tanstack_start_ts 1.0.0

package/src/lib/admin.functions.ts

@@ -0,0 +1,564 @@
+import { createServerFn } from "@tanstack/react-start";
+import { requireSupabaseAuth } from "@/integrations/supabase/auth-middleware";
+import { supabaseAdmin } from "@/integrations/supabase/client.server";
+import { z } from "zod";
+
+const MASTER_ADMIN_ID = "doraexplora";
+const FETCH_TIMEOUT_MS = 12_000;
+
+type RoleRow = {
+  admin_id: string | null;
+};
+
+type UserRow = {
+  id: string;
+  email: string | null;
+};
+
+type ProductImportPreview = {
+  title: string;
+  description: string | null;
+  image_url: string;
+  price: number;
+  original_price: number | null;
+  currency: string;
+  merchant: string | null;
+  product_url: string;
+  source_url: string | null;
+  tracking_url: string | null;
+  imported_from: string | null;
+  tags: string[];
+  badges: string[];
+  shipping_info: string | null;
+  delivery_estimate: string | null;
+  import_notes: string | null;
+};
+
+async function getAdminRole(supabase: any, userId: string) {
+  const { data } = await supabase
+    .from("user_roles")
+    .select("admin_id")
+    .eq("user_id", userId)
+    .eq("role", "admin")
+    .maybeSingle();
+  return data as RoleRow | null;
+}
+
+async function requireAdmin(supabase: any, userId: string) {
+  const role = await getAdminRole(supabase, userId);
+  if (!role) throw new Error("Forbidden");
+  return role.admin_id;
+}
+
+async function findAuthUserByEmail(email: string) {
+  const normalizedEmail = email.trim().toLowerCase();
+  const { data, error } = await supabaseAdmin.auth.admin.listUsers({ perPage: 1000 });
+  if (error) throw new Error(error.message);
+  const user = data.users.find((candidate) => candidate.email?.toLowerCase() === normalizedEmail);
+  return (user ?? null) as UserRow | null;
+}
+
+function normalizeUrl(value: string) {
+  const trimmed = value.trim();
+  if (!trimmed) return trimmed;
+  if (trimmed.startsWith("//")) return `https:${trimmed}`;
+  return trimmed;
+}
+
+function getHostnameLabel(input: string) {
+  try {
+    return new URL(input).hostname.replace(/^www\./, "");
+  } catch {
+    return null;
+  }
+}
+
+function safeText(value: string | undefined | null) {
+  const text = value?.replace(/\s+/g, " ").trim();
+  return text ? text : null;
+}
+
+function firstMatch(html: string, patterns: RegExp[]) {
+  for (const pattern of patterns) {
+    const match = html.match(pattern);
+    if (match?.[1]) return safeText(match[1]);
+  }
+  return null;
+}
+
+function extractMetaContent(html: string, key: string) {
+  const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return firstMatch(html, [
+    new RegExp(`<meta[^>]+property=["']${escaped}["'][^>]+content=["']([^"']+)["'][^>]*>`, "i"),
+    new RegExp(`<meta[^>]+name=["']${escaped}["'][^>]+content=["']([^"']+)["'][^>]*>`, "i"),
+    new RegExp(`<meta[^>]+content=["']([^"']+)["'][^>]+property=["']${escaped}["'][^>]*>`, "i"),
+    new RegExp(`<meta[^>]+content=["']([^"']+)["'][^>]+name=["']${escaped}["'][^>]*>`, "i"),
+  ]);
+}
+
+function extractJsonLdObjects(html: string) {
+  const matches = [
+    ...html.matchAll(/<script[^>]+type=["']application\/ld\+json["'][^>]*>([\s\S]*?)<\/script>/gi),
+  ];
+  const parsed: unknown[] = [];
+
+  for (const match of matches) {
+    const raw = safeText(match[1]);
+    if (!raw) continue;
+    try {
+      const json = JSON.parse(raw);
+      if (Array.isArray(json)) parsed.push(...json);
+      else parsed.push(json);
+    } catch {
+      continue;
+    }
+  }
+
+  return parsed;
+}
+
+function pickJsonLdProduct(html: string) {
+  const objects = extractJsonLdObjects(html);
+  for (const object of objects) {
+    if (!object || typeof object !== "object") continue;
+    const candidate = object as Record<string, unknown>;
+    const type = candidate["@type"];
+    if (type === "Product") return candidate;
+    if (Array.isArray(type) && type.includes("Product")) return candidate;
+  }
+  return null;
+}
+
+function toNumber(value: unknown) {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string") {
+    const parsed = Number(value.replace(/[^\d.-]/g, ""));
+    return Number.isFinite(parsed) ? parsed : null;
+  }
+  return null;
+}
+
+function extractProductPreview(url: string, html: string): ProductImportPreview {
+  const hostname = getHostnameLabel(url);
+  const jsonLd = pickJsonLdProduct(html);
+
+  const title =
+    safeText((jsonLd?.name as string | undefined) ?? undefined) ||
+    extractMetaContent(html, "og:title") ||
+    extractMetaContent(html, "twitter:title") ||
+    firstMatch(html, [/<title[^>]*>([\s\S]*?)<\/title>/i]) ||
+    hostname ||
+    "Imported product";
+
+  const description =
+    safeText((jsonLd?.description as string | undefined) ?? undefined) ||
+    extractMetaContent(html, "og:description") ||
+    extractMetaContent(html, "twitter:description") ||
+    extractMetaContent(html, "description");
+
+  const imageFromJsonLd = jsonLd?.image;
+  const image_url =
+    (Array.isArray(imageFromJsonLd)
+      ? safeText(imageFromJsonLd[0] as string | undefined)
+      : safeText(imageFromJsonLd as string | undefined)) ||
+    extractMetaContent(html, "og:image") ||
+    extractMetaContent(html, "twitter:image") ||
+    extractMetaContent(html, "twitter:image:src") ||
+    "https://images.unsplash.com/photo-1558862107-d49ef2a04d72?auto=format&fit=crop&w=1200&q=80";
+
+  const offers = jsonLd?.offers;
+  const offer = Array.isArray(offers) ? offers[0] : offers;
+  const price =
+    toNumber((offer as Record<string, unknown> | undefined)?.price) ??
+    toNumber(extractMetaContent(html, "product:price:amount")) ??
+    toNumber(extractMetaContent(html, "price")) ??
+    0;
+
+  const originalPrice =
+    toNumber(extractMetaContent(html, "product:original_price")) ??
+    toNumber(extractMetaContent(html, "og:price:amount")) ??
+    null;
+
+  const currency =
+    safeText((offer as Record<string, unknown> | undefined)?.priceCurrency as string | undefined) ||
+    extractMetaContent(html, "product:price:currency") ||
+    "USD";
+
+  const merchant =
+    safeText((jsonLd?.brand as Record<string, unknown> | undefined)?.name as string | undefined) ||
+    safeText((jsonLd?.seller as Record<string, unknown> | undefined)?.name as string | undefined) ||
+    hostname;
+
+  const aggregateRating = jsonLd?.aggregateRating as Record<string, unknown> | undefined;
+  const ratingValue = toNumber(aggregateRating?.ratingValue);
+  const ratingCount =
+    toNumber(aggregateRating?.ratingCount) ?? toNumber(aggregateRating?.reviewCount);
+
+  const badges = [
+    ratingValue ? `${ratingValue.toFixed(1)}★` : null,
+    ratingCount ? `${Math.round(ratingCount)} reviews` : null,
+  ].filter(Boolean) as string[];
+
+  const imported_from = hostname;
+  const notes = `Imported from ${hostname ?? "shared link"}`;
+
+  return {
+    title,
+    description,
+    image_url,
+    price,
+    original_price: originalPrice,
+    currency,
+    merchant,
+    product_url: url,
+    source_url: url,
+    tracking_url: url,
+    imported_from,
+    tags: hostname ? [hostname.split(".")[0]] : [],
+    badges,
+    shipping_info: null,
+    delivery_estimate: null,
+    import_notes: notes,
+  };
+}
+
+async function fetchImportHtml(url: string) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+
+  try {
+    const response = await fetch(url, {
+      headers: {
+        "user-agent":
+          "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0 Safari/537.36",
+        accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      },
+      signal: controller.signal,
+    });
+
+    if (!response.ok) {
+      throw new Error(`Import failed with status ${response.status}`);
+    }
+
+    const contentType = response.headers.get("content-type") ?? "";
+    if (!contentType.includes("text/html") && !contentType.includes("application/xhtml+xml")) {
+      throw new Error("The provided link does not look like a product page");
+    }
+
+    return await response.text();
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+export const isAdmin = createServerFn({ method: "GET" })
+  .middleware([requireSupabaseAuth])
+  .handler(async ({ context }) => {
+    const { supabase, userId } = context;
+    const role = await getAdminRole(supabase, userId);
+    return {
+      admin: !!role,
+      admin_id: role?.admin_id ?? null,
+      is_master: role?.admin_id === MASTER_ADMIN_ID,
+    };
+  });
+
+export const getAdminBootstrapStatus = createServerFn({ method: "GET" }).handler(async () => {
+  const { count, error } = await supabaseAdmin
+    .from("user_roles")
+    .select("*", { count: "exact", head: true })
+    .eq("role", "admin");
+
+  if (error) throw new Error(error.message);
+
+  return {
+    needs_bootstrap: (count ?? 0) === 0,
+  };
+});
+
+export const bootstrapMasterAdmin = createServerFn({ method: "POST" })
+  .inputValidator((d) =>
+    z
+      .object({
+        email: z.string().email().max(255),
+        password: z.string().min(8).max(128),
+      })
+      .parse(d),
+  )
+  .handler(async ({ data }) => {
+    const { count, error: countError } = await supabaseAdmin
+      .from("user_roles")
+      .select("*", { count: "exact", head: true })
+      .eq("role", "admin");
+
+    if (countError) throw new Error(countError.message);
+    if ((count ?? 0) > 0) {
+      throw new Error("Master Admin is already set up.");
+    }
+
+    const existingUser = await findAuthUserByEmail(data.email);
+
+    let userId = existingUser?.id;
+    let createdUser = false;
+
+    if (!userId) {
+      const { data: created, error: createError } = await supabaseAdmin.auth.admin.createUser({
+        email: data.email,
+        password: data.password,
+        email_confirm: true,
+      });
+
+      if (createError || !created.user) {
+        throw new Error(createError?.message ?? "Failed to create master admin account");
+      }
+
+      userId = created.user.id;
+      createdUser = true;
+    }
+
+    const { error: roleError } = await supabaseAdmin.from("user_roles").insert({
+      user_id: userId,
+      role: "admin",
+      admin_id: MASTER_ADMIN_ID,
+    });
+
+    if (roleError) {
+      if (createdUser) {
+        await supabaseAdmin.auth.admin.deleteUser(userId);
+      }
+      throw new Error(roleError.message);
+    }
+
+    return {
+      ok: true,
+      user_id: userId,
+      admin_id: MASTER_ADMIN_ID,
+      created_user: createdUser,
+    };
+  });
+
+export const importProductFromLink = createServerFn({ method: "POST" })
+  .middleware([requireSupabaseAuth])
+  .inputValidator((d) =>
+    z
+      .object({
+        url: z.string().url().max(2000),
+      })
+      .parse(d),
+  )
+  .handler(async ({ data, context }) => {
+    await requireAdmin(context.supabase, context.userId);
+    const url = normalizeUrl(data.url);
+    const html = await fetchImportHtml(url);
+    return extractProductPreview(url, html);
+  });
+
+export const upsertProduct = createServerFn({ method: "POST" })
+  .middleware([requireSupabaseAuth])
+  .inputValidator((d) => productSchema.parse(d))
+  .handler(async ({ data, context }) => {
+    await requireAdmin(context.supabase, context.userId);
+
+    const product_url = normalizeUrl(
+      data.product_url ?? data.source_url ?? data.tracking_url ?? data.affiliate_url ?? "",
+    );
+    const source_url = normalizeUrl(
+      data.source_url ?? data.product_url ?? data.affiliate_url ?? product_url,
+    );
+    const tracking_url = normalizeUrl(data.tracking_url ?? data.affiliate_url ?? product_url);
+    const affiliate_url = normalizeUrl(data.affiliate_url ?? tracking_url ?? product_url);
+
+    const payload = {
+      ...data,
+      product_url,
+      source_url,
+      tracking_url,
+      affiliate_url,
+      imported_from: data.imported_from ?? getHostnameLabel(source_url ?? product_url),
+      import_notes: data.import_notes ?? null,
+    };
+
+    if (payload.id) {
+      const { error } = await context.supabase
+        .from("products")
+        .update(payload)
+        .eq("id", payload.id);
+      if (error) throw new Error(error.message);
+      return { id: payload.id };
+    }
+
+    const { data: ins, error } = await context.supabase
+      .from("products")
+      .insert(payload)
+      .select("id")
+      .single();
+    if (error) throw new Error(error.message);
+    return { id: ins.id };
+  });
+
+export const deleteProduct = createServerFn({ method: "POST" })
+  .middleware([requireSupabaseAuth])
+  .inputValidator((d: { id: string }) => z.object({ id: z.string().uuid() }).parse(d))
+  .handler(async ({ data, context }) => {
+    await requireAdmin(context.supabase, context.userId);
+    const { error } = await context.supabase.from("products").delete().eq("id", data.id);
+    if (error) throw new Error(error.message);
+    return { ok: true };
+  });
+
+export const listAllProducts = createServerFn({ method: "GET" })
+  .middleware([requireSupabaseAuth])
+  .handler(async ({ context }) => {
+    await requireAdmin(context.supabase, context.userId);
+    const { data } = await context.supabase
+      .from("products")
+      .select("*")
+      .order("created_at", { ascending: false });
+    return data ?? [];
+  });
+
+const productSchema = z
+  .object({
+    id: z.string().uuid().optional(),
+    title: z.string().min(1).max(200),
+    description: z.string().max(2000).optional().nullable(),
+    image_url: z.string().url().max(2000),
+    price: z.number().min(0).max(100000),
+    original_price: z.number().min(0).max(100000).optional().nullable(),
+    currency: z.string().min(1).max(12).default("USD"),
+    affiliate_url: z.string().url().max(2000).optional().nullable(),
+    product_url: z.string().url().max(2000).optional().nullable(),
+    tracking_url: z.string().url().max(2000).optional().nullable(),
+    source_url: z.string().url().max(2000).optional().nullable(),
+    imported_from: z.string().max(120).optional().nullable(),
+    import_notes: z.string().max(500).optional().nullable(),
+    merchant: z.string().max(100).optional().nullable(),
+    category_id: z.string().uuid().optional().nullable(),
+    tags: z.array(z.string().max(40)).max(20).default([]),
+    badges: z.array(z.string().max(40)).max(10).default([]),
+    is_trending: z.boolean().default(false),
+    is_hot: z.boolean().default(false),
+    is_featured: z.boolean().default(false),
+    shipping_info: z.string().max(120).optional().nullable(),
+    delivery_estimate: z.string().max(60).optional().nullable(),
+  })
+  .superRefine((value, ctx) => {
+    if (!value.product_url && !value.source_url && !value.tracking_url && !value.affiliate_url) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["product_url"],
+        message: "Provide a product URL, source URL, tracking URL, or affiliate URL",
+      });
+    }
+  });
+
+/**
+ * Master admin bootstrap for legacy installs.
+ * Used only while no admin exists yet.
+ */
+export const grantSelfAdmin = createServerFn({ method: "POST" })
+  .middleware([requireSupabaseAuth])
+  .handler(async ({ context }) => {
+    const { supabase, userId } = context;
+    const { count, error } = await supabase
+      .from("user_roles")
+      .select("*", { count: "exact", head: true })
+      .eq("role", "admin");
+    if (error) throw new Error(error.message);
+    if ((count ?? 0) > 0)
+      throw new Error("Admin already exists. Ask the Master Admin to grant you access.");
+    const { error: insertError } = await supabaseAdmin
+      .from("user_roles")
+      .insert({ user_id: userId, role: "admin", admin_id: MASTER_ADMIN_ID });
+    if (insertError) throw new Error(insertError.message);
+    return { ok: true, admin_id: MASTER_ADMIN_ID };
+  });
+
+/**
+ * Master admin creates a new admin account: provisions the auth user with email+password,
+ * assigns the chosen admin_id. Only callable by the Master Admin (doraexplora).
+ */
+export const createAdmin = createServerFn({ method: "POST" })
+  .middleware([requireSupabaseAuth])
+  .inputValidator((d) =>
+    z
+      .object({
+        email: z.string().email().max(255),
+        password: z.string().min(8).max(128),
+        admin_id: z
+          .string()
+          .min(3)
+          .max(40)
+          .regex(/^[a-zA-Z0-9_-]+$/, "Admin ID may only contain letters, numbers, _ and -"),
+      })
+      .parse(d),
+  )
+  .handler(async ({ data, context }) => {
+    const callerAdminId = await requireAdmin(context.supabase, context.userId);
+    if (callerAdminId !== MASTER_ADMIN_ID)
+      throw new Error("Only the Master Admin can create new admins");
+    if (data.admin_id === MASTER_ADMIN_ID) throw new Error("That admin ID is reserved");
+
+    const { data: existing } = await supabaseAdmin
+      .from("user_roles")
+      .select("id")
+      .eq("admin_id", data.admin_id)
+      .maybeSingle();
+    if (existing) throw new Error("Admin ID is already taken");
+
+    const { data: created, error: createErr } = await supabaseAdmin.auth.admin.createUser({
+      email: data.email,
+      password: data.password,
+      email_confirm: true,
+    });
+    if (createErr || !created.user) throw new Error(createErr?.message ?? "Failed to create user");
+
+    const newUserId = created.user.id;
+
+    const { error: roleErr } = await supabaseAdmin
+      .from("user_roles")
+      .insert({ user_id: newUserId, role: "admin", admin_id: data.admin_id });
+    if (roleErr) {
+      await supabaseAdmin.auth.admin.deleteUser(newUserId);
+      throw new Error(roleErr.message);
+    }
+
+    return { ok: true, user_id: newUserId, admin_id: data.admin_id };
+  });
+
+export const listAdmins = createServerFn({ method: "GET" })
+  .middleware([requireSupabaseAuth])
+  .handler(async ({ context }) => {
+    await requireAdmin(context.supabase, context.userId);
+    const { data: roles } = await supabaseAdmin
+      .from("user_roles")
+      .select("user_id, admin_id, created_at")
+      .eq("role", "admin")
+      .order("created_at", { ascending: true });
+    if (!roles?.length) return [];
+    const { data: users } = await supabaseAdmin.auth.admin.listUsers({ perPage: 1000 });
+    const emailById = new Map(users.users.map((u) => [u.id, u.email]));
+    return roles.map((r) => ({
+      user_id: r.user_id,
+      admin_id: r.admin_id,
+      email: emailById.get(r.user_id) ?? null,
+      is_master: r.admin_id === MASTER_ADMIN_ID,
+      created_at: r.created_at,
+    }));
+  });
+
+/**
+ * Admin login verification: signed-in user submits the admin_id they were assigned.
+ * Returns ok if the user is an admin AND the admin_id matches their record.
+ */
+export const verifyAdminId = createServerFn({ method: "POST" })
+  .middleware([requireSupabaseAuth])
+  .inputValidator((d) => z.object({ admin_id: z.string().min(1).max(40) }).parse(d))
+  .handler(async ({ data, context }) => {
+    const { supabase, userId } = context;
+    const row = await getAdminRole(supabase, userId);
+    if (!row || row.admin_id !== data.admin_id) {
+      throw new Error("Invalid admin credentials");
+    }
+    return { ok: true, is_master: row.admin_id === MASTER_ADMIN_ID };
+  });

package/src/lib/error-capture.ts

@@ -0,0 +1,27 @@
+// Captures the original Error out-of-band so server.ts can recover the stack
+// when h3 has already swallowed the throw into a generic 500 Response.
+
+let lastCapturedError: { error: unknown; at: number } | undefined;
+const TTL_MS = 5_000;
+
+function record(error: unknown) {
+  lastCapturedError = { error, at: Date.now() };
+}
+
+if (typeof globalThis.addEventListener === "function") {
+  globalThis.addEventListener("error", (event) => record((event as ErrorEvent).error ?? event));
+  globalThis.addEventListener("unhandledrejection", (event) =>
+    record((event as PromiseRejectionEvent).reason),
+  );
+}
+
+export function consumeLastCapturedError(): unknown {
+  if (!lastCapturedError) return undefined;
+  if (Date.now() - lastCapturedError.at > TTL_MS) {
+    lastCapturedError = undefined;
+    return undefined;
+  }
+  const { error } = lastCapturedError;
+  lastCapturedError = undefined;
+  return error;
+}

package/src/lib/error-page.ts

@@ -0,0 +1,30 @@
+export function renderErrorPage(): string {
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>This page didn't load</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <style>
+      body { font: 15px/1.5 system-ui, -apple-system, sans-serif; background: #fafafa; color: #111; display: grid; place-items: center; min-height: 100vh; margin: 0; padding: 1.5rem; }
+      .card { max-width: 28rem; width: 100%; text-align: center; padding: 2rem; }
+      h1 { font-size: 1.25rem; margin: 0 0 0.5rem; }
+      p { color: #4b5563; margin: 0 0 1.5rem; }
+      .actions { display: flex; gap: 0.5rem; justify-content: center; flex-wrap: wrap; }
+      a, button { padding: 0.5rem 1rem; border-radius: 0.375rem; font: inherit; cursor: pointer; text-decoration: none; border: 1px solid transparent; }
+      .primary { background: #111; color: #fff; }
+      .secondary { background: #fff; color: #111; border-color: #d1d5db; }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <h1>This page didn't load</h1>
+      <p>Something went wrong on our end. You can try refreshing or head back home.</p>
+      <div class="actions">
+        <button class="primary" onclick="location.reload()">Try again</button>
+        <a class="secondary" href="/">Go home</a>
+      </div>
+    </div>
+  </body>
+</html>`;
+}

package/src/lib/product-links.ts

@@ -0,0 +1,39 @@
+type ProductLinkLike = {
+  product_url?: string | null;
+  tracking_url?: string | null;
+  affiliate_url?: string | null;
+  source_url?: string | null;
+  imported_from?: string | null;
+  merchant?: string | null;
+};
+
+function normalizeUrl(value?: string | null) {
+  const trimmed = value?.trim();
+  if (!trimmed) return null;
+  if (trimmed.startsWith("//")) return `https:${trimmed}`;
+  return trimmed;
+}
+
+export function resolveBuyUrl(product: ProductLinkLike) {
+  return (
+    normalizeUrl(product.tracking_url) ??
+    normalizeUrl(product.affiliate_url) ??
+    normalizeUrl(product.product_url) ??
+    normalizeUrl(product.source_url) ??
+    null
+  );
+}
+
+export function resolveSourceUrl(product: ProductLinkLike) {
+  return (
+    normalizeUrl(product.product_url) ??
+    normalizeUrl(product.source_url) ??
+    normalizeUrl(product.tracking_url) ??
+    normalizeUrl(product.affiliate_url) ??
+    null
+  );
+}
+
+export function resolveProductLabel(product: ProductLinkLike) {
+  return product.merchant ?? product.imported_from ?? "shopping store";
+}