dhkatzandClaude Opus 5.5
f65f36c1ea
CI / test (push) Successful in 1m13s
T5 products placed in ordinary IMVU rooms, kept per room instance
(room_decoration, migration 0006). GET /api/v1/decorations/:instance (and
?instances= for up to 20) gives what the viewer may see, with a hash;
PUT is for the room owner's T5DE person only, checks the products exist,
and tells every realtime session with a chat in that room ({"type":
"decor"}). Hosted rooms' IDs are refused.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
1196 lines
47 KiB
TypeScript
1196 lines
47 KiB
TypeScript
// The hub's API: Better Auth at /api/auth, the hub's own routes at /api/v1. The website calls it through its own
|
|
// origin (Next.js rewrites /api to here), so session cookies are first-party; T5DE's proxy calls it with a bearer
|
|
// token.
|
|
import { Elysia, t } from "elysia";
|
|
import { and, desc, eq, ilike, inArray, ne, or, sql, count, schema, type Database, type ParentInfo } from "@t5de/db";
|
|
import type { Auth } from "./auth";
|
|
import { AgeError, AgeService } from "./age";
|
|
import { imvuAgeProvider, imvuResult } from "./age/imvu";
|
|
import { ImvuClient, ImvuUnavailable, NoSuchImvuUser } from "./imvu";
|
|
import { Realtime } from "./realtime";
|
|
import { isAdultRoom, Rooms } from "./rooms";
|
|
import { Signer } from "./keys";
|
|
import { ProductError, Products } from "./products";
|
|
import { chatId, HostedError, HostedRooms, instanceId, maxPlacement, maxSceneItems } from "./hosted";
|
|
import { DecorationError, Decorations, maxBatch, maxDecorationPlacement, maxDecorations } from "./decorations";
|
|
|
|
const { user, session, imvuLink, linkChallenge, audit } = schema;
|
|
|
|
export type Deps = {
|
|
db: Database;
|
|
auth: Auth;
|
|
imvu: ImvuClient;
|
|
realtime?: Realtime;
|
|
age?: AgeService;
|
|
rooms?: Rooms;
|
|
/** The hub's API URL, the issuer of its tokens. */
|
|
apiURL?: string;
|
|
};
|
|
|
|
/** An error shown to the person: the website displays message as is. */
|
|
export class Problem extends Error {
|
|
constructor(
|
|
readonly status: number,
|
|
readonly slug: string,
|
|
message: string,
|
|
) {
|
|
super(message);
|
|
}
|
|
}
|
|
|
|
type Person = typeof user.$inferSelect;
|
|
type Link = typeof imvuLink.$inferSelect;
|
|
|
|
const roles = ["user", "moderator", "admin"] as const;
|
|
const isModerator = (p: Person) => p.role === "moderator" || p.role === "admin";
|
|
|
|
// Link codes: "t5de-" and eight letters and digits without look-alikes.
|
|
function linkCode(): string {
|
|
const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
|
|
const bytes = crypto.getRandomValues(new Uint8Array(8));
|
|
const s = [...bytes].map((b) => alphabet[b % alphabet.length]).join("");
|
|
return `t5de-${s.slice(0, 4)}-${s.slice(4)}`;
|
|
}
|
|
|
|
function randomID(bytes = 16): string {
|
|
return Buffer.from(crypto.getRandomValues(new Uint8Array(bytes))).toString("base64url");
|
|
}
|
|
|
|
const challengeLifetime = 24 * 60 * 60 * 1000;
|
|
|
|
/** Allows n attempts per key in a window (IMVU lookups, which cost IMVU a request each). */
|
|
class Limiter {
|
|
private hits = new Map<string, number[]>();
|
|
allow(key: string, n: number, windowMs: number): boolean {
|
|
const now = Date.now();
|
|
const recent = (this.hits.get(key) ?? []).filter((t) => now - t < windowMs);
|
|
if (recent.length >= n) {
|
|
this.hits.set(key, recent);
|
|
return false;
|
|
}
|
|
recent.push(now);
|
|
this.hits.set(key, recent);
|
|
if (this.hits.size > 100_000) this.hits.clear();
|
|
return true;
|
|
}
|
|
}
|
|
|
|
export function createApp({ db, auth, imvu, realtime: rt, age: ageService, rooms: roomsService, apiURL }: Deps) {
|
|
const age = ageService ?? new AgeService(db, [imvuAgeProvider(imvu)]);
|
|
const signer = new Signer(db, apiURL ?? "http://localhost:4101");
|
|
const products = new Products(db, signer, imvu);
|
|
const rooms = roomsService ?? new Rooms(db, imvu);
|
|
const hosted = new HostedRooms(db);
|
|
const decorations = new Decorations(db);
|
|
const realtime =
|
|
rt ??
|
|
new Realtime({
|
|
owner: async (imvuId) => {
|
|
const [l] = await db.select({ userId: imvuLink.userId }).from(imvuLink).where(eq(imvuLink.imvuId, imvuId));
|
|
return l?.userId;
|
|
},
|
|
adult: async (userId, imvuId) => (await age.adultAccounts(userId, [imvuId])).has(imvuId),
|
|
room: (instanceId) => {
|
|
rooms.seen(instanceId).catch((e) => console.error("rooms:", e));
|
|
},
|
|
hostedRoom: (n) => hosted.info(n),
|
|
});
|
|
const limiter = new Limiter();
|
|
|
|
const personView = (p: Person) => ({
|
|
id: p.id,
|
|
username: p.displayUsername ?? p.username ?? p.name,
|
|
email: p.email,
|
|
role: (roles as readonly string[]).includes(p.role) ? (p.role as (typeof roles)[number]) : "user",
|
|
linkCap: p.linkCap,
|
|
createdAt: p.createdAt.toISOString(),
|
|
banned: p.banned === true,
|
|
banReason: p.banReason ?? "",
|
|
});
|
|
|
|
/** Links as the website shows them: with live presence, and age by the one rule. */
|
|
const linkViews = async (userId: string, links: Link[]) => {
|
|
const ids = links.map((l) => l.imvuId);
|
|
const adult = await age.adultAccounts(userId, ids);
|
|
const imvuChecks = await age.accountChecks("imvu", ids);
|
|
const online = realtime.online();
|
|
return links.map((l) => {
|
|
const live = online.find((o) => o.imvuId === l.imvuId);
|
|
const check = imvuChecks.get(l.imvuId);
|
|
return {
|
|
imvuId: l.imvuId,
|
|
username: l.username,
|
|
linkedAt: l.linkedAt.toISOString(),
|
|
ageVerified: check?.method === "imvu_age_verified",
|
|
accessPass: check?.method === "imvu_access_pass",
|
|
adult: adult.has(l.imvuId),
|
|
checkedAt: (check?.checkedAt ?? l.linkedAt).toISOString(),
|
|
showBadge: l.showBadge,
|
|
showPresence: l.showPresence,
|
|
listRooms: l.listRooms,
|
|
online: live !== undefined,
|
|
outfit: live?.outfit ?? [],
|
|
};
|
|
});
|
|
};
|
|
const linkView = async (l: Link) => (await linkViews(l.userId, [l]))[0]!;
|
|
|
|
const audited = (actorId: string | null, action: string, target: string, detail: Record<string, unknown> = {}) =>
|
|
db.insert(audit).values({ actorId, action, target, detail });
|
|
|
|
/** Who's online that viewer may see: accounts showing their presence (moderators see all). */
|
|
const visibleOnline = async (viewer: Person | undefined) => {
|
|
const online = realtime.online();
|
|
if (online.length === 0) return [];
|
|
const links = await db.select().from(imvuLink).where(inArray(imvuLink.imvuId, online.map((o) => o.imvuId)));
|
|
const mod = viewer !== undefined && isModerator(viewer);
|
|
const adult = new Set<number>();
|
|
if (mod) {
|
|
for (const l of links) if ((await age.adultAccounts(l.userId, [l.imvuId])).has(l.imvuId)) adult.add(l.imvuId);
|
|
}
|
|
return online.flatMap((o) => {
|
|
const l = links.find((l) => l.imvuId === o.imvuId);
|
|
if (!l || (!l.showPresence && !mod)) return [];
|
|
return [
|
|
{
|
|
imvuId: o.imvuId,
|
|
username: l.username,
|
|
badge: l.showBadge,
|
|
since: o.since.toISOString(),
|
|
outfit: o.outfit,
|
|
...(mod ? { hidden: !l.showPresence, personId: o.userId, adult: adult.has(o.imvuId) } : {}),
|
|
},
|
|
];
|
|
});
|
|
};
|
|
|
|
const imvuIdParam = t.Object({ imvu: t.Numeric({ minimum: 1 }) });
|
|
|
|
/** Whether any of a person's IMVU accounts counts as adult (for seeing adult products and rooms). */
|
|
const personAdult = async (p: Person | undefined) => {
|
|
if (!p) return false;
|
|
const ids = (await db.select({ id: imvuLink.imvuId }).from(imvuLink).where(eq(imvuLink.userId, p.id))).map((l) => l.id);
|
|
return ids.length > 0 && (await age.adultAccounts(p.id, ids)).size > 0;
|
|
};
|
|
|
|
/** Runs a product operation, turning its errors into Problems. */
|
|
const productCall = async <T>(f: () => Promise<T>): Promise<T> => {
|
|
try {
|
|
return await f();
|
|
} catch (e) {
|
|
if (e instanceof ProductError) throw new Problem(e.status, e.slug, e.message);
|
|
throw e;
|
|
}
|
|
};
|
|
|
|
/** `latest`: the latest revision's parent and its info (the image and categories are the parent's). */
|
|
const productView = (
|
|
p: typeof schema.product.$inferSelect,
|
|
creator?: string | null,
|
|
creatorUsername?: string | null,
|
|
latest?: { parent: number | null; parentInfo: ParentInfo | null } | null,
|
|
) => ({
|
|
id: p.id,
|
|
name: p.name,
|
|
description: p.description,
|
|
rating: p.rating as "general" | "adult",
|
|
latest: p.latest,
|
|
creator: creator ?? creatorUsername ?? "",
|
|
creatorUsername: creatorUsername ?? "",
|
|
parent: latest?.parent ?? 0,
|
|
image: latest?.parentInfo?.image ?? null,
|
|
categories: latest?.parentInfo?.categories ?? [],
|
|
createdAt: p.createdAt.toISOString(),
|
|
updatedAt: p.updatedAt.toISOString(),
|
|
});
|
|
|
|
const catalogView = (c: typeof schema.catalog.$inferSelect) => ({
|
|
id: c.id,
|
|
name: c.name,
|
|
url: c.url,
|
|
contact: c.contact,
|
|
visibility: c.visibility,
|
|
membership: c.membership,
|
|
status: c.status,
|
|
createdAt: c.createdAt.toISOString(),
|
|
});
|
|
|
|
/** Runs a hosted-room operation, turning its errors into Problems. */
|
|
const hostedCall = async <T>(f: () => Promise<T>): Promise<T> => {
|
|
try {
|
|
return await f();
|
|
} catch (e) {
|
|
if (e instanceof HostedError) throw new Problem(e.status, e.slug, e.message);
|
|
throw e;
|
|
}
|
|
};
|
|
|
|
const hostedView = ({ room: r, ownerName }: { room: typeof schema.hostedRoom.$inferSelect; ownerName: string }) => ({
|
|
n: r.n,
|
|
instanceId: instanceId(r.n),
|
|
chatId: chatId(r.n),
|
|
name: r.name,
|
|
description: r.description,
|
|
roomPid: r.roomPid,
|
|
rating: r.rating as "general" | "adult",
|
|
maxUsers: r.maxUsers,
|
|
ownerImvuId: r.ownerImvuId,
|
|
ownerName,
|
|
occupancy: realtime.occupancy(r.n),
|
|
createdAt: r.createdAt.toISOString(),
|
|
});
|
|
|
|
const hostedParam = t.Object({ n: t.Numeric({ minimum: 1, maximum: 47_483_647, multipleOf: 1 }) });
|
|
const rating = t.Union([t.Literal("general"), t.Literal("adult")]);
|
|
const roomPid = t.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER });
|
|
const maxUsers = t.Integer({ minimum: 2, maximum: 30 });
|
|
const sceneItem = t.Tuple([
|
|
t.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),
|
|
t.Union([t.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }), t.String({ pattern: "^[a-z2-7]{10}$" })]),
|
|
t.String({ maxLength: maxPlacement }),
|
|
]);
|
|
|
|
/** Runs a decorations operation, turning its errors into Problems. */
|
|
const decorationCall = async <T>(f: () => Promise<T>): Promise<T> => {
|
|
try {
|
|
return await f();
|
|
} catch (e) {
|
|
if (e instanceof DecorationError) throw new Problem(e.status, e.slug, e.message);
|
|
throw e;
|
|
}
|
|
};
|
|
|
|
const decorationItem = t.Tuple([
|
|
t.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),
|
|
t.String({ pattern: "^[a-z2-7]{10}$" }),
|
|
t.String({ maxLength: maxDecorationPlacement }),
|
|
]);
|
|
|
|
const productParam = t.Object({ id: t.String({ pattern: "^[a-z2-7]{10}$" }) });
|
|
|
|
const ownLink = async (p: Person, imvuId: number) => {
|
|
const [l] = await db.select().from(imvuLink).where(and(eq(imvuLink.imvuId, imvuId), eq(imvuLink.userId, p.id)));
|
|
if (!l) throw new Problem(404, "not_found", "That account isn't linked to you.");
|
|
return l;
|
|
};
|
|
|
|
const imvuCall = async <T>(p: Person, call: () => Promise<T>): Promise<T> => {
|
|
if (!limiter.allow(`imvu:${p.id}`, 20, 60 * 60 * 1000))
|
|
throw new Problem(429, "rate_limited", "Too many lookups. Try again in a while.");
|
|
try {
|
|
return await call();
|
|
} catch (e) {
|
|
if (e instanceof NoSuchImvuUser) throw new Problem(404, "no_such_imvu_account", "IMVU has no account by that name.");
|
|
if (e instanceof ImvuUnavailable) throw new Problem(502, "imvu_unavailable", "IMVU didn't answer. Try again in a moment.");
|
|
throw e;
|
|
}
|
|
};
|
|
|
|
const personById = async (id: string) => {
|
|
const [p] = await db.select().from(user).where(eq(user.id, id));
|
|
if (!p) throw new Problem(404, "not_found", "No such person.");
|
|
return p;
|
|
};
|
|
|
|
const api = new Elysia({ prefix: "/api/v1" })
|
|
.error({ Problem })
|
|
.onError(({ code, error, set }) => {
|
|
if (code === "Problem") {
|
|
set.status = error.status;
|
|
return { error: error.slug, message: error.message };
|
|
}
|
|
if (code === "VALIDATION") {
|
|
set.status = 400;
|
|
return { error: "invalid", message: "Some of that isn't right. Check it and try again." };
|
|
}
|
|
if (code === "NOT_FOUND") {
|
|
set.status = 404;
|
|
return { error: "not_found", message: "Not found." };
|
|
}
|
|
})
|
|
.derive(async ({ request }) => {
|
|
const s = await auth.api.getSession({ headers: request.headers });
|
|
const person = s?.user ? ((await db.select().from(user).where(eq(user.id, s.user.id)))[0] ?? undefined) : undefined;
|
|
return { person: person && !person.banned ? person : undefined, sessionId: s?.session.id };
|
|
})
|
|
.macro({
|
|
signedIn: {
|
|
resolve: ({ person }) => {
|
|
if (!person) throw new Problem(401, "signed_out", "Sign in first.");
|
|
return { me: person };
|
|
},
|
|
},
|
|
moderator: {
|
|
resolve: ({ person }) => {
|
|
if (!person) throw new Problem(401, "signed_out", "Sign in first.");
|
|
if (!isModerator(person)) throw new Problem(403, "forbidden", "Only moderators can do this.");
|
|
return { me: person };
|
|
},
|
|
},
|
|
})
|
|
|
|
// Who's signed in, and the home page.
|
|
.get("/me", ({ me }) => ({ person: personView(me) }), { signedIn: true })
|
|
.get("/home", async ({ person }) => {
|
|
const online = (await visibleOnline(person)).length;
|
|
if (!person) return { onlineCount: online };
|
|
const [row] = await db.select({ n: count() }).from(imvuLink).where(eq(imvuLink.userId, person.id));
|
|
return { onlineCount: online, links: row?.n ?? 0 };
|
|
})
|
|
|
|
// Who's online.
|
|
.get("/online", async ({ person }) => ({ online: await visibleOnline(person) }))
|
|
.get("/online/events", ({ person, request }) => {
|
|
const encoder = new TextEncoder();
|
|
let stop = () => {};
|
|
const stream = new ReadableStream({
|
|
start(controller) {
|
|
const send = async () => {
|
|
const online = await visibleOnline(person);
|
|
try {
|
|
controller.enqueue(encoder.encode(`event: online\ndata: ${JSON.stringify({ online })}\n\n`));
|
|
} catch {}
|
|
};
|
|
const unsubscribe = realtime.subscribe(() => void send());
|
|
const keepAlive = setInterval(() => {
|
|
try {
|
|
controller.enqueue(encoder.encode(": keep-alive\n\n"));
|
|
} catch {}
|
|
}, 25_000);
|
|
stop = () => {
|
|
unsubscribe();
|
|
clearInterval(keepAlive);
|
|
};
|
|
request.signal.addEventListener("abort", () => {
|
|
stop();
|
|
try {
|
|
controller.close();
|
|
} catch {}
|
|
});
|
|
void send();
|
|
},
|
|
cancel() {
|
|
stop();
|
|
},
|
|
});
|
|
return new Response(stream, {
|
|
headers: { "Content-Type": "text/event-stream", "Cache-Control": "no-store", Connection: "keep-alive" },
|
|
});
|
|
})
|
|
|
|
// Your account.
|
|
.get(
|
|
"/account",
|
|
async ({ me }) => {
|
|
const links = await db.select().from(imvuLink).where(eq(imvuLink.userId, me.id)).orderBy(imvuLink.linkedAt);
|
|
const challenges = await db
|
|
.select()
|
|
.from(linkChallenge)
|
|
.where(and(eq(linkChallenge.userId, me.id), sql`${linkChallenge.createdAt} > now() - interval '1 day'`))
|
|
.orderBy(linkChallenge.createdAt);
|
|
const [computers] = await db
|
|
.select({ n: count() })
|
|
.from(session)
|
|
.where(and(eq(session.userId, me.id), ilike(session.userAgent, "t5de-proxy%"), sql`${session.expiresAt} > now()`));
|
|
return {
|
|
person: personView(me),
|
|
links: await linkViews(me.id, links),
|
|
challenges: challenges.map((c) => ({
|
|
imvuId: c.imvuId,
|
|
username: c.username,
|
|
code: c.code,
|
|
createdAt: c.createdAt.toISOString(),
|
|
expiresAt: new Date(c.createdAt.getTime() + challengeLifetime).toISOString(),
|
|
})),
|
|
computers: computers?.n ?? 0,
|
|
canLink: links.length < me.linkCap,
|
|
};
|
|
},
|
|
{ signedIn: true },
|
|
)
|
|
.post(
|
|
"/account/links",
|
|
async ({ me, body, set }) => {
|
|
const found = await imvuCall(me, () => imvu.byUsername(body.username));
|
|
const [existing] = await db.select().from(imvuLink).where(eq(imvuLink.imvuId, found.id));
|
|
if (existing?.userId === me.id)
|
|
throw new Problem(409, "already_linked", `${found.username} is already linked.`);
|
|
const code = linkCode();
|
|
const [c] = await db
|
|
.insert(linkChallenge)
|
|
.values({ userId: me.id, imvuId: found.id, username: found.username, code })
|
|
.onConflictDoUpdate({
|
|
target: [linkChallenge.userId, linkChallenge.imvuId],
|
|
set: { code, username: found.username, createdAt: new Date() },
|
|
})
|
|
.returning();
|
|
set.status = 201;
|
|
return {
|
|
challenge: {
|
|
imvuId: c!.imvuId,
|
|
username: c!.username,
|
|
code: c!.code,
|
|
createdAt: c!.createdAt.toISOString(),
|
|
expiresAt: new Date(c!.createdAt.getTime() + challengeLifetime).toISOString(),
|
|
},
|
|
};
|
|
},
|
|
{ signedIn: true, body: t.Object({ username: t.String({ minLength: 1, maxLength: 64 }) }) },
|
|
)
|
|
.post(
|
|
"/account/links/:imvu/check",
|
|
async ({ me, params }) => {
|
|
const [c] = await db
|
|
.select()
|
|
.from(linkChallenge)
|
|
.where(
|
|
and(
|
|
eq(linkChallenge.userId, me.id),
|
|
eq(linkChallenge.imvuId, params.imvu),
|
|
sql`${linkChallenge.createdAt} > now() - interval '1 day'`,
|
|
),
|
|
);
|
|
if (!c) throw new Problem(410, "expired", "That code expired. Start again.");
|
|
const found = await imvuCall(me, () => imvu.byId(params.imvu));
|
|
if (!found.tagline.toLowerCase().includes(c.code.toLowerCase()))
|
|
throw new Problem(
|
|
409,
|
|
"code_missing",
|
|
`${found.username}'s tagline doesn't have the code yet. IMVU can take a minute to show a new tagline.`,
|
|
);
|
|
const result = await db.transaction(async (tx) => {
|
|
const [{ n } = { n: 0 }] = await tx
|
|
.select({ n: count() })
|
|
.from(imvuLink)
|
|
.where(and(eq(imvuLink.userId, me.id), ne(imvuLink.imvuId, found.id)));
|
|
if (n >= me.linkCap)
|
|
throw new Problem(403, "link_cap", `You can link up to ${me.linkCap} IMVU accounts. Ask a moderator if you need more.`);
|
|
const [prev] = await tx.select().from(imvuLink).where(eq(imvuLink.imvuId, found.id));
|
|
const moved = prev !== undefined && prev.userId !== me.id;
|
|
const values = { userId: me.id, username: found.username };
|
|
let link: Link;
|
|
if (!prev) {
|
|
[link] = (await tx.insert(imvuLink).values({ imvuId: found.id, pairwiseId: randomID(), ...values }).returning()) as [Link];
|
|
} else if (moved) {
|
|
// A moved account gets a new pairwise ID and starts with nothing shown: nothing connects the new owner
|
|
// to the old one.
|
|
[link] = (await tx
|
|
.update(imvuLink)
|
|
.set({ ...values, pairwiseId: randomID(), linkedAt: new Date(), showBadge: false, showPresence: false })
|
|
.where(eq(imvuLink.imvuId, found.id))
|
|
.returning()) as [Link];
|
|
} else {
|
|
[link] = (await tx.update(imvuLink).set(values).where(eq(imvuLink.imvuId, found.id)).returning()) as [Link];
|
|
}
|
|
await tx.delete(linkChallenge).where(eq(linkChallenge.imvuId, found.id));
|
|
await tx.insert(audit).values({
|
|
actorId: me.id,
|
|
action: "link.add",
|
|
target: String(found.id),
|
|
detail: moved ? { imvu: found.username, movedFrom: prev!.userId } : { imvu: found.username },
|
|
});
|
|
return { link, moved, previousOwner: prev?.userId };
|
|
});
|
|
// Age from IMVU, for this account; a moved account's earlier checks belonged to its previous owner.
|
|
if (result.moved) await age.forgetAccount(found.id);
|
|
await age.record({ userId: me.id, imvuId: found.id }, "imvu", imvuResult(found));
|
|
if (result.moved) {
|
|
await rooms.forgetOwner(found.id);
|
|
realtime.unlinked(result.previousOwner!, found.id);
|
|
}
|
|
await realtime.linked(me.id, found.id);
|
|
return { link: await linkView(result.link), moved: result.moved };
|
|
},
|
|
{ signedIn: true, params: imvuIdParam },
|
|
)
|
|
.delete(
|
|
"/account/challenges/:imvu",
|
|
async ({ me, params, set }) => {
|
|
await db.delete(linkChallenge).where(and(eq(linkChallenge.userId, me.id), eq(linkChallenge.imvuId, params.imvu)));
|
|
set.status = 204;
|
|
},
|
|
{ signedIn: true, params: imvuIdParam },
|
|
)
|
|
.patch(
|
|
"/account/links/:imvu",
|
|
async ({ me, params, body }) => {
|
|
await ownLink(me, params.imvu);
|
|
const [l] = await db
|
|
.update(imvuLink)
|
|
.set({
|
|
...(body.showBadge !== undefined ? { showBadge: body.showBadge } : {}),
|
|
...(body.showPresence !== undefined ? { showPresence: body.showPresence } : {}),
|
|
...(body.listRooms !== undefined ? { listRooms: body.listRooms } : {}),
|
|
})
|
|
.where(eq(imvuLink.imvuId, params.imvu))
|
|
.returning();
|
|
return { link: await linkView(l!) };
|
|
},
|
|
{
|
|
signedIn: true,
|
|
params: imvuIdParam,
|
|
body: t.Object({
|
|
showBadge: t.Optional(t.Boolean()),
|
|
showPresence: t.Optional(t.Boolean()),
|
|
listRooms: t.Optional(t.Boolean()),
|
|
}),
|
|
},
|
|
)
|
|
.post(
|
|
"/account/links/:imvu/recheck",
|
|
async ({ me, params }) => {
|
|
await ownLink(me, params.imvu);
|
|
const found = await imvuCall(me, () => imvu.byId(params.imvu));
|
|
await age.record({ userId: me.id, imvuId: params.imvu }, "imvu", imvuResult(found));
|
|
const [l] = await db.update(imvuLink).set({ username: found.username }).where(eq(imvuLink.imvuId, params.imvu)).returning();
|
|
return { link: await linkView(l!) };
|
|
},
|
|
{ signedIn: true, params: imvuIdParam },
|
|
)
|
|
.delete(
|
|
"/account/links/:imvu",
|
|
async ({ me, params, set }) => {
|
|
const l = await ownLink(me, params.imvu);
|
|
await db.delete(imvuLink).where(eq(imvuLink.imvuId, l.imvuId));
|
|
await age.forgetAccount(l.imvuId);
|
|
await rooms.forgetOwner(l.imvuId);
|
|
realtime.unlinked(me.id, l.imvuId);
|
|
await audited(me.id, "link.remove", String(l.imvuId), { imvu: l.username });
|
|
set.status = 204;
|
|
},
|
|
{ signedIn: true, params: imvuIdParam },
|
|
)
|
|
.post(
|
|
"/account/signout-computers",
|
|
async ({ me, set }) => {
|
|
await db.delete(session).where(and(eq(session.userId, me.id), ilike(session.userAgent, "t5de-proxy%")));
|
|
realtime.disconnect(me.id);
|
|
set.status = 204;
|
|
},
|
|
{ signedIn: true },
|
|
)
|
|
|
|
// A proxy's sign-in code, approved by the person on the website.
|
|
.post(
|
|
"/device/approve",
|
|
async ({ me, body, request, set }) => {
|
|
const raw = body.code.toUpperCase().replace(/[\s-]/g, "");
|
|
try {
|
|
// Viewing the code claims it for this person; then they approve it.
|
|
await auth.api.deviceVerify({ query: { user_code: raw }, headers: request.headers });
|
|
await auth.api.deviceApprove({ body: { userCode: raw }, headers: request.headers });
|
|
} catch {
|
|
throw new Problem(404, "not_found", "That code isn't right, or it expired. Check the code T5DE shows.");
|
|
}
|
|
await audited(me.id, "proxy.signin", "");
|
|
set.status = 204;
|
|
},
|
|
{ signedIn: true, body: t.Object({ code: t.String({ minLength: 4, maxLength: 32 }) }) },
|
|
)
|
|
|
|
// IMVU rooms whose owners list them, with the T5DE users in each now (those showing they're online).
|
|
.get("/rooms", async ({ person: me }) => {
|
|
const viewerAdult = await personAdult(me);
|
|
const listed = (await rooms.listed()).filter((r) => viewerAdult || !isAdultRoom(r.room));
|
|
const here = new Map<string, number[]>();
|
|
for (const o of realtime.online()) for (const r of o.rooms) here.set(r, [...(here.get(r) ?? []), o.imvuId]);
|
|
const ids = [...new Set([...here.values()].flat())];
|
|
const shown = ids.length
|
|
? await db
|
|
.select({ imvuId: imvuLink.imvuId, username: imvuLink.username, badge: imvuLink.showBadge })
|
|
.from(imvuLink)
|
|
.where(and(inArray(imvuLink.imvuId, ids), eq(imvuLink.showPresence, true)))
|
|
: [];
|
|
const out = listed.map(({ room: r, owner }) => {
|
|
const t5de = shown.filter((u) => here.get(r.instanceId)?.includes(u.imvuId));
|
|
return {
|
|
instanceId: r.instanceId,
|
|
name: r.name,
|
|
description: r.description,
|
|
imageURL: r.imageURL,
|
|
owner: { imvuId: r.ownerImvuId, username: owner },
|
|
adult: isAdultRoom(r),
|
|
occupancy: r.occupancy,
|
|
capacity: r.capacity,
|
|
url: `https://go.imvu.com/chat/room-${r.instanceId}`,
|
|
t5de,
|
|
seenAt: r.seenAt.toISOString(),
|
|
};
|
|
});
|
|
out.sort((a, b) => b.t5de.length - a.t5de.length);
|
|
return { rooms: out };
|
|
})
|
|
|
|
// T5DE-hosted rooms (docs/hosted-rooms.md).
|
|
.post(
|
|
"/hosted-rooms",
|
|
async ({ me, body, set }) => {
|
|
if (!limiter.allow(`hosted:${me.id}`, 20, 60 * 60 * 1000))
|
|
throw new Problem(429, "rate_limited", "Too many new rooms. Try again in a while.");
|
|
const r = await hostedCall(async () => hosted.create(me.id, await personAdult(me), body));
|
|
await audited(me.id, "hosted_room.create", String(r.room.n), { name: r.room.name, rating: r.room.rating });
|
|
set.status = 201;
|
|
return { room: hostedView(r) };
|
|
},
|
|
{
|
|
signedIn: true,
|
|
body: t.Object({
|
|
name: t.String({ maxLength: 64 }),
|
|
description: t.Optional(t.String({ maxLength: 512 })),
|
|
roomPid,
|
|
rating,
|
|
maxUsers: t.Optional(maxUsers),
|
|
imvuId: t.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
|
|
}),
|
|
},
|
|
)
|
|
.get(
|
|
"/hosted-rooms",
|
|
async ({ person, query }) => {
|
|
const mine = query.mine === "1" || query.mine === "true";
|
|
if (mine && !person) throw new Problem(401, "signed_out", "Sign in first.");
|
|
const rows = await hosted.list({ adult: await personAdult(person), mine: mine ? person!.id : undefined });
|
|
return { rooms: rows.map(hostedView) };
|
|
},
|
|
{ query: t.Object({ mine: t.Optional(t.String({ maxLength: 8 })) }) },
|
|
)
|
|
.get(
|
|
"/hosted-rooms/:n",
|
|
async ({ person, params }) => {
|
|
const r = await hostedCall(async () => hosted.get(params.n, await personAdult(person), person?.id));
|
|
return { room: hostedView(r), scene: { contents: r.room.scene, hash: r.room.sceneHash } };
|
|
},
|
|
{ params: hostedParam },
|
|
)
|
|
.patch(
|
|
"/hosted-rooms/:n",
|
|
async ({ me, params, body }) => {
|
|
const r = await hostedCall(async () => hosted.update(me.id, await personAdult(me), params.n, body));
|
|
realtime.hostedChanged(r.room.n, { closed: false, adult: r.room.rating === "adult", maxUsers: r.room.maxUsers });
|
|
await audited(me.id, "hosted_room.edit", String(r.room.n), { fields: Object.keys(body) });
|
|
return { room: hostedView(r) };
|
|
},
|
|
{
|
|
signedIn: true,
|
|
params: hostedParam,
|
|
body: t.Object({
|
|
name: t.Optional(t.String({ maxLength: 64 })),
|
|
description: t.Optional(t.String({ maxLength: 512 })),
|
|
rating: t.Optional(rating),
|
|
maxUsers: t.Optional(maxUsers),
|
|
roomPid: t.Optional(roomPid),
|
|
}),
|
|
},
|
|
)
|
|
.put(
|
|
"/hosted-rooms/:n/scene",
|
|
async ({ me, params, body }) => {
|
|
if (!limiter.allow(`scene:${me.id}`, 60, 60 * 1000))
|
|
throw new Problem(429, "rate_limited", "Too many changes. Try again in a moment.");
|
|
const r = await hostedCall(() => hosted.setScene(me.id, params.n, body.contents, body.roomPid));
|
|
return { room: hostedView(r), scene: { contents: r.room.scene, hash: r.room.sceneHash } };
|
|
},
|
|
{
|
|
signedIn: true,
|
|
params: hostedParam,
|
|
body: t.Object({ contents: t.Array(sceneItem, { maxItems: maxSceneItems }), roomPid: t.Optional(roomPid) }),
|
|
},
|
|
)
|
|
.delete(
|
|
"/hosted-rooms/:n",
|
|
async ({ me, params, set }) => {
|
|
const r = await hostedCall(() => hosted.close(me.id, isModerator(me), params.n));
|
|
realtime.hostedClosed(r.n);
|
|
await audited(me.id, "hosted_room.close", String(r.n), { name: r.name, ...(r.ownerId !== me.id ? { owner: r.ownerId } : {}) });
|
|
set.status = 204;
|
|
},
|
|
{ signedIn: true, params: hostedParam },
|
|
)
|
|
|
|
// Decorations over IMVU rooms (docs/products.md, "Decorations").
|
|
.get(
|
|
"/decorations",
|
|
async ({ person, query }) => {
|
|
const instances = [...new Set((query.instances ?? "").split(",").filter(Boolean))];
|
|
if (instances.length > maxBatch) throw new Problem(400, "invalid", `Up to ${maxBatch} rooms at a time.`);
|
|
return { rooms: await decorationCall(async () => decorations.get(instances, await personAdult(person))) };
|
|
},
|
|
{ query: t.Object({ instances: t.Optional(t.String({ maxLength: 1024 })) }) },
|
|
)
|
|
.get(
|
|
"/decorations/:instance",
|
|
async ({ person, params }) =>
|
|
(await decorationCall(async () => decorations.get([params.instance], await personAdult(person))))[0]!,
|
|
{ params: t.Object({ instance: t.String({ maxLength: 32 }) }) },
|
|
)
|
|
.put(
|
|
"/decorations/:instance",
|
|
async ({ me, params, body }) => {
|
|
if (!limiter.allow(`decor:${me.id}`, 60, 60 * 1000))
|
|
throw new Problem(429, "rate_limited", "Too many changes. Try again in a moment.");
|
|
await decorationCall(() => decorations.set(me.id, params.instance, body.contents));
|
|
realtime.decorated(params.instance);
|
|
return (await decorations.get([params.instance], await personAdult(me)))[0]!;
|
|
},
|
|
{
|
|
signedIn: true,
|
|
params: t.Object({ instance: t.String({ maxLength: 32 }) }),
|
|
body: t.Object({ contents: t.Array(decorationItem, { maxItems: maxDecorations }) }),
|
|
},
|
|
)
|
|
|
|
// Catalogs: registering one, and the directory.
|
|
.post(
|
|
"/catalogs",
|
|
async ({ me, body, set }) => {
|
|
const r = await productCall(() => products.registerCatalog(me.id, body));
|
|
await audited(me.id, "catalog.register", r.catalog.id, { name: r.catalog.name, url: r.catalog.url });
|
|
set.status = 201;
|
|
return { catalog: catalogView(r.catalog), key: r.key };
|
|
},
|
|
{
|
|
signedIn: true,
|
|
body: t.Object({
|
|
name: t.String({ maxLength: 64 }),
|
|
url: t.String({ maxLength: 300 }),
|
|
contact: t.String({ maxLength: 200 }),
|
|
visibility: t.String(),
|
|
membership: t.String(),
|
|
}),
|
|
},
|
|
)
|
|
.get("/catalogs", async ({ person }) => ({
|
|
catalogs: (await products.catalogs(person?.id)).map((c) => ({ ...catalogView(c), mine: c.ownerId === person?.id })),
|
|
}))
|
|
|
|
// For catalogs: registering an uploaded revision.
|
|
.post(
|
|
"/catalog/revisions",
|
|
async ({ request, body, set }) => {
|
|
const c = await products.catalogFor(request.headers.get("authorization"));
|
|
if (!c) throw new Problem(401, "forbidden", "Not an approved catalog.");
|
|
const r = await productCall(() => products.registerRevision(c, body));
|
|
set.status = 201;
|
|
return r;
|
|
},
|
|
{
|
|
body: t.Object({
|
|
uploadToken: t.String({ maxLength: 4000 }),
|
|
files: t.Array(t.Object({ name: t.String(), sha256: t.String(), size: t.Number() }), { maxItems: 512 }),
|
|
rating: t.String(),
|
|
parent: t.Number(),
|
|
name: t.String({ maxLength: 200 }),
|
|
notes: t.String({ maxLength: 4000 }),
|
|
}),
|
|
},
|
|
)
|
|
|
|
// Products.
|
|
.post(
|
|
"/products/upload",
|
|
async ({ me, body }) => productCall(() => products.uploadToken(me.id, body.catalog, body.product)),
|
|
{ signedIn: true, body: t.Object({ catalog: t.String(), product: t.Optional(t.String()) }) },
|
|
)
|
|
.get(
|
|
"/products",
|
|
async ({ person, query }) => {
|
|
const adult = await personAdult(person);
|
|
const rows = await products.list({ ...query, adult });
|
|
return { products: rows.map((r) => productView(r.product, r.creator, r.creatorUsername, r)) };
|
|
},
|
|
{
|
|
query: t.Object({
|
|
q: t.Optional(t.String({ maxLength: 100 })),
|
|
creator: t.Optional(t.String({ maxLength: 64 })),
|
|
category: t.Optional(t.Numeric({ minimum: 1, maximum: 2_147_483_647, multipleOf: 1 })),
|
|
limit: t.Optional(t.Numeric({ minimum: 1, maximum: 200, multipleOf: 1 })),
|
|
}),
|
|
},
|
|
)
|
|
.get(
|
|
"/products/:id",
|
|
async ({ person, params }) => {
|
|
const adult = await personAdult(person);
|
|
const p = await productCall(() => products.get(params.id, adult));
|
|
const lib = person ? await products.inLibrary(person.id, params.id) : undefined;
|
|
const latest = p.revisions.find((r) => r.number === p.product.latest);
|
|
return {
|
|
product: productView(p.product, p.creator, p.creatorUsername, latest),
|
|
revisions: p.revisions.map((r) => ({
|
|
number: r.number,
|
|
rating: r.rating,
|
|
notes: r.notes,
|
|
retracted: r.retracted,
|
|
files: r.files,
|
|
size: r.files.reduce((n, f) => n + f.size, 0),
|
|
createdAt: r.createdAt.toISOString(),
|
|
catalogs: p.hosts.filter((h) => h.number === r.number).map((h) => h.name),
|
|
})),
|
|
inLibrary: lib !== undefined,
|
|
stayOn: lib?.stayOn ?? null,
|
|
mine: person?.id === p.product.creatorId,
|
|
};
|
|
},
|
|
{ params: productParam },
|
|
)
|
|
.patch(
|
|
"/products/:id",
|
|
async ({ me, params, body }) => {
|
|
const p = await productCall(() => products.update(me.id, params.id, body));
|
|
await audited(me.id, "product.edit", p.id, { fields: Object.keys(body) });
|
|
return { product: productView(p, undefined, undefined, await products.latestParent(p)) };
|
|
},
|
|
{
|
|
signedIn: true,
|
|
params: productParam,
|
|
body: t.Object({
|
|
name: t.Optional(t.String({ maxLength: 64 })),
|
|
description: t.Optional(t.String({ maxLength: 20000 })),
|
|
rating: t.Optional(t.Union([t.Literal("general"), t.Literal("adult")])),
|
|
}),
|
|
},
|
|
)
|
|
.post(
|
|
"/products/:id/revisions/:n/retract",
|
|
async ({ me, params }) => {
|
|
await productCall(() => products.retract(me.id, params.id, params.n));
|
|
await audited(me.id, "product.retract", params.id, { revision: params.n });
|
|
return { ok: true };
|
|
},
|
|
{ signedIn: true, params: t.Object({ id: t.String({ pattern: "^[a-z2-7]{10}$" }), n: t.Numeric({ minimum: 1 }) }) },
|
|
)
|
|
// What the proxy loads: the revision this person uses, where to get it, and the hub's word on its files.
|
|
.get(
|
|
"/products/:id/files",
|
|
async ({ person, params }) => {
|
|
const r = await productCall(async () => products.revisionFor(person?.id, params.id, await personAdult(person)));
|
|
return {
|
|
product: r.product.id,
|
|
revision: r.revision.number,
|
|
rating: r.revision.rating,
|
|
parent: r.revision.parent,
|
|
name: r.product.name,
|
|
creator: r.creator ?? "",
|
|
files: r.revision.files,
|
|
catalogs: r.catalogs,
|
|
token: r.revision.token,
|
|
};
|
|
},
|
|
{ params: productParam },
|
|
)
|
|
.post(
|
|
"/access",
|
|
async ({ me }) => ({
|
|
token: await signer.sign("t5de-access", { sub: me.id, adult: await personAdult(me) }, 60 * 60),
|
|
}),
|
|
{ signedIn: true },
|
|
)
|
|
|
|
// Libraries.
|
|
.get(
|
|
"/library",
|
|
async ({ me }) => ({
|
|
library: (await products.library(me.id)).map((l) => ({
|
|
product: productView(l.product, l.creator, undefined, l),
|
|
stayOn: l.stayOn,
|
|
addedAt: l.addedAt.toISOString(),
|
|
})),
|
|
}),
|
|
{ signedIn: true },
|
|
)
|
|
.put(
|
|
"/library/:id",
|
|
async ({ me, params }) => {
|
|
await productCall(async () => products.add(me.id, params.id, await personAdult(me)));
|
|
realtime.notify(me.id, { type: "library" });
|
|
return { ok: true };
|
|
},
|
|
{ signedIn: true, params: productParam },
|
|
)
|
|
.delete(
|
|
"/library/:id",
|
|
async ({ me, params, set }) => {
|
|
await products.remove(me.id, params.id);
|
|
realtime.notify(me.id, { type: "library" });
|
|
set.status = 204;
|
|
},
|
|
{ signedIn: true, params: productParam },
|
|
)
|
|
.patch(
|
|
"/library/:id",
|
|
async ({ me, params, body }) => {
|
|
await productCall(() => products.stayOn(me.id, params.id, body.stayOn));
|
|
realtime.notify(me.id, { type: "library" });
|
|
return { ok: true };
|
|
},
|
|
{
|
|
signedIn: true,
|
|
params: productParam,
|
|
body: t.Object({ stayOn: t.Union([t.Integer({ minimum: 1 }), t.Null()]) }),
|
|
},
|
|
)
|
|
|
|
// Age verification beyond IMVU's: the providers in use, and the person's own checks.
|
|
.get(
|
|
"/age",
|
|
async ({ me }) => ({
|
|
providers: age.list(),
|
|
checks: (await age.personChecks(me.id)).map((c) => ({
|
|
provider: c.provider,
|
|
method: c.method,
|
|
status: c.status,
|
|
overEighteen: c.overEighteen,
|
|
createdAt: c.createdAt.toISOString(),
|
|
checkedAt: c.checkedAt?.toISOString() ?? null,
|
|
expiresAt: c.expiresAt?.toISOString() ?? null,
|
|
})),
|
|
}),
|
|
{ signedIn: true },
|
|
)
|
|
.post(
|
|
"/age/:provider/start",
|
|
async ({ me, params, body }) => {
|
|
let p;
|
|
try {
|
|
p = age.provider(params.provider);
|
|
} catch {
|
|
throw new Problem(404, "not_found", "That way of verifying age isn't available.");
|
|
}
|
|
if (p.scope !== "person") throw new Problem(400, "invalid", "That one checks an IMVU account: link it instead.");
|
|
const started = await age.start({ userId: me.id }, p.id, body.returnURL);
|
|
return started.kind === "done" ? { kind: "done" as const } : started;
|
|
},
|
|
{ signedIn: true, params: t.Object({ provider: t.String() }), body: t.Object({ returnURL: t.String({ maxLength: 500 }) }) },
|
|
)
|
|
.post(
|
|
"/age/:provider/complete",
|
|
async ({ params, body }) => {
|
|
const p = age.provider(params.provider);
|
|
if (!p.complete) throw new Problem(404, "not_found", "Not found.");
|
|
try {
|
|
const c = await age.finish(p.id, body.ref, await p.complete(body.ref, body.response));
|
|
return { status: c.status, overEighteen: c.overEighteen };
|
|
} catch (e) {
|
|
if (e instanceof AgeError) throw new Problem(404, "not_found", "That check isn't waiting for an answer.");
|
|
throw e;
|
|
}
|
|
},
|
|
{ signedIn: true, params: t.Object({ provider: t.String() }), body: t.Object({ ref: t.String(), response: t.Unknown() }) },
|
|
)
|
|
// Providers' webhooks: each checks the request is really from it.
|
|
.post(
|
|
"/age/webhook/:provider",
|
|
async ({ params, request, set }) => {
|
|
let p;
|
|
try {
|
|
p = age.provider(params.provider);
|
|
} catch {
|
|
throw new Problem(404, "not_found", "Not found.");
|
|
}
|
|
if (!p.webhook) throw new Problem(404, "not_found", "Not found.");
|
|
let answer;
|
|
try {
|
|
answer = await p.webhook(request);
|
|
} catch {
|
|
throw new Problem(401, "forbidden", "Not from the provider.");
|
|
}
|
|
try {
|
|
await age.finish(p.id, answer.ref, answer.result);
|
|
} catch (e) {
|
|
if (!(e instanceof AgeError)) throw e; // already finished: webhooks can repeat
|
|
}
|
|
set.status = 204;
|
|
},
|
|
{ params: t.Object({ provider: t.String() }), parse: "none" },
|
|
)
|
|
|
|
// The console.
|
|
.get(
|
|
"/console/catalogs",
|
|
async () => ({ catalogs: (await products.allCatalogs()).map(catalogView) }),
|
|
{ moderator: true },
|
|
)
|
|
.post(
|
|
"/console/catalogs/:id/:decision",
|
|
async ({ me, params }) => {
|
|
const c = await productCall(() =>
|
|
products.setCatalogStatus(params.id, params.decision === "approve" ? "approved" : "rejected"),
|
|
);
|
|
await audited(me.id, `catalog.${params.decision}`, c.id, { name: c.name });
|
|
return { catalog: catalogView(c) };
|
|
},
|
|
{ moderator: true, params: t.Object({ id: t.String(), decision: t.Union([t.Literal("approve"), t.Literal("reject")]) }) },
|
|
)
|
|
.get(
|
|
"/console",
|
|
async ({ me }) => {
|
|
const [counts] = await db
|
|
.select({
|
|
people: sql<number>`(select count(*) from ${user})::int`,
|
|
links: sql<number>`(select count(*) from ${imvuLink})::int`,
|
|
computers: sql<number>`(select count(*) from ${session} where ${session.userAgent} ilike 't5de-proxy%' and ${session.expiresAt} > now())::int`,
|
|
})
|
|
.from(sql`(select 1) as one`);
|
|
const log = await db
|
|
.select({ at: audit.at, actor: user.username, action: audit.action, target: audit.target, detail: audit.detail })
|
|
.from(audit)
|
|
.leftJoin(user, eq(user.id, audit.actorId))
|
|
.orderBy(desc(audit.id))
|
|
.limit(50);
|
|
return {
|
|
counts: counts!,
|
|
connections: realtime.connections(),
|
|
online: await visibleOnline(me),
|
|
audit: log.map((e) => ({ ...e, at: e.at.toISOString(), actor: e.actor ?? "" })),
|
|
};
|
|
},
|
|
{ moderator: true },
|
|
)
|
|
.get(
|
|
"/console/people",
|
|
async ({ query }) => {
|
|
const q = (query.q ?? "").trim();
|
|
const like = `%${q.replace(/[%_\\]/g, (c) => "\\" + c)}%`;
|
|
const rows = await db
|
|
.select()
|
|
.from(user)
|
|
.where(
|
|
q
|
|
? or(
|
|
ilike(user.username, like),
|
|
inArray(user.id, db.select({ id: imvuLink.userId }).from(imvuLink).where(ilike(imvuLink.username, like))),
|
|
)
|
|
: undefined,
|
|
)
|
|
.orderBy(desc(user.createdAt))
|
|
.limit(100);
|
|
return { people: rows.map(personView) };
|
|
},
|
|
{ moderator: true, query: t.Object({ q: t.Optional(t.String({ maxLength: 64 })) }) },
|
|
)
|
|
.get(
|
|
"/console/people/:id",
|
|
async ({ params }) => {
|
|
const p = await personById(params.id);
|
|
const links = await db.select().from(imvuLink).where(eq(imvuLink.userId, p.id)).orderBy(imvuLink.linkedAt);
|
|
const [computers] = await db
|
|
.select({ n: count() })
|
|
.from(session)
|
|
.where(and(eq(session.userId, p.id), ilike(session.userAgent, "t5de-proxy%"), sql`${session.expiresAt} > now()`));
|
|
return { person: personView(p), links: await linkViews(p.id, links), computers: computers?.n ?? 0 };
|
|
},
|
|
{ moderator: true },
|
|
)
|
|
.post(
|
|
"/console/people/:id/link-cap",
|
|
async ({ me, params, body }) => {
|
|
const p = await personById(params.id);
|
|
const [updated] = await db.update(user).set({ linkCap: body.linkCap }).where(eq(user.id, p.id)).returning();
|
|
await audited(me.id, "person.link_cap", p.username ?? p.id, { from: p.linkCap, to: body.linkCap });
|
|
return { person: personView(updated!) };
|
|
},
|
|
{ moderator: true, body: t.Object({ linkCap: t.Integer({ minimum: 0, maximum: 1000 }) }) },
|
|
)
|
|
.post(
|
|
"/console/people/:id/ban",
|
|
async ({ me, params, body }) => {
|
|
const p = await personById(params.id);
|
|
if (p.id === me.id) throw new Problem(400, "invalid", "You can't ban yourself.");
|
|
if (isModerator(p) && me.role !== "admin") throw new Problem(403, "forbidden", "Only admins can ban moderators.");
|
|
const [updated] = await db.update(user).set({ banned: true, banReason: body.reason }).where(eq(user.id, p.id)).returning();
|
|
await db.delete(session).where(eq(session.userId, p.id));
|
|
realtime.disconnect(p.id);
|
|
await audited(me.id, "person.ban", p.username ?? p.id, { reason: body.reason });
|
|
return { person: personView(updated!) };
|
|
},
|
|
{ moderator: true, body: t.Object({ reason: t.String({ minLength: 1, maxLength: 500 }) }) },
|
|
)
|
|
.post(
|
|
"/console/people/:id/unban",
|
|
async ({ me, params }) => {
|
|
const p = await personById(params.id);
|
|
const [updated] = await db.update(user).set({ banned: false, banReason: null }).where(eq(user.id, p.id)).returning();
|
|
await audited(me.id, "person.unban", p.username ?? p.id);
|
|
return { person: personView(updated!) };
|
|
},
|
|
{ moderator: true },
|
|
)
|
|
.post(
|
|
"/console/people/:id/role",
|
|
async ({ me, params, body }) => {
|
|
if (me.role !== "admin") throw new Problem(403, "forbidden", "Only admins can change roles.");
|
|
const p = await personById(params.id);
|
|
if (p.id === me.id) throw new Problem(400, "invalid", "Another admin has to change your role.");
|
|
const [updated] = await db.update(user).set({ role: body.role }).where(eq(user.id, p.id)).returning();
|
|
await audited(me.id, "person.role", p.username ?? p.id, { from: p.role, to: body.role });
|
|
return { person: personView(updated!) };
|
|
},
|
|
{
|
|
moderator: true,
|
|
body: t.Object({ role: t.Union([t.Literal("user"), t.Literal("moderator"), t.Literal("admin")]) }),
|
|
},
|
|
)
|
|
|
|
// T5DE's proxy: which of the IMVU accounts it's showing get the T5 badge (linked, the badge turned on, the
|
|
// person not banned). Nothing else about them.
|
|
.post(
|
|
"/badges",
|
|
async ({ me, body }) => {
|
|
if (!limiter.allow(`badges:${me.id}`, 120, 60 * 1000))
|
|
throw new Problem(429, "rate_limited", "Too many lookups. Try again in a while.");
|
|
const ids = [...new Set(body.imvuIds)];
|
|
if (ids.length === 0) return { badges: [] };
|
|
const rows = await db
|
|
.select({ imvuId: imvuLink.imvuId })
|
|
.from(imvuLink)
|
|
.innerJoin(user, eq(user.id, imvuLink.userId))
|
|
.where(and(inArray(imvuLink.imvuId, ids), eq(imvuLink.showBadge, true), sql`coalesce(${user.banned}, false) = false`));
|
|
return { badges: rows.map((r) => r.imvuId) };
|
|
},
|
|
{
|
|
signedIn: true,
|
|
body: t.Object({
|
|
imvuIds: t.Array(t.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }), { maxItems: 200 }),
|
|
}),
|
|
},
|
|
)
|
|
|
|
// T5DE's proxy: the live connection.
|
|
.ws("/realtime", {
|
|
async beforeHandle({ person, set }) {
|
|
if (!person) {
|
|
set.status = 401;
|
|
return { error: "signed_out", message: "Sign in first." };
|
|
}
|
|
},
|
|
open(ws) {
|
|
const { person } = ws.data as unknown as { person: Person };
|
|
realtime.open(
|
|
ws.id,
|
|
person.id,
|
|
() => ws.close(4001, "signed out"),
|
|
(m) => ws.send(JSON.stringify(m)),
|
|
);
|
|
ws.send(JSON.stringify({ type: "welcome" }));
|
|
},
|
|
async message(ws, message) {
|
|
const reply = await realtime.message(ws.id, message);
|
|
if (reply) ws.send(JSON.stringify(reply));
|
|
},
|
|
close(ws) {
|
|
realtime.close(ws.id);
|
|
},
|
|
});
|
|
|
|
const app = new Elysia()
|
|
.all("/api/auth/*", ({ request }) => auth.handler(request))
|
|
.get("/.well-known/jwks.json", async () => auth.api.getJwks())
|
|
.get("/.well-known/t5de-keys.json", async () => signer.jwks())
|
|
.get("/health", () => ({ ok: true }))
|
|
.use(api);
|
|
|
|
return { app, realtime, age, rooms, products, signer, hosted, decorations };
|
|
}
|
|
|
|
export type App = ReturnType<typeof createApp>["app"];
|