From fb18593ac5767779d7343731370e87a31145970b Mon Sep 17 00:00:00 2001 From: JCEEE <0xjceee@proton.me> Date: Mon, 17 Aug 2026 07:41:58 +0100 Subject: [PATCH] optimize post migration --- AGENTS.md | 6 ++-- MEMORY.md | 2 +- TODO.md | 13 ++++++++ frontend/src/lib/client/api.ts | 21 ++++++------ frontend/src/lib/server/member-otp.ts | 14 ++++---- frontend/src/lib/server/migrate.ts | 19 ++++++----- frontend/src/lib/server/pocketbase.ts | 2 +- frontend/src/lib/server/routeAuth.ts | 28 ---------------- .../src/routes/[fam]/[username]/+page.svelte | 32 ++++++++----------- .../admin/[famId]/assigned-chores/+server.ts | 14 ++++---- .../[famId]/assigned-chores/[id]/+server.ts | 14 ++++---- frontend/src/routes/api/chat/+server.ts | 20 ++++++------ .../routes/api/completions/toggle/+server.ts | 12 ++++--- .../routes/api/fam/[famId]/payday/+server.ts | 12 ++++--- frontend/src/routes/api/members/+server.ts | 17 ++++++++++ frontend/src/routes/api/members/me/+server.ts | 15 --------- .../api/members/rewards/[id]/claim/+server.ts | 12 ++++--- 17 files changed, 121 insertions(+), 132 deletions(-) create mode 100644 TODO.md delete mode 100644 frontend/src/lib/server/routeAuth.ts create mode 100644 frontend/src/routes/api/members/+server.ts delete mode 100644 frontend/src/routes/api/members/me/+server.ts diff --git a/AGENTS.md b/AGENTS.md index f82f862..786c875 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -25,7 +25,7 @@ | Superuser | PB `_superusers` (server-side only, `pb-admin`) | — | — | - **Admins** (parents) are `users` records (role `parent`). They authenticate via email/password login, get an httpOnly `pb_token` cookie with `{ id, name, username, role: "parent", famId, color }`. -- **Members** (children) are `users` records (role `child`); PB `username` = `{famSlug}:{handle}` (globally-unique auth identity; `handle` = whitespace-free lowercase name), URL segment = `handleOf(username)`, `name` = display name. Their PB password is **derived** server-side (`MEMBER_SECRET + famSlug + handle`); access is gated by a 20-min OTP in `user_configs`, then `authWithPassword`. They get the same httpOnly `pb_token` cookie. There is **no `members` collection**. +- **Members** (children) are `users` records (role `child`); PB `username` = `{famSlug}:{handle}` (globally-unique auth identity; `handle` = whitespace-free lowercase name), URL segment = `handleOf(username)`, `name` = display name. Their PB password is **derived** server-side (`MEMBER_SECRET + famSlug + handle`); access is gated by a 20-min OTP in `otp`, then `authWithPassword`. They get the same httpOnly `pb_token` cookie. There is **no `members` collection**. - **Platform superuser** (`_superusers`) used only server-side by `pb-admin.ts` for cross-family queries (e.g. `/admin` stats dashboard) and OTP/signup writes. Not an app role. - The layout (`[fam]/+layout.server.ts`) derives `isParent` and `role` centrally from the session — child pages use `page.data.isParent` or `page.data.role` from `$app/state`. - Because `pb_token` is httpOnly, the browser PB SDK is seeded from `page.data.pbToken` via `initPb(token)` in the layout `onMount` (not `document.cookie`). @@ -33,7 +33,7 @@ ## PB Collections (all scoped by `famId`; child/member = `users` row) - `users` — auth collection; famId, role (`parent`|`child`), username (`{famSlug}:{handle}`), name, color, email (admin only) -- `user_configs` — famId, userId, otp, colour, updatedAt (OTP gate for child join) +- `otp` — famId, userId, otp, updatedAt (OTP gate for child join; display colour lives on `users.color`) - `fams` — name, slug, stripeCustomerId, featureFlags - `chore_templates` — famId, name, defaultValue, defaultFrequency - `assigned_chores` — famId, userId, templateId, frequency, value @@ -197,7 +197,7 @@ All admin and member pages use the following pattern: - Every collection query includes `famId = @request.auth.famId` filter - Super admin bypasses famId filter (access via PB admin API) -- Child PB passwords are derived (`MEMBER_SECRET + famSlug + username`); the child join gate is a transient OTP in `user_configs`. No device tokens. Never log raw tokens/secrets. +- Child PB passwords are derived (`MEMBER_SECRET + famSlug + username`); the child join gate is a transient OTP in `otp`. No device tokens. Never log raw tokens/secrets. - **Admin → Proxy**: `hono.admin.*` in `$lib/server/hono.ts` — uses `sessionHeaders(event)` (server-side only, requires `RequestEvent`) - **Member → Proxy (server)**: `memberApi.*` in `$lib/client/api.ts` — use inside `+page.server.ts` load/actions; `BASE_URL` resolves to Hono port on server - **Member → Proxy (browser)**: `memberApi.*` in `$lib/client/api.ts` — use inside `+page.svelte`; `BASE_URL` is empty, Vite proxies `/api/*` to Hono diff --git a/MEMORY.md b/MEMORY.md index 9bc4e2c..fca4786 100644 --- a/MEMORY.md +++ b/MEMORY.md @@ -3,7 +3,7 @@ ## 2026-08-17 — Hono proxy removed: everything runs in SvelteKit services - **Decision**: deleted the `proxy/` Hono service entirely. All business logic (admin CRUD, member kanban, weekly summary/EOW, bonus evaluation/trigger/progress, rewards claim/issue, chat, payday settlement, debug data-gen) now lives in `frontend/src/lib/server/services/`, grouped **by app area** (not by role): `fam.ts`, `chores.ts`, `completions.ts`, `rewards.ts`, `bonuses.ts`, `chat.ts`, `settings.ts`, `crud.ts`, `debug.ts`, plus a generic per-resource `crud.ts`. `createServices(pb, user)` returns a per-feature binder; `servicesFor(event)` is the shorthand for loads/form actions. **No role guard** — PB collection rules on the acting user's token are the security boundary (the `admin`/`member` split no longer exists as separate files). -- **Wiring**: `hono.admin.*` (form actions/loads) and `memberApi.*`/chat are now direct service calls or SvelteKit `/api/*` routes (`completions/toggle`, `members/rewards/[id]/claim`, `members/me`, `fam/[famId]/payday`, `chat`, `admin/[famId]/assigned-chores`). Browser admin calls (chores grid) hit SvelteKit `/api/admin/*`. `routeAuth.actingClient(event)` resolves the acting user's PB client from the Bearer header or the `pb_token` cookie. +- **Wiring**: `hono.admin.*` (form actions/loads) and `memberApi.*`/chat are now direct service calls or SvelteKit `/api/*` routes (`completions/toggle`, `members/rewards/[id]/claim`, `members`, `fam/[famId]/payday`, `chat`, `admin/[famId]/assigned-chores`). Browser admin calls (chores grid) hit SvelteKit `/api/admin/*`. The `/api/*` routes read auth straight from `event.locals` (`locals.user` + `createPbClient(locals.pbToken)`) — a separate `actingClient` helper was dropped as redundant since `hooks.server.ts` already resolves the session. No Authorization header; the httpOnly `pb_token` cookie is the auth for same-origin calls. - **Migration relocated**: `proxy/src/migrate.ts` → `frontend/src/lib/server/migrate.ts` (env now via `$app/env/private` + `PB_ENDPOINT` from `pocketbase.ts`), run once per process by `migrate-boot.ts`, kicked off in `hooks.server.ts` (`void migrateOnBoot()`). Schema source of truth remains `shared/pb/schema.ts`. - **Infra**: `pnpm-workspace.yaml` (only `frontend`), root `package.json` (`dev` = `pnpm --filter frontend dev`), `docker/Dockerfile` (no proxy build/deploy), `docker/entrypoint.sh` (no proxy start; app runs schema migration on boot), `docker/nginx.conf` (`/api/` block removed → falls through to `location /` → SvelteKit `:3000`; `/pb/api/` unchanged). Removed `PROXY_URL` env + `PROXY_PORT` from `shared/config.ts` and `frontend/src/env.ts`. Dead `memberApi.myChores`/`requestAll` removed. - **Typecheck**: frontend `svelte-check` = 12 pre-existing canary errors (`.svelte` implicit-any, qrcode decl, RewardType/Frequency casts, signup `string|undefined`); **zero errors in the migration's files**. `pnpm build` (adapter-node) succeeds. diff --git a/TODO.md b/TODO.md new file mode 100644 index 0000000..b4e77cb --- /dev/null +++ b/TODO.md @@ -0,0 +1,13 @@ +Items: + +- The hono workhorse - see notes later + +## the hono workhorse + +**Actively used (the workhorse):** + +- **Admin reads/writes** via `hono.admin.*` — used heavily by the child kanban (`+page.server.ts` load: members, chore-templates, assigned-chores, weekly-summary, fam, rewards, bonus-configs, completions, settings), the **bonuses** page (17 calls), **ledger** (6), **preferences** (2), **fam dashboard** (4), plus settings `complete-week` and `debug/generate-data`. +- **Member actions** via `memberApi.*` + direct `/api` fetches — `toggleCompletion`, `claimReward`, `payday`, `/api/members/me`, `/api/members/my-chores` (both SSR and browser). +- **Direct client calls** — the chores page hits `/api/admin/:famId/assigned-chores` directly; the kanban hits `/api/members/me`. + +We will tackle this as the next feature `feature/migrate-hono-to-kit` diff --git a/frontend/src/lib/client/api.ts b/frontend/src/lib/client/api.ts index 0f90c67..8486269 100644 --- a/frontend/src/lib/client/api.ts +++ b/frontend/src/lib/client/api.ts @@ -1,16 +1,13 @@ -// Client-only. All /api calls go same-origin (SvelteKit in dev and prod). +// Client-only. All /api calls go same-origin (SvelteKit in dev and prod); +// auth rides on the httpOnly `pb_token` cookie, so no token/header needed. const BASE_URL = ''; async function memberFetch( method: string, path: string, - token: string, - _famId?: string, body?: unknown, ): Promise { - const headers: Record = { - Authorization: `Bearer ${token}`, - }; + const headers: Record = {}; if (body !== undefined) headers['Content-Type'] = 'application/json'; const res = await fetch(`${BASE_URL}${path}`, { method, @@ -23,13 +20,13 @@ async function memberFetch( } export const memberApi = { - async toggleCompletion(token: string, famId: string, assignedChoreId: string, date: string) { - return memberFetch('POST', '/api/completions/toggle', token, famId, { assignedChoreId, date }); + async toggleCompletion(famId: string, assignedChoreId: string, date: string) { + return memberFetch('POST', '/api/completions/toggle', { assignedChoreId, date }); }, - async claimReward(token: string, famId: string, rewardId: string) { - return memberFetch('POST', `/api/members/rewards/${rewardId}/claim`, token, famId); + async claimReward(famId: string, rewardId: string) { + return memberFetch('POST', `/api/members/rewards/${rewardId}/claim`); }, - async payday(token: string, famId: string) { - return memberFetch('POST', `/api/fam/${famId}/payday`, token, famId); + async payday(famId: string) { + return memberFetch('POST', `/api/fam/${famId}/payday`); }, }; \ No newline at end of file diff --git a/frontend/src/lib/server/member-otp.ts b/frontend/src/lib/server/member-otp.ts index a3cc112..6e6fc83 100644 --- a/frontend/src/lib/server/member-otp.ts +++ b/frontend/src/lib/server/member-otp.ts @@ -59,7 +59,7 @@ export async function createChild(opts: { } // Admin grants access to a child: creates the users auth record (or re-issues -// OTP if they already exist) + upserts their user_configs. Returns the OTP and +// OTP if they already exist) + upserts their otp. Returns the OTP and // shareable join link (using the whitespace-free handle) for QR display. export async function issueAccess(opts: { famId: string; @@ -67,23 +67,23 @@ export async function issueAccess(opts: { name: string; colour?: string; }) { - const { famId, famSlug, name, colour } = opts; + const { famId, famSlug, name } = opts; const username = handle(name); const otp = generateOtp(); const updatedAt = new Date().toISOString(); - const user = await createChild({ famId, famSlug, name, colour }); + const user = await createChild({ famId, famSlug, name, colour: opts.colour }); const pb = await createSuperClient(); let config = await pb - .collection('user_configs') + .collection('otp') .getFirstListItem(`famId='${famId}' && userId='${user.id}'`) .catch(() => null); if (config) { - await pb.collection('user_configs').update(config.id, { otp, colour, updatedAt }); + await pb.collection('otp').update(config.id, { otp, updatedAt }); } else { - await pb.collection('user_configs').create({ famId, userId: user.id, otp, colour, updatedAt }); + await pb.collection('otp').create({ famId, userId: user.id, otp, updatedAt }); } return { otp, joinUrl: `/${famSlug}/join/${encodeURIComponent(username)}` }; @@ -109,7 +109,7 @@ export async function redeemOtp(opts: { famSlug: string; username: string; otp: if (!user || user.role !== 'child') throw new Error('Invalid join link'); let config = await pb - .collection('user_configs') + .collection('otp') .getFirstListItem(`famId='${fam.id}' && userId='${user.id}'`) .catch(() => null); if (!config || config.otp !== otp) throw new Error('Invalid code'); diff --git a/frontend/src/lib/server/migrate.ts b/frontend/src/lib/server/migrate.ts index 145ea21..1020f7e 100644 --- a/frontend/src/lib/server/migrate.ts +++ b/frontend/src/lib/server/migrate.ts @@ -1752,21 +1752,21 @@ export async function migrate(): Promise { } } - // ── 30. user_configs: identity + OTP store (superuser-only) ── - // Holds the rotating one-time code, colour, and the OTP-issue timestamp used - // for the 20-minute window. Sensitive (OTPs) → not public; read/written via + // ── 30. otp: OTP store (superuser-only) ── + // Holds the rotating one-time code and the OTP-issue timestamp used for the + // 20-minute join window. Sensitive (OTPs) → not public; read/written via // createSuperClient in SvelteKit. `created`/`updated` are PB built-ins; the // manual `updatedAt` is written ONLY on OTP (re)issue so the window stays - // accurate (colour edits must not bump it). userId links to the users auth - // record so each child's config is uniquely addressable. + // accurate. userId links to the users auth record so each child's config is + // uniquely addressable. (Display colour lives on users.color, not here.) { - if (!(await getCollection("user_configs"))) { + if (!(await getCollection("otp"))) { const famsCol = await getCollection("fams"); const usersCol = await getCollection("users"); if (!famsCol || !usersCol) throw new Error("fams/users collection not found"); - console.log("[migrate] Creating user_configs collection..."); + console.log("[migrate] Creating otp collection..."); await createCollection({ - name: "user_configs", + name: "otp", type: "base", listRule: null, viewRule: null, @@ -1791,12 +1791,11 @@ export async function migrate(): Promise { cascadeDelete: false, }, { name: "otp", type: "text", required: false }, - { name: "colour", type: "text", required: false }, { name: "updatedAt", type: "text", required: false }, ], }); } else { - console.log(" ↳ user_configs already exists"); + console.log(" ↳ otp already exists"); } } diff --git a/frontend/src/lib/server/pocketbase.ts b/frontend/src/lib/server/pocketbase.ts index 09d4543..fe7e44f 100644 --- a/frontend/src/lib/server/pocketbase.ts +++ b/frontend/src/lib/server/pocketbase.ts @@ -26,7 +26,7 @@ export function pbUser(event: RequestEvent) { // Superuser PB client (memoized). Reserved for server-only privileged // operations that must bypass collection rules: creating child users, minting -// OTP-login tokens, and verifying OTPs against the superuser-only user_configs. +// OTP-login tokens, and verifying OTPs against the superuser-only otp. let superClient: PocketBase | null = null; export async function createSuperClient() { if (superClient) return superClient; diff --git a/frontend/src/lib/server/routeAuth.ts b/frontend/src/lib/server/routeAuth.ts deleted file mode 100644 index 0b6cee2..0000000 --- a/frontend/src/lib/server/routeAuth.ts +++ /dev/null @@ -1,28 +0,0 @@ -import { error } from '@sveltejs/kit'; -import { createPbClient } from '$lib/server/pocketbase'; -import type { RequestEvent } from '@sveltejs/kit'; - -// Resolve the acting user's PB client from a request: prefer the Authorization -// Bearer token (sent by the browser member API), else the httpOnly session -// cookie. Identity comes from the verified session. Used by the in-app /api/* -// routes that replaced the Hono member endpoints. -export function actingClient(event: RequestEvent) { - const token = - event.request.headers.get('authorization')?.replace(/^Bearer\s+/i, '') || - event.locals.pbToken || - ''; - const u = event.locals.user; - if (!u || !token) throw error(401, 'Unauthorized'); - return { - pb: createPbClient(token), - famId: u.famId, - userId: u.id, - role: u.role, - name: u.name || '', - color: u.color || '#6366f1' - }; -} - -export function err(e: unknown) { - return error(500, e instanceof Error ? e.message : 'Internal error'); -} \ No newline at end of file diff --git a/frontend/src/routes/[fam]/[username]/+page.svelte b/frontend/src/routes/[fam]/[username]/+page.svelte index 9fc9eb9..20ed820 100644 --- a/frontend/src/routes/[fam]/[username]/+page.svelte +++ b/frontend/src/routes/[fam]/[username]/+page.svelte @@ -212,7 +212,7 @@ if (secondsLeft > 0 || eowFired) return; if (!pbToken || !famId) return; eowFired = true; - memberApi.payday(pbToken, famId).catch(() => {}); + memberApi.payday(famId).catch(() => {}); }); function paydayWeekStart(): string { @@ -546,7 +546,7 @@ } try { - await memberApi.toggleCompletion(pbToken, famId, chore.id, todayChild); + await memberApi.toggleCompletion(famId, chore.id, todayChild); const optimistic = completions.find((c) => c.id === 'optimistic-' + chore.id); if (optimistic) { famStore.applyRecord('completions', optimistic, 'delete'); @@ -960,14 +960,11 @@ const old = memberName; memberName = nameInput; try { - const res = await fetch('/api/members/me', { - method: 'PATCH', - headers: { - 'Content-Type': 'application/json', - Authorization: `Bearer ${pbToken}` - }, - body: JSON.stringify({ name: nameInput }) - }); +const res = await fetch('/api/members', { + method: 'PATCH', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ name: nameInput }) + }); if (!res.ok) memberName = old; } catch { memberName = old; @@ -1022,14 +1019,11 @@ memberColor = color; showColorPicker = false; try { - const res = await fetch('/api/members/me', { - method: 'PATCH', - headers: { - 'Content-Type': 'application/json', - Authorization: `Bearer ${pbToken}` - }, - body: JSON.stringify({ color }) - }); +const res = await fetch('/api/members', { + method: 'PATCH', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ color }) + }); if (!res.ok) memberColor = old; } catch { memberColor = old; @@ -1253,7 +1247,7 @@ class="wr-cta" onclick={async () => { try { - await memberApi.claimReward(pbToken, famId, r.id); + await memberApi.claimReward(famId, r.id); } catch (e) { claimError = e instanceof Error ? e.message : 'Claim failed'; } diff --git a/frontend/src/routes/api/admin/[famId]/assigned-chores/+server.ts b/frontend/src/routes/api/admin/[famId]/assigned-chores/+server.ts index 05d6af3..8c616b2 100644 --- a/frontend/src/routes/api/admin/[famId]/assigned-chores/+server.ts +++ b/frontend/src/routes/api/admin/[famId]/assigned-chores/+server.ts @@ -1,17 +1,19 @@ -import { json } from '@sveltejs/kit'; +import { json, error } from '@sveltejs/kit'; import type { RequestEvent } from '@sveltejs/kit'; -import { actingClient } from '$lib/server/routeAuth'; +import { createPbClient } from '$lib/server/pocketbase'; import { createServices } from '$lib/server/services'; export async function POST(event: RequestEvent) { - const { pb, famId, userId, role } = actingClient(event); - if (famId !== event.params.famId) { + const u = event.locals.user; + if (!u || !event.locals.pbToken) throw error(401, 'Unauthorized'); + const pb = createPbClient(event.locals.pbToken); + if (u.famId !== event.params.famId) { return json({ error: 'famId mismatch' }, { status: 403 }); } const body = await event.request.json().catch(() => ({})); try { - const s = createServices(pb, { id: userId, role }); - const record = await s.crud.create('assigned-chores', famId, body); + const s = createServices(pb, { id: u.id, role: u.role }); + const record = await s.crud.create('assigned-chores', u.famId, body); return json(record); } catch (e) { return json({ error: e instanceof Error ? e.message : 'create failed' }, { status: 400 }); diff --git a/frontend/src/routes/api/admin/[famId]/assigned-chores/[id]/+server.ts b/frontend/src/routes/api/admin/[famId]/assigned-chores/[id]/+server.ts index 31943a3..8da7ce4 100644 --- a/frontend/src/routes/api/admin/[famId]/assigned-chores/[id]/+server.ts +++ b/frontend/src/routes/api/admin/[famId]/assigned-chores/[id]/+server.ts @@ -1,17 +1,19 @@ -import { json } from '@sveltejs/kit'; +import { json, error } from '@sveltejs/kit'; import type { RequestEvent } from '@sveltejs/kit'; -import { actingClient } from '$lib/server/routeAuth'; +import { createPbClient } from '$lib/server/pocketbase'; import { createServices } from '$lib/server/services'; export async function DELETE(event: RequestEvent) { - const { pb, famId, userId, role } = actingClient(event); - if (famId !== event.params.famId) { + const u = event.locals.user; + if (!u || !event.locals.pbToken) throw error(401, 'Unauthorized'); + const pb = createPbClient(event.locals.pbToken); + if (u.famId !== event.params.famId) { return json({ error: 'famId mismatch' }, { status: 403 }); } const id = event.params.id!; try { - const s = createServices(pb, { id: userId, role }); - await s.crud.remove('assigned-chores', famId, id); + const s = createServices(pb, { id: u.id, role: u.role }); + await s.crud.remove('assigned-chores', u.famId, id); return json({ ok: true }); } catch (e) { return json({ error: e instanceof Error ? e.message : 'delete failed' }, { status: 400 }); diff --git a/frontend/src/routes/api/chat/+server.ts b/frontend/src/routes/api/chat/+server.ts index ae5134a..bb0af43 100644 --- a/frontend/src/routes/api/chat/+server.ts +++ b/frontend/src/routes/api/chat/+server.ts @@ -1,5 +1,5 @@ -import { json } from '@sveltejs/kit'; -import { actingClient } from '$lib/server/routeAuth'; +import { json, error } from '@sveltejs/kit'; +import { createPbClient } from '$lib/server/pocketbase'; import { createServices, type ChatActor } from '$lib/server/services'; import type { RequestEvent } from '@sveltejs/kit'; @@ -15,18 +15,20 @@ export async function POST(event: RequestEvent) { const body = (await event.request.json().catch(() => null)) as Body | null; if (!body || !body.action) return json({ error: 'missing action' }, { status: 400 }); - const { pb, famId: sessionFamId, userId, role, name, color } = actingClient(event); + const u = event.locals.user; + if (!u || !event.locals.pbToken) throw error(401, 'Unauthorized'); + const pb = createPbClient(event.locals.pbToken); const actor: ChatActor = { - id: userId, - type: role === 'parent' ? 'admin' : 'member', - name, - color + id: u.id, + type: u.role === 'parent' ? 'admin' : 'member', + name: u.name, + color: u.color || '#6366f1' }; - const famId = body.famId || sessionFamId || ''; + const famId = body.famId || u.famId || ''; if (!famId) return json({ error: 'famId required' }, { status: 400 }); try { - const s = createServices(pb, { id: userId, role }); + const s = createServices(pb, { id: u.id, role: u.role }); const data = body.action === 'typing' ? await s.chat.typing(famId, actor, { typing: Boolean(body.typing) }) diff --git a/frontend/src/routes/api/completions/toggle/+server.ts b/frontend/src/routes/api/completions/toggle/+server.ts index 4bc2165..0b1fe7e 100644 --- a/frontend/src/routes/api/completions/toggle/+server.ts +++ b/frontend/src/routes/api/completions/toggle/+server.ts @@ -1,14 +1,16 @@ -import { json } from '@sveltejs/kit'; +import { json, error } from '@sveltejs/kit'; import type { RequestEvent } from '@sveltejs/kit'; -import { actingClient } from '$lib/server/routeAuth'; +import { createPbClient } from '$lib/server/pocketbase'; import { createServices } from '$lib/server/services'; export async function POST(event: RequestEvent) { - const { pb, famId, userId, role } = actingClient(event); + const u = event.locals.user; + if (!u || !event.locals.pbToken) throw error(401, 'Unauthorized'); + const pb = createPbClient(event.locals.pbToken); const body = await event.request.json().catch(() => ({})); try { - const s = createServices(pb, { id: userId, role }); - return json(await s.completions.toggle(famId, body)); + const s = createServices(pb, { id: u.id, role: u.role }); + return json(await s.completions.toggle(u.famId, body)); } catch (e) { return json({ error: e instanceof Error ? e.message : 'toggle failed' }, { status: 400 }); } diff --git a/frontend/src/routes/api/fam/[famId]/payday/+server.ts b/frontend/src/routes/api/fam/[famId]/payday/+server.ts index 7e4f530..763b88d 100644 --- a/frontend/src/routes/api/fam/[famId]/payday/+server.ts +++ b/frontend/src/routes/api/fam/[famId]/payday/+server.ts @@ -1,13 +1,15 @@ -import { json } from '@sveltejs/kit'; +import { json, error } from '@sveltejs/kit'; import type { RequestEvent } from '@sveltejs/kit'; -import { actingClient } from '$lib/server/routeAuth'; +import { createPbClient } from '$lib/server/pocketbase'; import { createServices } from '$lib/server/services'; export async function POST(event: RequestEvent) { - const { pb, famId, userId, role } = actingClient(event); + const u = event.locals.user; + if (!u || !event.locals.pbToken) throw error(401, 'Unauthorized'); + const pb = createPbClient(event.locals.pbToken); try { - const s = createServices(pb, { id: userId, role }); - return json(await s.fam.payday(famId)); + const s = createServices(pb, { id: u.id, role: u.role }); + return json(await s.fam.payday(u.famId)); } catch (e) { return json({ error: e instanceof Error ? e.message : 'payday failed' }, { status: 400 }); } diff --git a/frontend/src/routes/api/members/+server.ts b/frontend/src/routes/api/members/+server.ts new file mode 100644 index 0000000..19e020b --- /dev/null +++ b/frontend/src/routes/api/members/+server.ts @@ -0,0 +1,17 @@ +import { json, error } from '@sveltejs/kit'; +import type { RequestEvent } from '@sveltejs/kit'; +import { createPbClient } from '$lib/server/pocketbase'; +import { createServices } from '$lib/server/services'; + +export async function PATCH(event: RequestEvent) { + const u = event.locals.user; + if (!u || !event.locals.pbToken) throw error(401, 'Unauthorized'); + const pb = createPbClient(event.locals.pbToken); + const body = await event.request.json().catch(() => ({})); + try { + const s = createServices(pb, { id: u.id, role: u.role }); + return json(await s.fam.updateProfile(u.famId, body)); + } catch (e) { + return json({ error: e instanceof Error ? e.message : 'update failed' }, { status: 400 }); + } +} \ No newline at end of file diff --git a/frontend/src/routes/api/members/me/+server.ts b/frontend/src/routes/api/members/me/+server.ts deleted file mode 100644 index b0ae416..0000000 --- a/frontend/src/routes/api/members/me/+server.ts +++ /dev/null @@ -1,15 +0,0 @@ -import { json } from '@sveltejs/kit'; -import type { RequestEvent } from '@sveltejs/kit'; -import { actingClient } from '$lib/server/routeAuth'; -import { createServices } from '$lib/server/services'; - -export async function PATCH(event: RequestEvent) { - const { pb, famId, userId, role } = actingClient(event); - const body = await event.request.json().catch(() => ({})); - try { - const s = createServices(pb, { id: userId, role }); - return json(await s.fam.updateProfile(famId, body)); - } catch (e) { - return json({ error: e instanceof Error ? e.message : 'update failed' }, { status: 400 }); - } -} \ No newline at end of file diff --git a/frontend/src/routes/api/members/rewards/[id]/claim/+server.ts b/frontend/src/routes/api/members/rewards/[id]/claim/+server.ts index de72fb0..d22d6d9 100644 --- a/frontend/src/routes/api/members/rewards/[id]/claim/+server.ts +++ b/frontend/src/routes/api/members/rewards/[id]/claim/+server.ts @@ -1,14 +1,16 @@ -import { json } from '@sveltejs/kit'; +import { json, error } from '@sveltejs/kit'; import type { RequestEvent } from '@sveltejs/kit'; -import { actingClient } from '$lib/server/routeAuth'; +import { createPbClient } from '$lib/server/pocketbase'; import { createServices } from '$lib/server/services'; export async function POST(event: RequestEvent) { - const { pb, famId, userId, role } = actingClient(event); + const u = event.locals.user; + if (!u || !event.locals.pbToken) throw error(401, 'Unauthorized'); + const pb = createPbClient(event.locals.pbToken); const id = event.params.id!; try { - const s = createServices(pb, { id: userId, role }); - return json(await s.rewards.claim(famId, id)); + const s = createServices(pb, { id: u.id, role: u.role }); + return json(await s.rewards.claim(u.famId, id)); } catch (e) { return json({ error: e instanceof Error ? e.message : 'claim failed' }, { status: 400 }); }