Phase 3, part 1 (`docs/design.md`, "Next"): cases and notifications. File blocks, API tokens and two-factor sign-in come as separate PRs.
**Cases**
- One queue (Console → Cases) for everything someone has to decide. Each case has:
- a thread of notes, where internal notes are visible only to those deciding
- an assignee (moderators assign cases to moderators)
- a decision, Resolve or Decline, with a written resolution that the person who opened it sees
- **Reports:** anyone signed in can report a product or catalog from its page (the API also takes rooms and people).
- Limits: 10 an hour, one open report per person and thing, and you can't report yourself.
- Reports about a product go to the teams of the catalogs hosting it, as well as to moderators.
- Only the reporter and moderators know who reported. The audit entry for a report isn't tagged with what it's about, so a product's creator can't find out from their audit log either.
- **Rating reviews:** a creator lowering a rating from adult to general now opens a review instead of being refused. The rest of the edit still saves. Resolving the review lowers the rating, recorded in the product's history.
- **Removal requests:** a catalog's team can ask moderators to remove a product it hosts, everywhere. Resolving it removes the product.
- **Deletion requests:** a catalog's owner asks for deletion from the catalog's console page, and a moderator decides, as agreed. Resolving it marks the catalog `deleted`: its key stops working, nothing is available from it, and its changes feed says so.
- **Appeals:**
- From the audit log, the person an action affected can appeal it, once: their product removed, delisted or edited by someone else; their catalog suspended or rejected; a ban from a catalog or a declined request to join.
- Another moderator decides. An admin may decide an appeal of their own action, and the audit log flags it.
- Resolving records the decision; the moderator then undoes the action where it's done. For that, there's now a Restore for removed products (Console → Products, for moderators); the design mentioned one, but it was never built.
- The console shows a "Cases" tab, and a to-do with the number of open cases the person could decide.
**Notifications**
- A bell in the header with the unread count, and a notifications page with "Mark all as read".
- Each is also sent to the person's proxies over the realtime connection (`{"type": "notification"}`), so the client can show them later.
- They cover:
- a moderator edited or locked your product, or undid a change (with the reason)
- your product was removed or restored
- your case was decided
- someone replied on your case
- a catalog decided your membership
**Also changed**
- A product's creator and moderators can now see it when it's adult, even without an adult account. Before, a creator who made their own product adult couldn't open its page any more, and neither could moderators. Getting and wearing adult products still need an adult account.
**Not done yet** (in `docs/console.md`): email notifications (the hub sends no email yet), canned reasons, private moderator notes on people and products, and second approval for the most destructive actions.
**Migration** `0012_cases`: the `moderation_case`, `case_note` and `notification` tables. (`case` is a reserved word in SQL, hence the table's name.)
**Checks**
- 51 API tests pass. The 7 in the new `cases.test.ts` cover:
- who sees and decides each kind of case, and that the reporter stays private
- rate limits and duplicate reports
- the thread and internal notes, and assigning
- what deciding each kind of case does
- appeals by the person affected only, decided by another moderator
- restoring a removed product
- the notifications
- Type checks pass.
- On a local hub I went through every flow with the website's own forms: report from a product page; the catalog owner's note and decision; assigning, an internal note and a decision as admin; removal by a moderator, the creator's appeal from the audit log, the admin's decision and Restore; a creator's rating review and the decision lowering the rating; a deletion request and its decline; the notifications, the bell's count, and Mark all as read.
- Fixed along the way:
- The catalog's team could see who reported.
- A missing Resolve/Decline choice was treated as Decline; now it's refused.
- The Unassign button sent the typed name instead of nothing.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Phase 3, part 1 (`docs/design.md`, "Next"): cases and notifications. File blocks, API tokens and two-factor sign-in come as separate PRs.
**Cases**
- One queue (Console → Cases) for everything someone has to decide. Each case has:
- a thread of notes, where internal notes are visible only to those deciding
- an assignee (moderators assign cases to moderators)
- a decision, Resolve or Decline, with a written resolution that the person who opened it sees
- **Reports:** anyone signed in can report a product or catalog from its page (the API also takes rooms and people).
- Limits: 10 an hour, one open report per person and thing, and you can't report yourself.
- Reports about a product go to the teams of the catalogs hosting it, as well as to moderators.
- Only the reporter and moderators know who reported. The audit entry for a report isn't tagged with what it's about, so a product's creator can't find out from their audit log either.
- **Rating reviews:** a creator lowering a rating from adult to general now opens a review instead of being refused. The rest of the edit still saves. Resolving the review lowers the rating, recorded in the product's history.
- **Removal requests:** a catalog's team can ask moderators to remove a product it hosts, everywhere. Resolving it removes the product.
- **Deletion requests:** a catalog's owner asks for deletion from the catalog's console page, and a moderator decides, as agreed. Resolving it marks the catalog `deleted`: its key stops working, nothing is available from it, and its changes feed says so.
- **Appeals:**
- From the audit log, the person an action affected can appeal it, once: their product removed, delisted or edited by someone else; their catalog suspended or rejected; a ban from a catalog or a declined request to join.
- Another moderator decides. An admin may decide an appeal of their own action, and the audit log flags it.
- Resolving records the decision; the moderator then undoes the action where it's done. For that, there's now a Restore for removed products (Console → Products, for moderators); the design mentioned one, but it was never built.
- The console shows a "Cases" tab, and a to-do with the number of open cases the person could decide.
**Notifications**
- A bell in the header with the unread count, and a notifications page with "Mark all as read".
- Each is also sent to the person's proxies over the realtime connection (`{"type": "notification"}`), so the client can show them later.
- They cover:
- a moderator edited or locked your product, or undid a change (with the reason)
- your product was removed or restored
- your case was decided
- someone replied on your case
- a catalog decided your membership
**Also changed**
- A product's creator and moderators can now see it when it's adult, even without an adult account. Before, a creator who made their own product adult couldn't open its page any more, and neither could moderators. Getting and wearing adult products still need an adult account.
**Not done yet** (in `docs/console.md`): email notifications (the hub sends no email yet), canned reasons, private moderator notes on people and products, and second approval for the most destructive actions.
**Migration** `0012_cases`: the `moderation_case`, `case_note` and `notification` tables. (`case` is a reserved word in SQL, hence the table's name.)
**Checks**
- 51 API tests pass. The 7 in the new `cases.test.ts` cover:
- who sees and decides each kind of case, and that the reporter stays private
- rate limits and duplicate reports
- the thread and internal notes, and assigning
- what deciding each kind of case does
- appeals by the person affected only, decided by another moderator
- restoring a removed product
- the notifications
- Type checks pass.
- On a local hub I went through every flow with the website's own forms: report from a product page; the catalog owner's note and decision; assigning, an internal note and a decision as admin; removal by a moderator, the creator's appeal from the audit log, the admin's decision and Restore; a creator's rating review and the decision lowering the rating; a deletion request and its decline; the notifications, the bell's count, and Mark all as read.
- Fixed along the way:
- The catalog's team could see who reported.
- A missing Resolve/Decline choice was treated as Decline; now it's refused.
- The Unassign button sent the typed name instead of nothing.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: dhkatz <[email protected]>
96 lines
4.3 KiB
TypeScript
96 lines
4.3 KiB
TypeScript
// The hub's API, called from server components and server actions. Calls go to the API's internal address
|
|
// (API_URL) with the visitor's cookie, so the API sees the same session the browser has.
|
|
import "server-only";
|
|
import { treaty } from "@elysiajs/eden";
|
|
import type { App } from "@t5de/api";
|
|
import { headers } from "next/headers";
|
|
import { cache } from "react";
|
|
|
|
const apiURL = process.env.API_URL ?? "http://localhost:4101";
|
|
|
|
/** The visitor's cookie and address, to pass on to the API. */
|
|
async function forwarded(): Promise<Record<string, string>> {
|
|
const incoming = await headers();
|
|
const forward: Record<string, string> = {};
|
|
for (const name of ["cookie", "x-forwarded-for", "user-agent"]) {
|
|
const value = incoming.get(name);
|
|
if (value) forward[name] = value;
|
|
}
|
|
return forward;
|
|
}
|
|
|
|
/**
|
|
* The API's /api/v1 routes, as the person making this request. (Never await the client itself: it's a proxy, and
|
|
* awaiting it would call a route named "then".)
|
|
*/
|
|
export const api = treaty<App>(apiURL, { headers: forwarded }).api.v1;
|
|
|
|
type V1 = typeof api;
|
|
type Problem = { error: string; message: string };
|
|
/** What a route answers when it succeeds (the API's error shape is part of its declared answers). */
|
|
type Ok<T> = Exclude<T, Problem>;
|
|
type Data<Route extends (...args: any[]) => Promise<{ data: unknown }>> = Ok<
|
|
NonNullable<Awaited<ReturnType<Route>>["data"]>
|
|
>;
|
|
|
|
export type Person = Data<V1["me"]["get"]>["person"];
|
|
export type Account = Data<V1["account"]["get"]>;
|
|
export type Link = Account["links"][number];
|
|
export type Challenge = Account["challenges"][number];
|
|
export type AgeInfo = Data<V1["age"]["get"]>;
|
|
export type OnlineEntry = Data<V1["online"]["get"]>["online"][number];
|
|
export type ConsoleData = Data<V1["console"]["get"]>;
|
|
export type AuditEntry = ConsoleData["audit"][number];
|
|
export type CaseSummary = Data<V1["cases"]["get"]>["cases"][number];
|
|
export type CasePage = Data<ReturnType<V1["cases"]>["get"]>;
|
|
export type NotificationEntry = Data<V1["notifications"]["get"]>["notifications"][number];
|
|
export type CatalogPage = Data<ReturnType<V1["catalogs"]>["get"]>;
|
|
export type CatalogMember = Data<ReturnType<V1["catalogs"]>["members"]["get"]>["members"][number];
|
|
export type CatalogInvite = Data<ReturnType<V1["catalogs"]>["invites"]["get"]>["invites"][number];
|
|
export type HostedProduct = Data<ReturnType<V1["catalogs"]>["products"]["get"]>["products"][number];
|
|
export type CatalogTeam = Data<ReturnType<V1["catalogs"]>["team"]["get"]>;
|
|
export type ProductSummary = Data<V1["products"]["get"]>["products"][number];
|
|
export type ProductPage = Data<ReturnType<V1["products"]>["get"]>;
|
|
export type Revision = ProductPage["revisions"][number];
|
|
export type InfoEntry = Data<ReturnType<V1["products"]>["history"]["get"]>["entries"][number];
|
|
export type ManagedProduct = Data<V1["console"]["products"]["get"]>["products"][number];
|
|
export type Catalog = Data<V1["catalogs"]["get"]>["catalogs"][number];
|
|
export type LibraryEntry = Data<V1["library"]["get"]>["library"][number];
|
|
export type HostedRoom = Data<V1["hosted-rooms"]["get"]>["rooms"][number];
|
|
|
|
/** An error the API answered: message is written to be shown as is. */
|
|
export class ApiError extends Error {
|
|
constructor(
|
|
readonly status: number,
|
|
readonly slug: string,
|
|
message: string,
|
|
) {
|
|
super(message);
|
|
}
|
|
}
|
|
|
|
type Answer<T> = { data: T; error: null } | { data: null; error: { status: unknown; value: unknown } };
|
|
|
|
/** The answer's data, or throws ApiError with the API's message. */
|
|
export function unwrap<T>(answer: Answer<T>): Ok<NonNullable<T>> {
|
|
if (answer.error) {
|
|
const status = typeof answer.error.status === "number" ? answer.error.status : 500;
|
|
const value = answer.error.value as { error?: unknown; message?: unknown } | null;
|
|
const slug = typeof value?.error === "string" ? value.error : "error";
|
|
const message =
|
|
typeof value?.message === "string" && value.message
|
|
? value.message
|
|
: "Something went wrong. Try again in a moment.";
|
|
throw new ApiError(status, slug, message);
|
|
}
|
|
return answer.data as Ok<NonNullable<T>>;
|
|
}
|
|
|
|
/** Who's signed in, or undefined. Once per request. */
|
|
export const getMe = cache(async (): Promise<Person | undefined> => {
|
|
const { data } = await api.me.get();
|
|
return data && "person" in data ? data.person : undefined;
|
|
});
|
|
|
|
export const isModerator = (p: Pick<Person, "role"> | undefined) => p?.role === "moderator" || p?.role === "admin";
|