v3: comments say what the code can't — the documentation pass wanted JSDoc on every export and every field of an exported interface, which filled the code with restatements ("The dump.", "Whether it is loading.", "The props of X.", "Renders the X.") and module docs that told a reader nothing ("The hot and new feeds, and the props every main feed of the index takes."); some were wrong as well as vague. Every comment in api/, shared/ and src/ is rewritten under one rule, now stated in the README's "Comments" section: every module and export still has a JSDoc, and it gives context (who uses it and where), usage (what a caller must know: a precondition, what it leaves to the caller, a side effect) or its place in the chain (where its input comes from, where its output goes); a field, parameter, private function or local gets one only when it adds to its parent's, and context about a whole type goes on the type; a type's doc is phrased from the value's side ("Returned to Y by X when Z", "Passed to Y by X"); full sentences, as short as they can be, no label-colon-list; // goes wherever the code isn't obvious and says why, and the section banners and narration go. Every claim was checked against the code, which turned up some forty comments that were wrong: DumpCard's claimed it was only used by the hot and new feeds, the WebSocket welcome claimed to be a socket's first message (presence comes first), UpdateUserRequest said null removes a description (it keeps it), deletedDumpIds leaves out that it also holds dumps made private, THEME_COLOR claimed to mirror index.html's, and the like. The routers' JSDoc now says where they are mounted and what becomes of a thrown APIException. doc-lint.ts lets a field without a doc through; a module or export without one still fails. No code changes; 204 backend and 628 frontend tests pass, and doc:lint, deno check, deno lint and tsc are clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
khannurien
165
shared/user.ts
165
shared/user.ts
@@ -1,129 +1,144 @@
|
||||
/**
|
||||
* Users as the API shows them, their roles, and the bodies and answers of
|
||||
* sign-up, sign-in, profile edits and invites.
|
||||
* Types users as the API sends them, their roles, and the bodies and answers
|
||||
* of the `/api/users` and `/api/invites` endpoints, for the server and the
|
||||
* client alike.
|
||||
*
|
||||
* @module
|
||||
*/
|
||||
|
||||
/** What a user may do beyond the basics; see `ROLE_PERMISSIONS`. */
|
||||
/**
|
||||
* Sets what a user may do beyond the basics, through `ROLE_PERMISSIONS`
|
||||
* (`shared/permissions.ts`). An admin changes it with
|
||||
* `PATCH /api/users/:userId/role`.
|
||||
*/
|
||||
export type Role = "user" | "moderator" | "admin";
|
||||
|
||||
/** Every {@link Role}, least to most privileged. */
|
||||
export const ROLES: readonly Role[] = ["user", "moderator", "admin"];
|
||||
|
||||
/** Checks whether `value` is a {@link Role}. */
|
||||
/**
|
||||
* Checks whether `value` is a {@link Role}, as the role endpoint and the row
|
||||
* guards must before trusting one.
|
||||
*/
|
||||
export function isRole(value: unknown): value is Role {
|
||||
return typeof value === "string" &&
|
||||
(ROLES as readonly string[]).includes(value);
|
||||
}
|
||||
|
||||
/** A user as anyone may see them: no password hash, no email. */
|
||||
/**
|
||||
* Returned by every endpoint that shows a user to others: profiles, the users
|
||||
* one follows, search results, and the `user_updated` socket message. The
|
||||
* server makes it with `toPublicUser`, which drops the email.
|
||||
*/
|
||||
export interface PublicUser {
|
||||
/** The user's id. */
|
||||
id: string;
|
||||
/** The user's name, fixed at sign-up. */
|
||||
/** Fixed at sign-up. */
|
||||
username: string;
|
||||
/** The user's role. */
|
||||
role: Role;
|
||||
/** When the user signed up. */
|
||||
createdAt: Date;
|
||||
/** When the user last changed, if ever. */
|
||||
/**
|
||||
* Bumped by any profile or avatar change. The client uses it to reload the
|
||||
* avatar.
|
||||
*/
|
||||
updatedAt?: Date;
|
||||
/** The avatar's type, undefined without one. */
|
||||
/** Undefined without an avatar. */
|
||||
avatarMime?: string;
|
||||
/** The user's description of themselves, in Markdown. */
|
||||
/** Markdown. */
|
||||
description?: string;
|
||||
/** The name of whoever invited them. */
|
||||
invitedByUsername?: string;
|
||||
}
|
||||
|
||||
/** A user as they see themselves: everything but the password hash. */
|
||||
/**
|
||||
* Returned to a user about themselves: by sign-up and sign-in in
|
||||
* {@link AuthResponse}, by `GET /api/users/me`, and by an avatar upload.
|
||||
*/
|
||||
export interface SelfUser extends PublicUser {
|
||||
/** The address password resets are sent to. */
|
||||
email: string;
|
||||
}
|
||||
|
||||
/** A match for the @mention autocomplete. */
|
||||
export interface UserSuggestion {
|
||||
/** The user's id. */
|
||||
id: string;
|
||||
/** The user's name. */
|
||||
username: string;
|
||||
/** The avatar's type, null without one. */
|
||||
avatarMime: string | null;
|
||||
}
|
||||
|
||||
/** Someone a user invited, directly or down the line. */
|
||||
export interface Invitee {
|
||||
/** The user's id. */
|
||||
id: string;
|
||||
/** The user's name. */
|
||||
username: string;
|
||||
/** The avatar's type, undefined without one. */
|
||||
avatarMime?: string;
|
||||
/** The id of whoever invited them, to build the tree. */
|
||||
invitedById: string;
|
||||
/** When they signed up. */
|
||||
createdAt: Date;
|
||||
}
|
||||
|
||||
/** The body of `POST /api/users/login`. */
|
||||
export interface LoginUserRequest {
|
||||
/** The user's name. */
|
||||
username: string;
|
||||
/** The user's password. */
|
||||
password: string;
|
||||
}
|
||||
|
||||
/** The body of `POST /api/users/register`. */
|
||||
export interface RegisterUserRequest {
|
||||
/** The name to sign up with. */
|
||||
username: string;
|
||||
/** The password to sign up with. */
|
||||
password: string;
|
||||
/** The invite's token. */
|
||||
inviteToken: string;
|
||||
/** The address password resets will be sent to. */
|
||||
/** Where password reset links go. It belongs to this account only. */
|
||||
email: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Fields of a user to change. `PATCH /api/users/me` takes only `description`
|
||||
* and `email` from it; the role and the password change through their own
|
||||
* endpoints.
|
||||
* Returned by `GET /api/users/search` to the editor's @mention autocomplete.
|
||||
*/
|
||||
export interface UserSuggestion {
|
||||
id: string;
|
||||
username: string;
|
||||
/** Null without an avatar. */
|
||||
avatarMime: string | null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returned, as a flat list in sign-up order, by
|
||||
* `GET /api/users/:username/invitees`. The profile page nests it into a tree
|
||||
* by `invitedById`.
|
||||
*/
|
||||
export interface Invitee {
|
||||
id: string;
|
||||
username: string;
|
||||
/** Undefined without an avatar. */
|
||||
avatarMime?: string;
|
||||
invitedById: string;
|
||||
createdAt: Date;
|
||||
}
|
||||
|
||||
/** Sent to `POST /api/users/login` by the login page. */
|
||||
export interface LoginUserRequest {
|
||||
username: string;
|
||||
password: string;
|
||||
}
|
||||
|
||||
/** Sent to `POST /api/users/register` by the register page. */
|
||||
export interface RegisterUserRequest {
|
||||
username: string;
|
||||
password: string;
|
||||
/** From the invite link the register page was opened with. */
|
||||
inviteToken: string;
|
||||
email: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Passed to `updateUser` by the users routes and the password reset. Of a
|
||||
* client's body, `PATCH /api/users/me` takes only `description` and `email`;
|
||||
* the role and the password change through their own endpoints.
|
||||
*/
|
||||
export interface UpdateUserRequest {
|
||||
/** The new name. */
|
||||
username?: string;
|
||||
/** The new password. */
|
||||
password?: string;
|
||||
/** The new role. */
|
||||
role?: Role;
|
||||
/** The new description; `null` removes it. */
|
||||
/** An empty string clears it. Null, like undefined, keeps it. */
|
||||
description?: string | null;
|
||||
/** The new email address. */
|
||||
email?: string;
|
||||
}
|
||||
|
||||
/** The session token, plus the media-only one for file and thumbnail URLs. */
|
||||
/**
|
||||
* Returned by sign-up, sign-in and a password change. The client keeps both
|
||||
* tokens with its session.
|
||||
*/
|
||||
export interface AuthTokens {
|
||||
/** The session token, sent as a bearer token. */
|
||||
/** Sent as `Authorization: Bearer …`, and as `?token=` to the WebSocket. */
|
||||
token: string;
|
||||
/** The token media URLs carry as `?token=`, good for nothing else. */
|
||||
/**
|
||||
* Carried as `?token=` by the URLs of private media. It can read media and
|
||||
* nothing else.
|
||||
*/
|
||||
mediaToken: string;
|
||||
}
|
||||
|
||||
/** What sign-up and sign-in answer: the user and their tokens. */
|
||||
/** Returned by sign-up and sign-in. */
|
||||
export interface AuthResponse extends AuthTokens {
|
||||
/** The signed-in user. */
|
||||
user: SelfUser;
|
||||
}
|
||||
|
||||
/** `GET /api/users/me/media-token`: a fresh media token. */
|
||||
/**
|
||||
* Returned by `GET /api/users/me/media-token` to a session from before media
|
||||
* tokens, which has none.
|
||||
*/
|
||||
export type MediaTokenResponse = Pick<AuthTokens, "mediaToken">;
|
||||
|
||||
/** `POST /api/invites`: the new invite's token. */
|
||||
/**
|
||||
* Returned by `POST /api/invites` to the profile page, which builds the invite
|
||||
* link from `token`.
|
||||
*/
|
||||
export interface InviteResponse {
|
||||
/** The token, which the invite link carries. */
|
||||
token: string;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user