refactor(api): extract user procedures

2026-03-31 21:40:50 +02:00
parent e34c22f3b0
commit 9fccd4c29e
4 changed files with 1098 additions and 661 deletions
@@ -0,0 +1,272 @@
+import { Prisma } from "@capakraken/db";
+import {
+  dashboardLayoutSchema,
+  normalizeDashboardLayout,
+} from "@capakraken/shared/schemas";
+import type { ColumnPreferences } from "@capakraken/shared/types";
+import { TRPCError } from "@trpc/server";
+import { z } from "zod";
+import { findUniqueOrThrow } from "../db/helpers.js";
+import { createAuditEntry } from "../lib/audit.js";
+import type { TRPCContext } from "../trpc.js";
+
+export const SaveDashboardLayoutInputSchema = z.object({
+  layout: dashboardLayoutSchema,
+});
+
+export const ToggleFavoriteProjectInputSchema = z.object({
+  projectId: z.string(),
+});
+
+export const SetColumnPreferencesInputSchema = z.object({
+  view: z.enum(["resources", "projects", "allocations", "vacations", "roles", "users", "blueprints"]),
+  visible: z.array(z.string()).optional(),
+  sort: z.object({ field: z.string(), dir: z.enum(["asc", "desc"]) }).nullable().optional(),
+  rowOrder: z.array(z.string()).nullable().optional(),
+});
+
+export const VerifyAndEnableTotpInputSchema = z.object({
+  token: z.string().length(6),
+});
+
+export const VerifyTotpInputSchema = z.object({
+  userId: z.string(),
+  token: z.string().length(6),
+});
+
+type UserSelfServiceContext = Pick<TRPCContext, "db" | "dbUser" | "session">;
+type UserPublicContext = Pick<TRPCContext, "db">;
+
+export async function getCurrentUserProfile(ctx: UserSelfServiceContext) {
+  return findUniqueOrThrow(
+    ctx.db.user.findUnique({
+      where: { id: ctx.dbUser!.id },
+      select: {
+        id: true,
+        name: true,
+        email: true,
+        systemRole: true,
+        permissionOverrides: true,
+        createdAt: true,
+      },
+    }),
+    "User",
+  );
+}
+
+export async function getDashboardLayout(ctx: UserSelfServiceContext) {
+  const user = await ctx.db.user.findUnique({
+    where: { id: ctx.dbUser!.id },
+    select: { dashboardLayout: true, updatedAt: true },
+  });
+
+  return {
+    layout: user?.dashboardLayout ? normalizeDashboardLayout(user.dashboardLayout) : null,
+    updatedAt: user?.updatedAt ?? null,
+  };
+}
+
+export async function saveDashboardLayout(
+  ctx: UserSelfServiceContext,
+  input: z.infer<typeof SaveDashboardLayoutInputSchema>,
+) {
+  const updated = await ctx.db.user.update({
+    where: { id: ctx.dbUser!.id },
+    data: { dashboardLayout: input.layout as unknown as Prisma.InputJsonValue },
+    select: { updatedAt: true },
+  });
+
+  return { updatedAt: updated.updatedAt };
+}
+
+export async function getFavoriteProjectIds(ctx: UserSelfServiceContext) {
+  const user = await ctx.db.user.findUnique({
+    where: { id: ctx.dbUser!.id },
+    select: { favoriteProjectIds: true },
+  });
+
+  return ((user?.favoriteProjectIds as string[] | null) ?? []) as string[];
+}
+
+export async function toggleFavoriteProject(
+  ctx: UserSelfServiceContext,
+  input: z.infer<typeof ToggleFavoriteProjectInputSchema>,
+) {
+  const user = await ctx.db.user.findUnique({
+    where: { id: ctx.dbUser!.id },
+    select: { favoriteProjectIds: true },
+  });
+  const current = ((user?.favoriteProjectIds as string[] | null) ?? []) as string[];
+  const next = current.includes(input.projectId)
+    ? current.filter((id) => id !== input.projectId)
+    : [...current, input.projectId];
+
+  await ctx.db.user.update({
+    where: { id: ctx.dbUser!.id },
+    data: { favoriteProjectIds: next as unknown as Prisma.InputJsonValue },
+  });
+
+  return { favoriteProjectIds: next, added: !current.includes(input.projectId) };
+}
+
+export async function getColumnPreferences(ctx: UserSelfServiceContext) {
+  const user = await ctx.db.user.findUnique({
+    where: { id: ctx.dbUser!.id },
+    select: { columnPreferences: true },
+  });
+
+  return (user?.columnPreferences ?? {}) as ColumnPreferences;
+}
+
+export async function setColumnPreferences(
+  ctx: UserSelfServiceContext,
+  input: z.infer<typeof SetColumnPreferencesInputSchema>,
+) {
+  const existing = await ctx.db.user.findUnique({
+    where: { id: ctx.dbUser!.id },
+    select: { columnPreferences: true },
+  });
+  const prefs = (existing?.columnPreferences ?? {}) as ColumnPreferences;
+  const prev = (prefs[input.view] as import("@capakraken/shared").ViewPreferences | undefined) ?? { visible: [] };
+
+  const merged: import("@capakraken/shared").ViewPreferences = {
+    visible: input.visible ?? prev.visible,
+  };
+  if (input.sort !== null && input.sort !== undefined) {
+    merged.sort = input.sort;
+  } else if (input.sort === undefined && prev.sort != null) {
+    merged.sort = prev.sort;
+  }
+  if (input.rowOrder !== null && input.rowOrder !== undefined) {
+    merged.rowOrder = input.rowOrder;
+  } else if (input.rowOrder === undefined && prev.rowOrder != null) {
+    merged.rowOrder = prev.rowOrder;
+  }
+
+  prefs[input.view] = merged;
+  await ctx.db.user.update({
+    where: { id: ctx.dbUser!.id },
+    data: { columnPreferences: prefs as Prisma.InputJsonValue },
+  });
+
+  return { ok: true };
+}
+
+export async function generateTotpSecret(ctx: UserSelfServiceContext) {
+  const { TOTP, Secret } = await import("otpauth");
+  const secret = new Secret({ size: 20 });
+  const totp = new TOTP({
+    issuer: "CapaKraken",
+    label: ctx.session.user?.email ?? ctx.dbUser!.id,
+    algorithm: "SHA1",
+    digits: 6,
+    period: 30,
+    secret,
+  });
+
+  await ctx.db.user.update({
+    where: { id: ctx.dbUser!.id },
+    data: { totpSecret: secret.base32 },
+  });
+
+  return { secret: secret.base32, uri: totp.toString() };
+}
+
+export async function verifyAndEnableTotp(
+  ctx: UserSelfServiceContext,
+  input: z.infer<typeof VerifyAndEnableTotpInputSchema>,
+) {
+  const user = await findUniqueOrThrow(
+    ctx.db.user.findUnique({
+      where: { id: ctx.dbUser!.id },
+      select: { id: true, name: true, email: true, totpSecret: true, totpEnabled: true },
+    }),
+    "User",
+  );
+
+  if (!user.totpSecret) {
+    throw new TRPCError({ code: "BAD_REQUEST", message: "No TOTP secret generated. Call generateTotpSecret first." });
+  }
+  if (user.totpEnabled) {
+    throw new TRPCError({ code: "BAD_REQUEST", message: "TOTP is already enabled." });
+  }
+
+  const { TOTP, Secret } = await import("otpauth");
+  const totp = new TOTP({
+    issuer: "CapaKraken",
+    label: user.email,
+    algorithm: "SHA1",
+    digits: 6,
+    period: 30,
+    secret: Secret.fromBase32(user.totpSecret),
+  });
+
+  const delta = totp.validate({ token: input.token, window: 1 });
+  if (delta === null) {
+    throw new TRPCError({ code: "BAD_REQUEST", message: "Invalid TOTP token." });
+  }
+
+  await ctx.db.user.update({
+    where: { id: user.id },
+    data: { totpEnabled: true },
+  });
+
+  void createAuditEntry({
+    db: ctx.db,
+    entityType: "User",
+    entityId: user.id,
+    entityName: `${user.name} (${user.email})`,
+    action: "UPDATE",
+    userId: user.id,
+    source: "ui",
+    summary: "Enabled TOTP MFA",
+  });
+
+  return { enabled: true };
+}
+
+export async function verifyTotp(
+  ctx: UserPublicContext,
+  input: z.infer<typeof VerifyTotpInputSchema>,
+) {
+  const user = await findUniqueOrThrow(
+    ctx.db.user.findUnique({
+      where: { id: input.userId },
+      select: { id: true, totpSecret: true, totpEnabled: true },
+    }),
+    "User",
+  );
+
+  if (!user.totpEnabled || !user.totpSecret) {
+    throw new TRPCError({ code: "BAD_REQUEST", message: "TOTP is not enabled for this user." });
+  }
+
+  const { TOTP, Secret } = await import("otpauth");
+  const totp = new TOTP({
+    issuer: "CapaKraken",
+    label: user.id,
+    algorithm: "SHA1",
+    digits: 6,
+    period: 30,
+    secret: Secret.fromBase32(user.totpSecret),
+  });
+
+  const delta = totp.validate({ token: input.token, window: 1 });
+  if (delta === null) {
+    throw new TRPCError({ code: "UNAUTHORIZED", message: "Invalid TOTP token." });
+  }
+
+  return { valid: true };
+}
+
+export async function getCurrentMfaStatus(ctx: UserSelfServiceContext) {
+  const user = await findUniqueOrThrow(
+    ctx.db.user.findUnique({
+      where: { id: ctx.dbUser!.id },
+      select: { totpEnabled: true },
+    }),
+    "User",
+  );
+
+  return { totpEnabled: user.totpEnabled };
+}