e61179ab27
Adds the notifications system end-to-end (4 types, payload-versioned JSONB, SSE-based live unread badge, /notifications page, mark-read API, fan-out job for activity_published, daily 90-day retention purge). Bell icon in the navbar with unread badge. Side-findings from exercising the change: - Add 6-digit magic code to registration (mirrors login UX, mobile paste-friendly), with `[Register Magic Link]` console line in dev so the code is reachable without a real email transport. - Manual passkey/magic-link toggle on the register form (login already had it). - Restrict ALPN to http/1.1 in HTTPS dev so React Router's singleFetchAction CSRF check (Origin vs. Host) passes — Node doesn't synthesize Host from h2's :authority. Plain HTTP dev unaffected. - Followers/Following routes now use the locked-account rule from the profile route (owner + accepted followers see the list; others 404). Profile page renders the count chips as plain spans for viewers who can't see the lists, so private profiles don't surface dead links. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
54 lines
1.9 KiB
TypeScript
54 lines
1.9 KiB
TypeScript
import { data } from "react-router";
|
|
import { eq } from "drizzle-orm";
|
|
import type { Route } from "./+types/users.$username.followers";
|
|
import { getDb } from "~/lib/db";
|
|
import { users } from "@trails-cool/db/schema/journal";
|
|
import { listFollowers, countFollowers, getFollowState } from "~/lib/follow.server";
|
|
import { getSessionUser } from "~/lib/auth.server";
|
|
import { CollectionPage } from "~/components/CollectionPage";
|
|
|
|
export async function loader({ params, request }: Route.LoaderArgs) {
|
|
const db = getDb();
|
|
const [user] = await db.select().from(users).where(eq(users.username, params.username));
|
|
if (!user) {
|
|
throw data({ error: "User not found" }, { status: 404 });
|
|
}
|
|
|
|
// Locked-account model: only the owner and accepted followers can see
|
|
// a private user's followers list. Non-followers (anonymous or signed-in)
|
|
// get the same 404 a stranger sees, mirroring the profile-route policy.
|
|
const currentUser = await getSessionUser(request);
|
|
const isOwn = currentUser?.id === user.id;
|
|
const followState = !isOwn && currentUser
|
|
? await getFollowState(currentUser.id, user.username)
|
|
: null;
|
|
const canSee =
|
|
isOwn ||
|
|
user.profileVisibility === "public" ||
|
|
(followState !== null && followState.following === true);
|
|
if (!canSee) {
|
|
throw data({ error: "User not found" }, { status: 404 });
|
|
}
|
|
|
|
const url = new URL(request.url);
|
|
const page = Math.max(1, parseInt(url.searchParams.get("page") ?? "1", 10) || 1);
|
|
const [entries, total] = await Promise.all([
|
|
listFollowers(user.id, page),
|
|
countFollowers(user.id),
|
|
]);
|
|
|
|
return data({
|
|
user: { username: user.username, displayName: user.displayName },
|
|
page,
|
|
total,
|
|
entries,
|
|
});
|
|
}
|
|
|
|
export function meta({ data: d }: Route.MetaArgs) {
|
|
return [{ title: `Followers of @${d?.user.username ?? ""} — trails.cool` }];
|
|
}
|
|
|
|
export default function Followers({ loaderData }: Route.ComponentProps) {
|
|
return <CollectionPage kind="followers" {...loaderData} />;
|
|
}
|