input;
+      const { log } = ctx;
+      if (username === ctx.user.username) return "cannot disable yourself";
+      if (!await database.userExists(username))
+        return "user does not exist";
+      const target = await database.stores.users.findOne({ type: "user", username });
+      if (target?.isOwner) return "cannot disable the owner";
+      await database.banUser(username, banned);
+      log(`${banned ? "disabled" : "enabled"} user "${username.yellow}"`);
+      return "";
+    }),
+    delete: trpc.protectedProcedure(scopes.ScopeName.UserDelete).input(
+      v4.z.object({
+        username: v4.z.string()
+      })
+    ).mutation(async ({ input, ctx }) => {
+      const { database } = trpc.getContextDeps();
+      const { username } = input;
+      const { log } = ctx;
+      if (username === ctx.user.username) return "cannot delete yourself";
+      if (!await database.userExists(username))
+        return "user does not exist";
+      const target = await database.stores.users.findOne({ type: "user", username });
+      if (target?.isOwner) return "cannot delete the owner";
+      await database.deleteUser(username);
+      log(`deleted user "${username.yellow}"`);
+      return "";
+    }),
+    permissions: trpc.protectedProcedure(scopes.ScopeName.UserPermissions).input(
+      v4.z.object({
+        username: v4.z.string(),
+        permissions: PermissionSetSchema
+      })
+    ).mutation(async ({ input, ctx }) => {
+      const { database } = trpc.getContextDeps();
+      const { username } = input;
+      const permissions$1 = input.permissions;
+      const { log } = ctx;
+      if (username === ctx.user.username)
+        return "cannot edit own permissions";
+      const target = await database.stores.users.findOne({ type: "user", username });
+      if (!target) return "user does not exist";
+      if (target.isOwner) return "cannot edit the owner";
+      if (!ctx.user.isOwner) {
+        const defaults = await database.getDefaultPermissions();
+        const myScopes = permissions.resolveAllScopes(ctx.user.permissions, defaults);
+        const grantedScopes = permissions.resolveAllScopes(permissions$1, defaults);
+        for (const [scope, granted] of Object.entries(grantedScopes)) {
+          if (granted && !myScopes[scope])
+            return `cannot grant permission you do not have: ${scope}`;
+        }
+      }
+      await database.setUserPermissions(username, permissions$1);
+      log(`updated permissions for "${username.yellow}"`);
+      return "";
+    }),
+    defaultPermissions: trpc.router({
+      get: trpc.protectedProcedure(scopes.ScopeName.UserPermissions).query(async () => {
+        const { database } = trpc.getContextDeps();
+        const defaults = await database.getDefaultPermissions();
+        return {
+          root: defaults.root,
+          domains: defaults.domains,
+          scopes: defaults.scopes
+        };
+      }),
+      set: trpc.protectedProcedure(scopes.ScopeName.UserPermissions).input(PermissionSetSchema).mutation(async ({ input, ctx }) => {
+        const { database } = trpc.getContextDeps();
+        const { log } = ctx;
+        await database.setDefaultPermissions(
+          input
+        );
+        log(`updated default permissions`);
+        return "";
+      })
+    }),
+    resetMfa: trpc.protectedProcedure(scopes.ScopeName.UserResetMfa).input(v4.z.object({ username: v4.z.string() })).mutation(async ({ input, ctx }) => {
+      const { database } = trpc.getContextDeps();
+      const { username } = input;
+      const { log } = ctx;
+      if (username === ctx.user.username) return "cannot reset own MFA";
+      const target = await database.stores.users.findOne({ type: "user", username });
+      if (!target) return "user does not exist";
+      if (target.isOwner) return "cannot reset the owner";
+      await database.resetUserMfa(username);
+      log(`reset MFA for "${username.yellow}"`);
+      return "";
     })
   })
 });

package/dist/webserver/backend/router/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sources":["../../../../src/webserver/backend/router/user.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport { router, protectedProcedure, getContextDeps } from '../trpc';\n\nexport const userRouter = router({\n  user: router({\n    list: protectedProcedure('user.list')\n      .input(\n        z\n          .object({\n            page: z.number().optional().default(0),\n            search: z.string().optional().default(''),\n            sort: z.string().optional().default('name'),\n            direction: z.number().optional().default(1),\n          })\n          .optional()\n          .default({ page: 0, search: '', sort: 'name', direction: 1 }),\n      )\n      .query(async ({ input }) => {\n        const { database } = getContextDeps();\n        const { page, search, sort, direction } = input;\n        const resp = await database.getUsers({ page, search, sort, direction });\n        const now = Date.now();\n        resp.users = resp.users.map(({ hash: _, ...user }) => ({\n          ...user,\n          hash: '',\n          seenAgo: user.lastOnline ? now - user.lastOnline : Infinity,\n          createdAgo: now - user.created,\n        }));\n        return resp;\n      }),\n\n    create: protectedProcedure('user.create')\n      .input(\n        z.object({\n          username: z.string(),\n          password: z.string(),\n        }),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { database } = getContextDeps();\n        const { username, password } = input;\n        const { log, error } = ctx;\n\n        if (!ctx.user.isOwner) return 'missing permission';\n        if (typeof username !== 'string' || typeof password !== 'string')\n          return 'username/password not a string';\n        if (!username.match(/^\\w{0,32}$/)) return 'username is not allowed';\n        if (password.length === 0 || password.length > 128)\n          return 'invalid password size';\n\n        if (ctx.user.isOwner && ctx.user.username === '') {\n          try {\n            await database.stores.users.update(\n              { _id: ctx.user._id },\n              { username, hash: await database.hash(password) },\n            );\n          } catch (e) {\n            error('error setting owner password', e);\n            return 'error setting owner password';\n          }\n          log(`created account as \"${username.yellow}\"`);\n          return '';\n        }\n\n        if (await database.userExists(username)) return 'user already exists';\n\n        try {\n          await database.createUser(username, password);\n        } catch (e) {\n          error('error creating new user', e);\n          return 'error creating new user';\n        }\n        log(`created new user \"${username.yellow}\"`);\n        return '';\n      }),\n\n    passwd: protectedProcedure('user.passwd')\n      .input(\n        z.object({\n          username: z.string(),\n          password: z.string(),\n        }),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { database } = getContextDeps();\n        const { username, password } = input;\n        const { log, error } = ctx;\n\n        if (!ctx.user.isOwner && username !== ctx.user.username)\n          return 'missing permission';\n        if (typeof username !== 'string' || typeof password !== 'string')\n          return 'username/password not a string';\n        if (!username.match(/^\\w{0,32}$/)) return 'username is not allowed';\n        if (!(await database.userExists(username)))\n          return 'user does not exist';\n\n        try {\n          await database.userPasswd(username, password);\n        } catch (e) {\n          error('error setting user password', e);\n          return \"error setting user's password\";\n        }\n        log(`changed password for \"${username.yellow}\"`);\n        return '';\n      }),\n  }),\n});\n"],"names":["router","protectedProcedure","z","getContextDeps"],"mappings":";;;;AAGO,MAAM,aAAaA,KAAAA,OAAO;AAAA,EAC/B,MAAMA,KAAAA,OAAO;AAAA,IACX,MAAMC,KAAAA,mBAA8B,EACjC;AAAA,MACCC,GAAAA,EACG,OAAO;AAAA,QACN,MAAMA,GAAAA,EAAE,OAAA,EAAS,SAAA,EAAW,QAAQ,CAAC;AAAA,QACrC,QAAQA,GAAAA,EAAE,OAAA,EAAS,SAAA,EAAW,QAAQ,EAAE;AAAA,QACxC,MAAMA,GAAAA,EAAE,OAAA,EAAS,SAAA,EAAW,QAAQ,MAAM;AAAA,QAC1C,WAAWA,GAAAA,EAAE,OAAA,EAAS,SAAA,EAAW,QAAQ,CAAC;AAAA,MAAA,CAC3C,EACA,SAAA,EACA,QAAQ,EAAE,MAAM,GAAG,QAAQ,IAAI,MAAM,QAAQ,WAAW,GAAG;AAAA,IAAA,EAE/D,MAAM,OAAO,EAAE,YAAY;AAC1B,YAAM,EAAE,SAAA,IAAaC,oBAAA;AACrB,YAAM,EAAE,MAAM,QAAQ,MAAM,cAAc;AAC1C,YAAM,OAAO,MAAM,SAAS,SAAS,EAAE,MAAM,QAAQ,MAAM,WAAW;AACtE,YAAM,MAAM,KAAK,IAAA;AACjB,WAAK,QAAQ,KAAK,MAAM,IAAI,CAAC,EAAE,MAAM,GAAG,GAAG,YAAY;AAAA,QACrD,GAAG;AAAA,QACH,MAAM;AAAA,QACN,SAAS,KAAK,aAAa,MAAM,KAAK,aAAa;AAAA,QACnD,YAAY,MAAM,KAAK;AAAA,MAAA,EACvB;AACF,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,QAAQF,KAAAA,mBAAgC,EACrC;AAAA,MACCC,GAAAA,EAAE,OAAO;AAAA,QACP,UAAUA,GAAAA,EAAE,OAAA;AAAA,QACZ,UAAUA,GAAAA,EAAE,OAAA;AAAA,MAAO,CACpB;AAAA,IAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,SAAA,IAAaC,oBAAA;AACrB,YAAM,EAAE,UAAU,SAAA,IAAa;AAC/B,YAAM,EAAE,KAAK,MAAA,IAAU;AAEvB,UAAI,CAAC,IAAI,KAAK,QAAS,QAAO;AAC9B,UAAI,OAAO,aAAa,YAAY,OAAO,aAAa;AACtD,eAAO;AACT,UAAI,CAAC,SAAS,MAAM,YAAY,EAAG,QAAO;AAC1C,UAAI,SAAS,WAAW,KAAK,SAAS,SAAS;AAC7C,eAAO;AAET,UAAI,IAAI,KAAK,WAAW,IAAI,KAAK,aAAa,IAAI;AAChD,YAAI;AACF,gBAAM,SAAS,OAAO,MAAM;AAAA,YAC1B,EAAE,KAAK,IAAI,KAAK,IAAA;AAAA,YAChB,EAAE,UAAU,MAAM,MAAM,SAAS,KAAK,QAAQ,EAAA;AAAA,UAAE;AAAA,QAEpD,SAAS,GAAG;AACV,gBAAM,gCAAgC,CAAC;AACvC,iBAAO;AAAA,QACT;AACA,YAAI,uBAAuB,SAAS,MAAM,GAAG;AAC7C,eAAO;AAAA,MACT;AAEA,UAAI,MAAM,SAAS,WAAW,QAAQ,EAAG,QAAO;AAEhD,UAAI;AACF,cAAM,SAAS,WAAW,UAAU,QAAQ;AAAA,MAC9C,SAAS,GAAG;AACV,cAAM,2BAA2B,CAAC;AAClC,eAAO;AAAA,MACT;AACA,UAAI,qBAAqB,SAAS,MAAM,GAAG;AAC3C,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,QAAQF,KAAAA,mBAAgC,EACrC;AAAA,MACCC,GAAAA,EAAE,OAAO;AAAA,QACP,UAAUA,GAAAA,EAAE,OAAA;AAAA,QACZ,UAAUA,GAAAA,EAAE,OAAA;AAAA,MAAO,CACpB;AAAA,IAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,SAAA,IAAaC,oBAAA;AACrB,YAAM,EAAE,UAAU,SAAA,IAAa;AAC/B,YAAM,EAAE,KAAK,MAAA,IAAU;AAEvB,UAAI,CAAC,IAAI,KAAK,WAAW,aAAa,IAAI,KAAK;AAC7C,eAAO;AACT,UAAI,OAAO,aAAa,YAAY,OAAO,aAAa;AACtD,eAAO;AACT,UAAI,CAAC,SAAS,MAAM,YAAY,EAAG,QAAO;AAC1C,UAAI,CAAE,MAAM,SAAS,WAAW,QAAQ;AACtC,eAAO;AAET,UAAI;AACF,cAAM,SAAS,WAAW,UAAU,QAAQ;AAAA,MAC9C,SAAS,GAAG;AACV,cAAM,+BAA+B,CAAC;AACtC,eAAO;AAAA,MACT;AACA,UAAI,yBAAyB,SAAS,MAAM,GAAG;AAC/C,aAAO;AAAA,IACT,CAAC;AAAA,EAAA,CACJ;AACH,CAAC;;"}
+{"version":3,"file":"user.js","sources":["../../../../src/webserver/backend/router/user.ts"],"sourcesContent":["import { z } from 'zod/v4';\nimport {\n  decodePermissions,\n  resolveAllScopes,\n  userHasScope,\n  type PermissionSet,\n} from '../permissions';\nimport { ScopeName } from '../scopes';\nimport { router, protectedProcedure, getContextDeps } from '../trpc';\nimport type { IStoreUser } from '../types';\n\nconst PermissionSetSchema = z.object({\n  root: z.enum(['all', 'read', 'off']),\n  domains: z.record(z.string(), z.enum(['all', 'read', 'none'])),\n  scopes: z.record(z.string(), z.boolean()),\n});\n\nexport const userRouter = router({\n  user: router({\n    list: protectedProcedure(ScopeName.UserList)\n      .input(\n        z\n          .object({\n            page: z.number().optional().default(0),\n            search: z.string().optional().default(''),\n            sort: z.string().optional().default('name'),\n            direction: z.number().optional().default(1),\n          })\n          .optional()\n          .default({ page: 0, search: '', sort: 'name', direction: 1 }),\n      )\n      .query(async ({ input }) => {\n        const { database } = getContextDeps();\n        const { page, search, sort, direction } = input;\n        const resp = await database.getUsers({ page, search, sort, direction });\n        const now = Date.now();\n        resp.users = resp.users.map(\n          ({\n            hash: _h,\n            totpSecret: _ts,\n            recoveryCodes: _rc,\n            passkeys: _pk,\n            permissions: _perms,\n            ...user\n          }) => ({\n            ...user,\n            hash: '',\n            permissions: decodePermissions(_perms as any),\n            totpEnabled: user.totpEnabled ?? false,\n            passkeyCount: _pk?.length ?? 0,\n            seenAgo: user.lastOnline ? now - user.lastOnline : Infinity,\n            createdAgo: now - user.created,\n          }),\n        );\n        return resp;\n      }),\n\n    self: protectedProcedure(ScopeName.SessionInfo).query(async ({ ctx }) => {\n      const now = Date.now();\n      return {\n        username: ctx.user.username || 'Admin',\n        isOwner: ctx.user.isOwner,\n        isBanned: ctx.user.isBanned ?? false,\n        lastOnline: ctx.user.lastOnline ?? 0,\n        created: ctx.user.created ?? 0,\n        seenAgo: ctx.user.lastOnline ? now - ctx.user.lastOnline : Infinity,\n        createdAgo: now - (ctx.user.created ?? now),\n        permissions: ctx.user.permissions,\n        totpEnabled: ctx.user.totpEnabled ?? false,\n        passkeyCount: ctx.user.passkeys?.length ?? 0,\n      };\n    }),\n\n    create: protectedProcedure(ScopeName.UserCreate)\n      .input(\n        z.object({\n          username: z.string(),\n          password: z.string(),\n        }),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { database } = getContextDeps();\n        const { username, password } = input;\n        const { log, error } = ctx;\n\n        if (typeof username !== 'string' || typeof password !== 'string')\n          return 'username/password not a string';\n        if (!username.match(/^\\w{0,32}$/)) return 'username is not allowed';\n        if (password.length === 0 || password.length > 128)\n          return 'invalid password size';\n\n        if (ctx.user.isOwner && ctx.user.username === '') {\n          try {\n            await database.stores.users.update(\n              { _id: ctx.user._id },\n              { username, hash: await database.hash(password) },\n            );\n          } catch (e) {\n            error('error setting owner password', e);\n            return 'error setting owner password';\n          }\n          log(`created account as \"${username.yellow}\"`);\n          return '';\n        }\n\n        if (await database.userExists(username)) return 'user already exists';\n\n        try {\n          await database.createUser(username, password);\n        } catch (e) {\n          error('error creating new user', e);\n          return 'error creating new user';\n        }\n        log(`created new user \"${username.yellow}\"`);\n        return '';\n      }),\n\n    // self-service: any authenticated user can change their own password\n    // changing another user's password requires user.passwd permission (enforced here)\n    passwd: protectedProcedure(ScopeName.SessionInfo)\n      .input(\n        z.object({\n          username: z.string(),\n          password: z.string(),\n          currentPassword: z.string().optional(),\n        }),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { database } = getContextDeps();\n        const { username, password } = input;\n        const { log, error } = ctx;\n\n        const isSelf = username === ctx.user.username;\n        if (isSelf) {\n          if (!input.currentPassword) return 'current password required';\n          const bcryptLib = await import('bcryptjs');\n          if (!(await bcryptLib.compare(input.currentPassword, ctx.user.hash)))\n            return 'incorrect current password';\n        } else {\n          const defaults = await database.getDefaultPermissions();\n          if (!userHasScope(ctx.user, ScopeName.UserPasswd, defaults))\n            return 'missing permission';\n        }\n\n        if (typeof username !== 'string' || typeof password !== 'string')\n          return 'username/password not a string';\n        if (!username.match(/^\\w{0,32}$/)) return 'username is not allowed';\n        if (!(await database.userExists(username)))\n          return 'user does not exist';\n\n        try {\n          await database.userPasswd(username, password);\n        } catch (e) {\n          error('error setting user password', e);\n          return \"error setting user's password\";\n        }\n        log(`changed password for \"${username.yellow}\"`);\n        return '';\n      }),\n\n    ban: protectedProcedure(ScopeName.UserBan)\n      .input(\n        z.object({\n          username: z.string(),\n          banned: z.boolean(),\n        }),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { database } = getContextDeps();\n        const { username, banned } = input;\n        const { log } = ctx;\n\n        if (username === ctx.user.username) return 'cannot disable yourself';\n        if (!(await database.userExists(username)))\n          return 'user does not exist';\n\n        const target = await database.stores.users.findOne<\n          IStoreUser & { _id: string }\n        >({ type: 'user', username });\n        if (target?.isOwner) return 'cannot disable the owner';\n\n        await database.banUser(username, banned);\n        log(`${banned ? 'disabled' : 'enabled'} user \"${username.yellow}\"`);\n        return '';\n      }),\n\n    delete: protectedProcedure(ScopeName.UserDelete)\n      .input(\n        z.object({\n          username: z.string(),\n        }),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { database } = getContextDeps();\n        const { username } = input;\n        const { log } = ctx;\n\n        if (username === ctx.user.username) return 'cannot delete yourself';\n        if (!(await database.userExists(username)))\n          return 'user does not exist';\n\n        const target = await database.stores.users.findOne<\n          IStoreUser & { _id: string }\n        >({ type: 'user', username });\n        if (target?.isOwner) return 'cannot delete the owner';\n\n        await database.deleteUser(username);\n        log(`deleted user \"${username.yellow}\"`);\n        return '';\n      }),\n\n    permissions: protectedProcedure(ScopeName.UserPermissions)\n      .input(\n        z.object({\n          username: z.string(),\n          permissions: PermissionSetSchema,\n        }),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { database } = getContextDeps();\n        const { username } = input;\n        const permissions = input.permissions as PermissionSet;\n        const { log } = ctx;\n\n        if (username === ctx.user.username)\n          return 'cannot edit own permissions';\n\n        const target = await database.stores.users.findOne<\n          IStoreUser & { _id: string }\n        >({ type: 'user', username });\n        if (!target) return 'user does not exist';\n        if (target.isOwner) return 'cannot edit the owner';\n\n        // privilege escalation check: non-owner can't grant scopes they don't have\n        if (!ctx.user.isOwner) {\n          const defaults = await database.getDefaultPermissions();\n          const myScopes = resolveAllScopes(ctx.user.permissions!, defaults);\n          const grantedScopes = resolveAllScopes(permissions, defaults);\n          for (const [scope, granted] of Object.entries(grantedScopes)) {\n            if (granted && !myScopes[scope as keyof typeof myScopes])\n              return `cannot grant permission you do not have: ${scope}`;\n          }\n        }\n\n        await database.setUserPermissions(username, permissions);\n        log(`updated permissions for \"${username.yellow}\"`);\n        return '';\n      }),\n\n    defaultPermissions: router({\n      get: protectedProcedure(ScopeName.UserPermissions).query(async () => {\n        const { database } = getContextDeps();\n        const defaults = await database.getDefaultPermissions();\n        return {\n          root: defaults.root,\n          domains: defaults.domains,\n          scopes: defaults.scopes,\n        };\n      }),\n\n      set: protectedProcedure(ScopeName.UserPermissions)\n        .input(PermissionSetSchema)\n        .mutation(async ({ input, ctx }) => {\n          const { database } = getContextDeps();\n          const { log } = ctx;\n          await database.setDefaultPermissions(\n            input as unknown as PermissionSet,\n          );\n          log(`updated default permissions`);\n          return '';\n        }),\n    }),\n\n    resetMfa: protectedProcedure(ScopeName.UserResetMfa)\n      .input(z.object({ username: z.string() }))\n      .mutation(async ({ input, ctx }) => {\n        const { database } = getContextDeps();\n        const { username } = input;\n        const { log } = ctx;\n\n        if (username === ctx.user.username) return 'cannot reset own MFA';\n\n        const target = await database.stores.users.findOne<\n          IStoreUser & { _id: string }\n        >({ type: 'user', username });\n        if (!target) return 'user does not exist';\n        if (target.isOwner) return 'cannot reset the owner';\n\n        await database.resetUserMfa(username);\n        log(`reset MFA for \"${username.yellow}\"`);\n        return '';\n      }),\n  }),\n});\n"],"names":["z","router","protectedProcedure","ScopeName","getContextDeps","decodePermissions","userHasScope","permissions","resolveAllScopes"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAM,sBAAsBA,GAAAA,EAAE,OAAO;AAAA,EACnC,MAAMA,GAAAA,EAAE,KAAK,CAAC,OAAO,QAAQ,KAAK,CAAC;AAAA,EACnC,SAASA,GAAAA,EAAE,OAAOA,GAAAA,EAAE,OAAA,GAAUA,KAAE,KAAK,CAAC,OAAO,QAAQ,MAAM,CAAC,CAAC;AAAA,EAC7D,QAAQA,GAAAA,EAAE,OAAOA,GAAAA,EAAE,UAAUA,GAAAA,EAAE,SAAS;AAC1C,CAAC;AAEM,MAAM,aAAaC,KAAAA,OAAO;AAAA,EAC/B,MAAMA,KAAAA,OAAO;AAAA,IACX,MAAMC,KAAAA,mBAAmBC,iBAAU,QAAQ,EACxC;AAAA,MACCH,GAAAA,EACG,OAAO;AAAA,QACN,MAAMA,GAAAA,EAAE,OAAA,EAAS,SAAA,EAAW,QAAQ,CAAC;AAAA,QACrC,QAAQA,GAAAA,EAAE,OAAA,EAAS,SAAA,EAAW,QAAQ,EAAE;AAAA,QACxC,MAAMA,GAAAA,EAAE,OAAA,EAAS,SAAA,EAAW,QAAQ,MAAM;AAAA,QAC1C,WAAWA,GAAAA,EAAE,OAAA,EAAS,SAAA,EAAW,QAAQ,CAAC;AAAA,MAAA,CAC3C,EACA,SAAA,EACA,QAAQ,EAAE,MAAM,GAAG,QAAQ,IAAI,MAAM,QAAQ,WAAW,GAAG;AAAA,IAAA,EAE/D,MAAM,OAAO,EAAE,YAAY;AAC1B,YAAM,EAAE,SAAA,IAAaI,oBAAA;AACrB,YAAM,EAAE,MAAM,QAAQ,MAAM,cAAc;AAC1C,YAAM,OAAO,MAAM,SAAS,SAAS,EAAE,MAAM,QAAQ,MAAM,WAAW;AACtE,YAAM,MAAM,KAAK,IAAA;AACjB,WAAK,QAAQ,KAAK,MAAM;AAAA,QACtB,CAAC;AAAA,UACC,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,eAAe;AAAA,UACf,UAAU;AAAA,UACV,aAAa;AAAA,UACb,GAAG;AAAA,QAAA,OACE;AAAA,UACL,GAAG;AAAA,UACH,MAAM;AAAA,UACN,aAAaC,YAAAA,kBAAkB,MAAa;AAAA,UAC5C,aAAa,KAAK,eAAe;AAAA,UACjC,cAAc,KAAK,UAAU;AAAA,UAC7B,SAAS,KAAK,aAAa,MAAM,KAAK,aAAa;AAAA,UACnD,YAAY,MAAM,KAAK;AAAA,QAAA;AAAA,MACzB;AAEF,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,MAAMH,KAAAA,mBAAmBC,iBAAU,WAAW,EAAE,MAAM,OAAO,EAAE,UAAU;AACvE,YAAM,MAAM,KAAK,IAAA;AACjB,aAAO;AAAA,QACL,UAAU,IAAI,KAAK,YAAY;AAAA,QAC/B,SAAS,IAAI,KAAK;AAAA,QAClB,UAAU,IAAI,KAAK,YAAY;AAAA,QAC/B,YAAY,IAAI,KAAK,cAAc;AAAA,QACnC,SAAS,IAAI,KAAK,WAAW;AAAA,QAC7B,SAAS,IAAI,KAAK,aAAa,MAAM,IAAI,KAAK,aAAa;AAAA,QAC3D,YAAY,OAAO,IAAI,KAAK,WAAW;AAAA,QACvC,aAAa,IAAI,KAAK;AAAA,QACtB,aAAa,IAAI,KAAK,eAAe;AAAA,QACrC,cAAc,IAAI,KAAK,UAAU,UAAU;AAAA,MAAA;AAAA,IAE/C,CAAC;AAAA,IAED,QAAQD,KAAAA,mBAAmBC,iBAAU,UAAU,EAC5C;AAAA,MACCH,GAAAA,EAAE,OAAO;AAAA,QACP,UAAUA,GAAAA,EAAE,OAAA;AAAA,QACZ,UAAUA,GAAAA,EAAE,OAAA;AAAA,MAAO,CACpB;AAAA,IAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,SAAA,IAAaI,oBAAA;AACrB,YAAM,EAAE,UAAU,SAAA,IAAa;AAC/B,YAAM,EAAE,KAAK,MAAA,IAAU;AAEvB,UAAI,OAAO,aAAa,YAAY,OAAO,aAAa;AACtD,eAAO;AACT,UAAI,CAAC,SAAS,MAAM,YAAY,EAAG,QAAO;AAC1C,UAAI,SAAS,WAAW,KAAK,SAAS,SAAS;AAC7C,eAAO;AAET,UAAI,IAAI,KAAK,WAAW,IAAI,KAAK,aAAa,IAAI;AAChD,YAAI;AACF,gBAAM,SAAS,OAAO,MAAM;AAAA,YAC1B,EAAE,KAAK,IAAI,KAAK,IAAA;AAAA,YAChB,EAAE,UAAU,MAAM,MAAM,SAAS,KAAK,QAAQ,EAAA;AAAA,UAAE;AAAA,QAEpD,SAAS,GAAG;AACV,gBAAM,gCAAgC,CAAC;AACvC,iBAAO;AAAA,QACT;AACA,YAAI,uBAAuB,SAAS,MAAM,GAAG;AAC7C,eAAO;AAAA,MACT;AAEA,UAAI,MAAM,SAAS,WAAW,QAAQ,EAAG,QAAO;AAEhD,UAAI;AACF,cAAM,SAAS,WAAW,UAAU,QAAQ;AAAA,MAC9C,SAAS,GAAG;AACV,cAAM,2BAA2B,CAAC;AAClC,eAAO;AAAA,MACT;AACA,UAAI,qBAAqB,SAAS,MAAM,GAAG;AAC3C,aAAO;AAAA,IACT,CAAC;AAAA;AAAA;AAAA,IAIH,QAAQF,KAAAA,mBAAmBC,iBAAU,WAAW,EAC7C;AAAA,MACCH,GAAAA,EAAE,OAAO;AAAA,QACP,UAAUA,GAAAA,EAAE,OAAA;AAAA,QACZ,UAAUA,GAAAA,EAAE,OAAA;AAAA,QACZ,iBAAiBA,GAAAA,EAAE,OAAA,EAAS,SAAA;AAAA,MAAS,CACtC;AAAA,IAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,SAAA,IAAaI,oBAAA;AACrB,YAAM,EAAE,UAAU,SAAA,IAAa;AAC/B,YAAM,EAAE,KAAK,MAAA,IAAU;AAEvB,YAAM,SAAS,aAAa,IAAI,KAAK;AACrC,UAAI,QAAQ;AACV,YAAI,CAAC,MAAM,gBAAiB,QAAO;AACnC,cAAM,YAAY,MAAM,OAAO,UAAU;AACzC,YAAI,CAAE,MAAM,UAAU,QAAQ,MAAM,iBAAiB,IAAI,KAAK,IAAI;AAChE,iBAAO;AAAA,MACX,OAAO;AACL,cAAM,WAAW,MAAM,SAAS,sBAAA;AAChC,YAAI,CAACE,YAAAA,aAAa,IAAI,MAAMH,OAAAA,UAAU,YAAY,QAAQ;AACxD,iBAAO;AAAA,MACX;AAEA,UAAI,OAAO,aAAa,YAAY,OAAO,aAAa;AACtD,eAAO;AACT,UAAI,CAAC,SAAS,MAAM,YAAY,EAAG,QAAO;AAC1C,UAAI,CAAE,MAAM,SAAS,WAAW,QAAQ;AACtC,eAAO;AAET,UAAI;AACF,cAAM,SAAS,WAAW,UAAU,QAAQ;AAAA,MAC9C,SAAS,GAAG;AACV,cAAM,+BAA+B,CAAC;AACtC,eAAO;AAAA,MACT;AACA,UAAI,yBAAyB,SAAS,MAAM,GAAG;AAC/C,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,KAAKD,KAAAA,mBAAmBC,iBAAU,OAAO,EACtC;AAAA,MACCH,GAAAA,EAAE,OAAO;AAAA,QACP,UAAUA,GAAAA,EAAE,OAAA;AAAA,QACZ,QAAQA,GAAAA,EAAE,QAAA;AAAA,MAAQ,CACnB;AAAA,IAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,SAAA,IAAaI,oBAAA;AACrB,YAAM,EAAE,UAAU,OAAA,IAAW;AAC7B,YAAM,EAAE,QAAQ;AAEhB,UAAI,aAAa,IAAI,KAAK,SAAU,QAAO;AAC3C,UAAI,CAAE,MAAM,SAAS,WAAW,QAAQ;AACtC,eAAO;AAET,YAAM,SAAS,MAAM,SAAS,OAAO,MAAM,QAEzC,EAAE,MAAM,QAAQ,UAAU;AAC5B,UAAI,QAAQ,QAAS,QAAO;AAE5B,YAAM,SAAS,QAAQ,UAAU,MAAM;AACvC,UAAI,GAAG,SAAS,aAAa,SAAS,UAAU,SAAS,MAAM,GAAG;AAClE,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,QAAQF,KAAAA,mBAAmBC,iBAAU,UAAU,EAC5C;AAAA,MACCH,GAAAA,EAAE,OAAO;AAAA,QACP,UAAUA,GAAAA,EAAE,OAAA;AAAA,MAAO,CACpB;AAAA,IAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,SAAA,IAAaI,oBAAA;AACrB,YAAM,EAAE,aAAa;AACrB,YAAM,EAAE,QAAQ;AAEhB,UAAI,aAAa,IAAI,KAAK,SAAU,QAAO;AAC3C,UAAI,CAAE,MAAM,SAAS,WAAW,QAAQ;AACtC,eAAO;AAET,YAAM,SAAS,MAAM,SAAS,OAAO,MAAM,QAEzC,EAAE,MAAM,QAAQ,UAAU;AAC5B,UAAI,QAAQ,QAAS,QAAO;AAE5B,YAAM,SAAS,WAAW,QAAQ;AAClC,UAAI,iBAAiB,SAAS,MAAM,GAAG;AACvC,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,aAAaF,KAAAA,mBAAmBC,iBAAU,eAAe,EACtD;AAAA,MACCH,GAAAA,EAAE,OAAO;AAAA,QACP,UAAUA,GAAAA,EAAE,OAAA;AAAA,QACZ,aAAa;AAAA,MAAA,CACd;AAAA,IAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,SAAA,IAAaI,oBAAA;AACrB,YAAM,EAAE,aAAa;AACrB,YAAMG,gBAAc,MAAM;AAC1B,YAAM,EAAE,QAAQ;AAEhB,UAAI,aAAa,IAAI,KAAK;AACxB,eAAO;AAET,YAAM,SAAS,MAAM,SAAS,OAAO,MAAM,QAEzC,EAAE,MAAM,QAAQ,UAAU;AAC5B,UAAI,CAAC,OAAQ,QAAO;AACpB,UAAI,OAAO,QAAS,QAAO;AAG3B,UAAI,CAAC,IAAI,KAAK,SAAS;AACrB,cAAM,WAAW,MAAM,SAAS,sBAAA;AAChC,cAAM,WAAWC,YAAAA,iBAAiB,IAAI,KAAK,aAAc,QAAQ;AACjE,cAAM,gBAAgBA,YAAAA,iBAAiBD,eAAa,QAAQ;AAC5D,mBAAW,CAAC,OAAO,OAAO,KAAK,OAAO,QAAQ,aAAa,GAAG;AAC5D,cAAI,WAAW,CAAC,SAAS,KAA8B;AACrD,mBAAO,4CAA4C,KAAK;AAAA,QAC5D;AAAA,MACF;AAEA,YAAM,SAAS,mBAAmB,UAAUA,aAAW;AACvD,UAAI,4BAA4B,SAAS,MAAM,GAAG;AAClD,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,oBAAoBN,KAAAA,OAAO;AAAA,MACzB,KAAKC,KAAAA,mBAAmBC,OAAAA,UAAU,eAAe,EAAE,MAAM,YAAY;AACnE,cAAM,EAAE,SAAA,IAAaC,oBAAA;AACrB,cAAM,WAAW,MAAM,SAAS,sBAAA;AAChC,eAAO;AAAA,UACL,MAAM,SAAS;AAAA,UACf,SAAS,SAAS;AAAA,UAClB,QAAQ,SAAS;AAAA,QAAA;AAAA,MAErB,CAAC;AAAA,MAED,KAAKF,KAAAA,mBAAmBC,iBAAU,eAAe,EAC9C,MAAM,mBAAmB,EACzB,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,cAAM,EAAE,SAAA,IAAaC,oBAAA;AACrB,cAAM,EAAE,QAAQ;AAChB,cAAM,SAAS;AAAA,UACb;AAAA,QAAA;AAEF,YAAI,6BAA6B;AACjC,eAAO;AAAA,MACT,CAAC;AAAA,IAAA,CACJ;AAAA,IAED,UAAUF,KAAAA,mBAAmBC,iBAAU,YAAY,EAChD,MAAMH,GAAAA,EAAE,OAAO,EAAE,UAAUA,GAAAA,EAAE,OAAA,EAAO,CAAG,CAAC,EACxC,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,SAAA,IAAaI,oBAAA;AACrB,YAAM,EAAE,aAAa;AACrB,YAAM,EAAE,QAAQ;AAEhB,UAAI,aAAa,IAAI,KAAK,SAAU,QAAO;AAE3C,YAAM,SAAS,MAAM,SAAS,OAAO,MAAM,QAEzC,EAAE,MAAM,QAAQ,UAAU;AAC5B,UAAI,CAAC,OAAQ,QAAO;AACpB,UAAI,OAAO,QAAS,QAAO;AAE3B,YAAM,SAAS,aAAa,QAAQ;AACpC,UAAI,kBAAkB,SAAS,MAAM,GAAG;AACxC,aAAO;AAAA,IACT,CAAC;AAAA,EAAA,CACJ;AACH,CAAC;;"}

package/dist/webserver/backend/router/world.js

@@ -2,15 +2,16 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const brdb = require("../../../util/brdb.js");
 const v4 = require("zod/v4");
+const scopes = require("../scopes.js");
 const trpc = require("../trpc.js");
 const worldRouter = trpc.router({
   world: trpc.router({
-    list: trpc.protectedProcedure().query(() => {
+    list: trpc.protectedProcedure(scopes.ScopeName.WorldList).query(() => {
       const { omegga } = trpc.getContextDeps();
       const prefix = omegga.worldPath + "/";
       return omegga.getWorlds().map((world) => world.replace(prefix, "").replace(/\.brdb$/, ""));
     }),
-    revisions: trpc.protectedProcedure().input(v4.z.object({ world: v4.z.string() })).query(async ({ input }) => {
+    revisions: trpc.protectedProcedure(scopes.ScopeName.WorldRevisions).input(v4.z.object({ world: v4.z.string() })).query(async ({ input }) => {
       const { omegga } = trpc.getContextDeps();
       try {
         return (await omegga.getWorldRevisions(input.world))?.map(
@@ -20,7 +21,7 @@ const worldRouter = trpc.router({
         return null;
       }
     }),
-    meta: trpc.protectedProcedure().input(v4.z.object({ world: v4.z.string() })).query(async ({ input, ctx }) => {
+    meta: trpc.protectedProcedure(scopes.ScopeName.WorldMeta).input(v4.z.object({ world: v4.z.string() })).query(async ({ input, ctx }) => {
       const { omegga } = trpc.getContextDeps();
       try {
         const path = omegga.getWorldPath(input.world);
@@ -31,15 +32,15 @@ const worldRouter = trpc.router({
         return null;
       }
     }),
-    next: trpc.protectedProcedure().query(() => {
+    next: trpc.protectedProcedure(scopes.ScopeName.WorldNext).query(() => {
       const { omegga } = trpc.getContextDeps();
       return omegga.getNextWorld();
     }),
-    active: trpc.protectedProcedure().query(() => {
+    active: trpc.protectedProcedure(scopes.ScopeName.WorldActive).query(() => {
       const { omegga } = trpc.getContextDeps();
       return omegga.getActiveWorld();
     }),
-    load: trpc.protectedProcedure().input(
+    load: trpc.protectedProcedure(scopes.ScopeName.WorldLoad).input(
       v4.z.object({
         world: v4.z.string(),
         revision: v4.z.number().optional()
@@ -69,7 +70,7 @@ const worldRouter = trpc.router({
         return false;
       }
     }),
-    use: trpc.protectedProcedure().input(
+    use: trpc.protectedProcedure(scopes.ScopeName.WorldUse).input(
       v4.z.object({
         world: v4.z.string().optional()
       })
@@ -85,7 +86,7 @@ const worldRouter = trpc.router({
         return false;
       }
     }),
-    create: trpc.protectedProcedure().input(
+    create: trpc.protectedProcedure(scopes.ScopeName.WorldCreate).input(
       v4.z.object({
         name: v4.z.string(),
         level: v4.z.enum(["Plate", "Space", "Studio", "Peaks"]).optional()
@@ -109,7 +110,7 @@ const worldRouter = trpc.router({
         return false;
       }
     }),
-    save: trpc.protectedProcedure().input(
+    save: trpc.protectedProcedure(scopes.ScopeName.WorldSave).input(
       v4.z.object({
         name: v4.z.string().optional()
       }).optional().default({})

package/dist/webserver/backend/router/world.js.map

@@ -1 +1 @@
-{"version":3,"file":"world.js","sources":["../../../../src/webserver/backend/router/world.ts"],"sourcesContent":["import { readBrdbMeta } from '@util/brdb';\nimport { z } from 'zod/v4';\nimport { getContextDeps, protectedProcedure, router } from '../trpc';\n\nexport const worldRouter = router({\n  world: router({\n    list: protectedProcedure('world.list').query(() => {\n      const { omegga } = getContextDeps();\n      const prefix = omegga.worldPath + '/';\n      return omegga\n        .getWorlds()\n        .map(world => world.replace(prefix, '').replace(/\\.brdb$/, ''));\n    }),\n\n    revisions: protectedProcedure('world.revisions')\n      .input(z.object({ world: z.string() }))\n      .query(async ({ input }) => {\n        const { omegga } = getContextDeps();\n        try {\n          return (\n            (await omegga.getWorldRevisions(input.world))?.map(\n              ({ date, ...r }) => ({ ...r, date: date.getTime() }),\n            ) ?? null\n          );\n        } catch (_err) {\n          return null;\n        }\n      }),\n\n    meta: protectedProcedure('world.meta')\n      .input(z.object({ world: z.string() }))\n      .query(async ({ input, ctx }) => {\n        const { omegga } = getContextDeps();\n        try {\n          const path = omegga.getWorldPath(input.world);\n          if (!path) return null;\n          return readBrdbMeta(path);\n        } catch (err) {\n          ctx.error('Error while getting world meta', err);\n          return null;\n        }\n      }),\n\n    next: protectedProcedure('world.next').query(() => {\n      const { omegga } = getContextDeps();\n      return omegga.getNextWorld();\n    }),\n\n    active: protectedProcedure('world.active').query(() => {\n      const { omegga } = getContextDeps();\n      return omegga.getActiveWorld();\n    }),\n\n    load: protectedProcedure('world.load')\n      .input(\n        z.object({\n          world: z.string(),\n          revision: z.number().optional(),\n        }),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { omegga } = getContextDeps();\n        const { log, error } = ctx;\n        try {\n          let res = false;\n          if (input.revision) {\n            log(\n              'Loading world revision',\n              input.revision,\n              'of',\n              input.world.yellow,\n            );\n            res = await omegga.loadWorldRevision(input.world, input.revision);\n          } else {\n            log('Loading world', input.world.yellow);\n            res = await omegga.loadWorld(input.world);\n          }\n          if (res) log('World loaded successfully');\n          else log('World load failed');\n          return res;\n        } catch (err) {\n          error('Error while loading world', err);\n          return false;\n        }\n      }),\n\n    use: protectedProcedure('world.use')\n      .input(\n        z.object({\n          world: z.string().optional(),\n        }),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { omegga } = getContextDeps();\n        const { log, error } = ctx;\n        try {\n          const ok = omegga.setActiveWorld(input.world || null);\n          if (ok) log('Set default world to', (input.world || 'none').yellow);\n          return ok;\n        } catch (err) {\n          error('Error while using world', err);\n          return false;\n        }\n      }),\n\n    create: protectedProcedure('world.create')\n      .input(\n        z.object({\n          name: z.string(),\n          level: z.enum(['Plate', 'Space', 'Studio', 'Peaks']).optional(),\n        }),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { omegga } = getContextDeps();\n        const { log, error } = ctx;\n        try {\n          log(\n            'Creating new world',\n            input.name.yellow,\n            'with level',\n            input.level?.yellow || 'Plate',\n          );\n          const res = await omegga.createEmptyWorld(input.name, input.level);\n          if (res) log('World created successfully');\n          else log('World creation failed');\n          return res;\n        } catch (err) {\n          error('Error while creating world', err);\n          return false;\n        }\n      }),\n\n    save: protectedProcedure('world.save')\n      .input(\n        z\n          .object({\n            name: z.string().optional(),\n          })\n          .optional()\n          .default({}),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { omegga } = getContextDeps();\n        const { log, error } = ctx;\n        try {\n          let res = false;\n          if (input.name) {\n            log('Saving world as', input.name.yellow);\n            res = await omegga.saveWorldAs(input.name);\n          } else {\n            log('Saving current world');\n            res = await omegga.saveWorld();\n          }\n          if (res) log('World saved successfully');\n          else log('World save failed');\n          return res;\n        } catch (err) {\n          error('Error while saving world', err);\n          return false;\n        }\n      }),\n  }),\n});\n"],"names":["router","protectedProcedure","getContextDeps","z","readBrdbMeta"],"mappings":";;;;;AAIO,MAAM,cAAcA,KAAAA,OAAO;AAAA,EAChC,OAAOA,KAAAA,OAAO;AAAA,IACZ,MAAMC,KAAAA,mBAA+B,EAAE,MAAM,MAAM;AACjD,YAAM,EAAE,OAAA,IAAWC,oBAAA;AACnB,YAAM,SAAS,OAAO,YAAY;AAClC,aAAO,OACJ,UAAA,EACA,IAAI,CAAA,UAAS,MAAM,QAAQ,QAAQ,EAAE,EAAE,QAAQ,WAAW,EAAE,CAAC;AAAA,IAClE,CAAC;AAAA,IAED,WAAWD,KAAAA,mBAAoC,EAC5C,MAAME,GAAAA,EAAE,OAAO,EAAE,OAAOA,GAAAA,EAAE,OAAA,EAAO,CAAG,CAAC,EACrC,MAAM,OAAO,EAAE,YAAY;AAC1B,YAAM,EAAE,OAAA,IAAWD,oBAAA;AACnB,UAAI;AACF,gBACG,MAAM,OAAO,kBAAkB,MAAM,KAAK,IAAI;AAAA,UAC7C,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,GAAG,MAAM,KAAK,UAAQ;AAAA,QAAE,KAC/C;AAAA,MAET,SAAS,MAAM;AACb,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IAEH,MAAMD,KAAAA,mBAA+B,EAClC,MAAME,GAAAA,EAAE,OAAO,EAAE,OAAOA,GAAAA,EAAE,SAAO,CAAG,CAAC,EACrC,MAAM,OAAO,EAAE,OAAO,UAAU;AAC/B,YAAM,EAAE,OAAA,IAAWD,oBAAA;AACnB,UAAI;AACF,cAAM,OAAO,OAAO,aAAa,MAAM,KAAK;AAC5C,YAAI,CAAC,KAAM,QAAO;AAClB,eAAOE,KAAAA,aAAa,IAAI;AAAA,MAC1B,SAAS,KAAK;AACZ,YAAI,MAAM,kCAAkC,GAAG;AAC/C,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IAEH,MAAMH,KAAAA,mBAA+B,EAAE,MAAM,MAAM;AACjD,YAAM,EAAE,OAAA,IAAWC,oBAAA;AACnB,aAAO,OAAO,aAAA;AAAA,IAChB,CAAC;AAAA,IAED,QAAQD,KAAAA,mBAAiC,EAAE,MAAM,MAAM;AACrD,YAAM,EAAE,OAAA,IAAWC,oBAAA;AACnB,aAAO,OAAO,eAAA;AAAA,IAChB,CAAC;AAAA,IAED,MAAMD,KAAAA,mBAA+B,EAClC;AAAA,MACCE,GAAAA,EAAE,OAAO;AAAA,QACP,OAAOA,GAAAA,EAAE,OAAA;AAAA,QACT,UAAUA,GAAAA,EAAE,OAAA,EAAS,SAAA;AAAA,MAAS,CAC/B;AAAA,IAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,OAAA,IAAWD,oBAAA;AACnB,YAAM,EAAE,KAAK,MAAA,IAAU;AACvB,UAAI;AACF,YAAI,MAAM;AACV,YAAI,MAAM,UAAU;AAClB;AAAA,YACE;AAAA,YACA,MAAM;AAAA,YACN;AAAA,YACA,MAAM,MAAM;AAAA,UAAA;AAEd,gBAAM,MAAM,OAAO,kBAAkB,MAAM,OAAO,MAAM,QAAQ;AAAA,QAClE,OAAO;AACL,cAAI,iBAAiB,MAAM,MAAM,MAAM;AACvC,gBAAM,MAAM,OAAO,UAAU,MAAM,KAAK;AAAA,QAC1C;AACA,YAAI,SAAS,2BAA2B;AAAA,iBAC/B,mBAAmB;AAC5B,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,cAAM,6BAA6B,GAAG;AACtC,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IAEH,KAAKD,KAAAA,mBAA8B,EAChC;AAAA,MACCE,GAAAA,EAAE,OAAO;AAAA,QACP,OAAOA,GAAAA,EAAE,OAAA,EAAS,SAAA;AAAA,MAAS,CAC5B;AAAA,IAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,OAAA,IAAWD,oBAAA;AACnB,YAAM,EAAE,KAAK,MAAA,IAAU;AACvB,UAAI;AACF,cAAM,KAAK,OAAO,eAAe,MAAM,SAAS,IAAI;AACpD,YAAI,GAAI,KAAI,yBAAyB,MAAM,SAAS,QAAQ,MAAM;AAClE,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,cAAM,2BAA2B,GAAG;AACpC,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IAEH,QAAQD,KAAAA,mBAAiC,EACtC;AAAA,MACCE,GAAAA,EAAE,OAAO;AAAA,QACP,MAAMA,GAAAA,EAAE,OAAA;AAAA,QACR,OAAOA,GAAAA,EAAE,KAAK,CAAC,SAAS,SAAS,UAAU,OAAO,CAAC,EAAE,SAAA;AAAA,MAAS,CAC/D;AAAA,IAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,OAAA,IAAWD,oBAAA;AACnB,YAAM,EAAE,KAAK,MAAA,IAAU;AACvB,UAAI;AACF;AAAA,UACE;AAAA,UACA,MAAM,KAAK;AAAA,UACX;AAAA,UACA,MAAM,OAAO,UAAU;AAAA,QAAA;AAEzB,cAAM,MAAM,MAAM,OAAO,iBAAiB,MAAM,MAAM,MAAM,KAAK;AACjE,YAAI,SAAS,4BAA4B;AAAA,iBAChC,uBAAuB;AAChC,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,cAAM,8BAA8B,GAAG;AACvC,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IAEH,MAAMD,KAAAA,mBAA+B,EAClC;AAAA,MACCE,GAAAA,EACG,OAAO;AAAA,QACN,MAAMA,GAAAA,EAAE,OAAA,EAAS,SAAA;AAAA,MAAS,CAC3B,EACA,WACA,QAAQ,CAAA,CAAE;AAAA,IAAA,EAEd,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,OAAA,IAAWD,oBAAA;AACnB,YAAM,EAAE,KAAK,MAAA,IAAU;AACvB,UAAI;AACF,YAAI,MAAM;AACV,YAAI,MAAM,MAAM;AACd,cAAI,mBAAmB,MAAM,KAAK,MAAM;AACxC,gBAAM,MAAM,OAAO,YAAY,MAAM,IAAI;AAAA,QAC3C,OAAO;AACL,cAAI,sBAAsB;AAC1B,gBAAM,MAAM,OAAO,UAAA;AAAA,QACrB;AACA,YAAI,SAAS,0BAA0B;AAAA,iBAC9B,mBAAmB;AAC5B,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,cAAM,4BAA4B,GAAG;AACrC,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EAAA,CACJ;AACH,CAAC;;"}
+{"version":3,"file":"world.js","sources":["../../../../src/webserver/backend/router/world.ts"],"sourcesContent":["import { readBrdbMeta } from '@util/brdb';\nimport { z } from 'zod/v4';\nimport { ScopeName } from '../scopes';\nimport { getContextDeps, protectedProcedure, router } from '../trpc';\n\nexport const worldRouter = router({\n  world: router({\n    list: protectedProcedure(ScopeName.WorldList).query(() => {\n      const { omegga } = getContextDeps();\n      const prefix = omegga.worldPath + '/';\n      return omegga\n        .getWorlds()\n        .map(world => world.replace(prefix, '').replace(/\\.brdb$/, ''));\n    }),\n\n    revisions: protectedProcedure(ScopeName.WorldRevisions)\n      .input(z.object({ world: z.string() }))\n      .query(async ({ input }) => {\n        const { omegga } = getContextDeps();\n        try {\n          return (\n            (await omegga.getWorldRevisions(input.world))?.map(\n              ({ date, ...r }) => ({ ...r, date: date.getTime() }),\n            ) ?? null\n          );\n        } catch (_err) {\n          return null;\n        }\n      }),\n\n    meta: protectedProcedure(ScopeName.WorldMeta)\n      .input(z.object({ world: z.string() }))\n      .query(async ({ input, ctx }) => {\n        const { omegga } = getContextDeps();\n        try {\n          const path = omegga.getWorldPath(input.world);\n          if (!path) return null;\n          return readBrdbMeta(path);\n        } catch (err) {\n          ctx.error('Error while getting world meta', err);\n          return null;\n        }\n      }),\n\n    next: protectedProcedure(ScopeName.WorldNext).query(() => {\n      const { omegga } = getContextDeps();\n      return omegga.getNextWorld();\n    }),\n\n    active: protectedProcedure(ScopeName.WorldActive).query(() => {\n      const { omegga } = getContextDeps();\n      return omegga.getActiveWorld();\n    }),\n\n    load: protectedProcedure(ScopeName.WorldLoad)\n      .input(\n        z.object({\n          world: z.string(),\n          revision: z.number().optional(),\n        }),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { omegga } = getContextDeps();\n        const { log, error } = ctx;\n        try {\n          let res = false;\n          if (input.revision) {\n            log(\n              'Loading world revision',\n              input.revision,\n              'of',\n              input.world.yellow,\n            );\n            res = await omegga.loadWorldRevision(input.world, input.revision);\n          } else {\n            log('Loading world', input.world.yellow);\n            res = await omegga.loadWorld(input.world);\n          }\n          if (res) log('World loaded successfully');\n          else log('World load failed');\n          return res;\n        } catch (err) {\n          error('Error while loading world', err);\n          return false;\n        }\n      }),\n\n    use: protectedProcedure(ScopeName.WorldUse)\n      .input(\n        z.object({\n          world: z.string().optional(),\n        }),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { omegga } = getContextDeps();\n        const { log, error } = ctx;\n        try {\n          const ok = omegga.setActiveWorld(input.world || null);\n          if (ok) log('Set default world to', (input.world || 'none').yellow);\n          return ok;\n        } catch (err) {\n          error('Error while using world', err);\n          return false;\n        }\n      }),\n\n    create: protectedProcedure(ScopeName.WorldCreate)\n      .input(\n        z.object({\n          name: z.string(),\n          level: z.enum(['Plate', 'Space', 'Studio', 'Peaks']).optional(),\n        }),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { omegga } = getContextDeps();\n        const { log, error } = ctx;\n        try {\n          log(\n            'Creating new world',\n            input.name.yellow,\n            'with level',\n            input.level?.yellow || 'Plate',\n          );\n          const res = await omegga.createEmptyWorld(input.name, input.level);\n          if (res) log('World created successfully');\n          else log('World creation failed');\n          return res;\n        } catch (err) {\n          error('Error while creating world', err);\n          return false;\n        }\n      }),\n\n    save: protectedProcedure(ScopeName.WorldSave)\n      .input(\n        z\n          .object({\n            name: z.string().optional(),\n          })\n          .optional()\n          .default({}),\n      )\n      .mutation(async ({ input, ctx }) => {\n        const { omegga } = getContextDeps();\n        const { log, error } = ctx;\n        try {\n          let res = false;\n          if (input.name) {\n            log('Saving world as', input.name.yellow);\n            res = await omegga.saveWorldAs(input.name);\n          } else {\n            log('Saving current world');\n            res = await omegga.saveWorld();\n          }\n          if (res) log('World saved successfully');\n          else log('World save failed');\n          return res;\n        } catch (err) {\n          error('Error while saving world', err);\n          return false;\n        }\n      }),\n  }),\n});\n"],"names":["router","protectedProcedure","ScopeName","getContextDeps","z","readBrdbMeta"],"mappings":";;;;;;AAKO,MAAM,cAAcA,KAAAA,OAAO;AAAA,EAChC,OAAOA,KAAAA,OAAO;AAAA,IACZ,MAAMC,KAAAA,mBAAmBC,OAAAA,UAAU,SAAS,EAAE,MAAM,MAAM;AACxD,YAAM,EAAE,OAAA,IAAWC,oBAAA;AACnB,YAAM,SAAS,OAAO,YAAY;AAClC,aAAO,OACJ,UAAA,EACA,IAAI,CAAA,UAAS,MAAM,QAAQ,QAAQ,EAAE,EAAE,QAAQ,WAAW,EAAE,CAAC;AAAA,IAClE,CAAC;AAAA,IAED,WAAWF,KAAAA,mBAAmBC,iBAAU,cAAc,EACnD,MAAME,GAAAA,EAAE,OAAO,EAAE,OAAOA,GAAAA,EAAE,OAAA,GAAU,CAAC,EACrC,MAAM,OAAO,EAAE,YAAY;AAC1B,YAAM,EAAE,OAAA,IAAWD,oBAAA;AACnB,UAAI;AACF,gBACG,MAAM,OAAO,kBAAkB,MAAM,KAAK,IAAI;AAAA,UAC7C,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,GAAG,MAAM,KAAK,UAAQ;AAAA,QAAE,KAC/C;AAAA,MAET,SAAS,MAAM;AACb,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IAEH,MAAMF,KAAAA,mBAAmBC,iBAAU,SAAS,EACzC,MAAME,GAAAA,EAAE,OAAO,EAAE,OAAOA,GAAAA,EAAE,OAAA,EAAO,CAAG,CAAC,EACrC,MAAM,OAAO,EAAE,OAAO,UAAU;AAC/B,YAAM,EAAE,OAAA,IAAWD,oBAAA;AACnB,UAAI;AACF,cAAM,OAAO,OAAO,aAAa,MAAM,KAAK;AAC5C,YAAI,CAAC,KAAM,QAAO;AAClB,eAAOE,KAAAA,aAAa,IAAI;AAAA,MAC1B,SAAS,KAAK;AACZ,YAAI,MAAM,kCAAkC,GAAG;AAC/C,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IAEH,MAAMJ,KAAAA,mBAAmBC,OAAAA,UAAU,SAAS,EAAE,MAAM,MAAM;AACxD,YAAM,EAAE,OAAA,IAAWC,oBAAA;AACnB,aAAO,OAAO,aAAA;AAAA,IAChB,CAAC;AAAA,IAED,QAAQF,KAAAA,mBAAmBC,OAAAA,UAAU,WAAW,EAAE,MAAM,MAAM;AAC5D,YAAM,EAAE,OAAA,IAAWC,oBAAA;AACnB,aAAO,OAAO,eAAA;AAAA,IAChB,CAAC;AAAA,IAED,MAAMF,KAAAA,mBAAmBC,iBAAU,SAAS,EACzC;AAAA,MACCE,GAAAA,EAAE,OAAO;AAAA,QACP,OAAOA,GAAAA,EAAE,OAAA;AAAA,QACT,UAAUA,GAAAA,EAAE,OAAA,EAAS,SAAA;AAAA,MAAS,CAC/B;AAAA,IAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,OAAA,IAAWD,oBAAA;AACnB,YAAM,EAAE,KAAK,MAAA,IAAU;AACvB,UAAI;AACF,YAAI,MAAM;AACV,YAAI,MAAM,UAAU;AAClB;AAAA,YACE;AAAA,YACA,MAAM;AAAA,YACN;AAAA,YACA,MAAM,MAAM;AAAA,UAAA;AAEd,gBAAM,MAAM,OAAO,kBAAkB,MAAM,OAAO,MAAM,QAAQ;AAAA,QAClE,OAAO;AACL,cAAI,iBAAiB,MAAM,MAAM,MAAM;AACvC,gBAAM,MAAM,OAAO,UAAU,MAAM,KAAK;AAAA,QAC1C;AACA,YAAI,SAAS,2BAA2B;AAAA,iBAC/B,mBAAmB;AAC5B,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,cAAM,6BAA6B,GAAG;AACtC,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IAEH,KAAKF,KAAAA,mBAAmBC,iBAAU,QAAQ,EACvC;AAAA,MACCE,GAAAA,EAAE,OAAO;AAAA,QACP,OAAOA,GAAAA,EAAE,OAAA,EAAS,SAAA;AAAA,MAAS,CAC5B;AAAA,IAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,OAAA,IAAWD,oBAAA;AACnB,YAAM,EAAE,KAAK,MAAA,IAAU;AACvB,UAAI;AACF,cAAM,KAAK,OAAO,eAAe,MAAM,SAAS,IAAI;AACpD,YAAI,GAAI,KAAI,yBAAyB,MAAM,SAAS,QAAQ,MAAM;AAClE,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,cAAM,2BAA2B,GAAG;AACpC,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IAEH,QAAQF,KAAAA,mBAAmBC,iBAAU,WAAW,EAC7C;AAAA,MACCE,GAAAA,EAAE,OAAO;AAAA,QACP,MAAMA,GAAAA,EAAE,OAAA;AAAA,QACR,OAAOA,GAAAA,EAAE,KAAK,CAAC,SAAS,SAAS,UAAU,OAAO,CAAC,EAAE,SAAA;AAAA,MAAS,CAC/D;AAAA,IAAA,EAEF,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,OAAA,IAAWD,oBAAA;AACnB,YAAM,EAAE,KAAK,MAAA,IAAU;AACvB,UAAI;AACF;AAAA,UACE;AAAA,UACA,MAAM,KAAK;AAAA,UACX;AAAA,UACA,MAAM,OAAO,UAAU;AAAA,QAAA;AAEzB,cAAM,MAAM,MAAM,OAAO,iBAAiB,MAAM,MAAM,MAAM,KAAK;AACjE,YAAI,SAAS,4BAA4B;AAAA,iBAChC,uBAAuB;AAChC,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,cAAM,8BAA8B,GAAG;AACvC,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IAEH,MAAMF,KAAAA,mBAAmBC,iBAAU,SAAS,EACzC;AAAA,MACCE,GAAAA,EACG,OAAO;AAAA,QACN,MAAMA,GAAAA,EAAE,OAAA,EAAS,SAAA;AAAA,MAAS,CAC3B,EACA,WACA,QAAQ,CAAA,CAAE;AAAA,IAAA,EAEd,SAAS,OAAO,EAAE,OAAO,UAAU;AAClC,YAAM,EAAE,OAAA,IAAWD,oBAAA;AACnB,YAAM,EAAE,KAAK,MAAA,IAAU;AACvB,UAAI;AACF,YAAI,MAAM;AACV,YAAI,MAAM,MAAM;AACd,cAAI,mBAAmB,MAAM,KAAK,MAAM;AACxC,gBAAM,MAAM,OAAO,YAAY,MAAM,IAAI;AAAA,QAC3C,OAAO;AACL,cAAI,sBAAsB;AAC1B,gBAAM,MAAM,OAAO,UAAA;AAAA,QACrB;AACA,YAAI,SAAS,0BAA0B;AAAA,iBAC9B,mBAAmB;AAC5B,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,cAAM,4BAA4B,GAAG;AACrC,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EAAA,CACJ;AACH,CAAC;;"}