[{"_1":2,"_180":-5,"_181":-5},"loaderData",{"_3":4,"_93":94},"root",{"_5":6,"_36":37,"_66":67},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":-5,"_32":33,"_34":20,"_35":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesChatPanelState","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63,"_64":65},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","1f1a009cadcf7353a37b999b92a7f8af633192ea","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_68":69},"__internal_clerk_state",{"_70":71,"_72":47,"_73":74,"_75":74,"_76":20,"_77":74,"_78":74,"_79":74,"_80":74,"_81":82,"_91":20,"_92":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_83":20,"_19":20,"_84":74,"_85":86,"_87":74,"_88":47,"_89":20,"_90":74},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_95":96,"_97":98,"_99":100,"_101":102,"_155":156,"_177":178,"_179":-5},"handle","shapedlines","name","loki","path","backend/groups.ts","project",{"_103":104,"_97":98,"_105":106,"_107":-5,"_108":20,"_109":110,"_111":-5,"_112":-5,"_12":113,"_114":115,"_116":117,"_118":117,"_119":-5,"_120":33,"_14":121,"_122":-5,"_123":-5,"_124":125,"_126":125,"_127":128,"_129":128,"_130":128,"_131":125,"_132":125,"_23":133,"_136":137,"_141":142,"_154":20},"id","d3df2ae6-4d5b-11f0-b336-76b3cceeab13","createdAt",["D",1750371724044],"deletedAt","legacyEnvVars","privacy","public","description","imageUrl","7ed186b0-c78a-4757-a5b0-12c00ac89afa","pinnedFileId","9cf06f84-4d5d-11f0-a672-76b3cceeab13","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","e9195859-3c6b-4b40-bb3e-c11844477fdf","tursoName","tursoHostname","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_95":96,"_134":135},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yYlc2Q1A2eUFyNEdDeXBud0E0bFJyWlJVUzQifQ","org",{"_95":96,"_138":135,"_12":113,"_139":140},"avatar","tier","free","branch",{"_143":144,"_97":45,"_103":145,"_146":104,"_147":-5,"_148":-5,"_149":-5,"_150":-5,"_151":-5,"_152":98,"_153":96},"version",336,"d3df7564-4d5b-11f0-b336-76b3cceeab13","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_103":157,"_97":158,"_159":160,"_161":162,"_163":145,"_164":165,"_166":117,"_105":167,"_143":168,"_169":170,"_171":172,"_173":20,"_174":-5,"_99":175},"28f9b28e-f80c-11f0-8bf8-42dde27851f2","groups.ts","fileId","7d41f302-f806-11f0-a6eb-42dde27851f2","parentId","7c759398-f806-11f0-be4c-42dde27851f2","branchId","branchVersion",321,"latest",["D",1769139155904],2,"fileType","script","content","/**\n * Group management API for Loki\n * Handles creating, joining, and managing house search groups\n */\n\nimport { Hono } from \"https://esm.sh/hono@4.0.0\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport type { AuthContext } from \"./auth.ts\";\nimport { requireAuth } from \"./auth.ts\";\nimport type { Group, GroupMember, GroupWithMembers, User, CreateGroupRequest } from \"../shared/types.ts\";\nimport { rowToObject, rowsToObjects } from \"./db-utils.ts\";\n\nconst TABLE_PREFIX = \"loki_\";\n\nexport const groupsRouter = new Hono();\n\n// Apply auth middleware to all group routes\ngroupsRouter.use(\"/*\", requireAuth);\n\n/**\n * Generate a unique ID\n */\nfunction generateId(): string {\n return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;\n}\n\n/**\n * Generate a random invite code (6 alphanumeric characters)\n */\nfunction generateInviteCode(): string {\n const chars = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\"; // Excluded confusing chars like 0, O, 1, I\n let code = \"\";\n for (let i = 0; i < 6; i++) {\n code += chars.charAt(Math.floor(Math.random() * chars.length));\n }\n return code;\n}\n\n/**\n * Get group by ID with members\n */\nasync function getGroupWithMembers(groupId: string): Promise {\n const groupResult = await sqlite.execute({\n sql: `SELECT id, name, created_by, invite_code, created_at FROM ${TABLE_PREFIX}groups WHERE id = ?`,\n args: [groupId],\n });\n\n if (groupResult.rows.length === 0) return null;\n\n const groupRow = rowToObject<{ id: string; name: string; created_by: string; invite_code: string; created_at: number }>(\n groupResult.rows[0] as unknown[] | Record,\n groupResult.columns\n );\n const group: Group = {\n id: groupRow.id,\n name: groupRow.name,\n created_by: groupRow.created_by,\n invite_code: groupRow.invite_code,\n created_at: groupRow.created_at,\n };\n\n // Get members with user details\n const membersResult = await sqlite.execute({\n sql: `\n SELECT gm.group_id, gm.user_id, gm.role, gm.joined_at, u.email, u.name as user_name, u.avatar_url\n FROM ${TABLE_PREFIX}group_members gm\n JOIN ${TABLE_PREFIX}users u ON gm.user_id = u.id\n WHERE gm.group_id = ?\n `,\n args: [groupId],\n });\n\n type MemberRow = { group_id: string; user_id: string; role: string; joined_at: number; email: string; user_name: string | null; avatar_url: string | null };\n const memberRows = rowsToObjects(\n membersResult.rows as (unknown[] | Record)[],\n membersResult.columns\n );\n\n const members = memberRows.map(row => ({\n group_id: row.group_id,\n user_id: row.user_id,\n role: row.role as \"owner\" | \"member\",\n joined_at: row.joined_at,\n user: {\n id: row.user_id,\n email: row.email,\n name: row.user_name,\n avatar_url: row.avatar_url,\n created_at: 0, // Not needed here\n },\n }));\n\n return { ...group, members };\n}\n\n/**\n * Check if user is member of group\n */\nasync function isGroupMember(groupId: string, userId: string): Promise {\n const result = await sqlite.execute({\n sql: `SELECT 1 FROM ${TABLE_PREFIX}group_members WHERE group_id = ? AND user_id = ?`,\n args: [groupId, userId],\n });\n return result.rows.length > 0;\n}\n\n/**\n * Check if user is owner of group\n */\nasync function isGroupOwner(groupId: string, userId: string): Promise {\n const result = await sqlite.execute({\n sql: `SELECT 1 FROM ${TABLE_PREFIX}group_members WHERE group_id = ? AND user_id = ? AND role = 'owner'`,\n args: [groupId, userId],\n });\n return result.rows.length > 0;\n}\n\n/**\n * POST /groups - Create a new group\n */\ngroupsRouter.post(\"/\", async (c) => {\n const user = c.get(\"user\") as User;\n \n // Validate user object has required fields\n if (!user || !user.id) {\n console.error(\"Invalid user object in create group:\", JSON.stringify(user));\n return c.json({ error: \"Authentication error\", message: \"Invalid user session\" }, 401);\n }\n \n let body: CreateGroupRequest;\n try {\n body = await c.req.json();\n } catch {\n return c.json({ error: \"Invalid request\", message: \"Invalid JSON body\" }, 400);\n }\n\n if (!body.name || body.name.trim().length === 0) {\n return c.json({ error: \"Validation error\", message: \"Group name is required\" }, 400);\n }\n\n const groupId = generateId();\n const inviteCode = generateInviteCode();\n const now = Math.floor(Date.now() / 1000);\n\n // Create group\n await sqlite.execute({\n sql: `INSERT INTO ${TABLE_PREFIX}groups (id, name, created_by, invite_code, created_at) VALUES (?, ?, ?, ?, ?)`,\n args: [groupId, body.name.trim(), user.id, inviteCode, now],\n });\n\n // Add creator as owner\n await sqlite.execute({\n sql: `INSERT INTO ${TABLE_PREFIX}group_members (group_id, user_id, role, joined_at) VALUES (?, ?, 'owner', ?)`,\n args: [groupId, user.id, now],\n });\n\n const group = await getGroupWithMembers(groupId);\n return c.json({ group }, 201);\n});\n\n/**\n * GET /groups - List user's groups\n */\ngroupsRouter.get(\"/\", async (c) => {\n const user = c.get(\"user\") as User;\n\n const result = await sqlite.execute({\n sql: `\n SELECT g.id, g.name, g.created_by, g.invite_code, g.created_at, gm.role\n FROM ${TABLE_PREFIX}groups g\n JOIN ${TABLE_PREFIX}group_members gm ON g.id = gm.group_id\n WHERE gm.user_id = ?\n ORDER BY g.created_at DESC\n `,\n args: [user.id],\n });\n\n type GroupRow = { id: string; name: string; created_by: string; invite_code: string; created_at: number; role: string };\n const groupRows = rowsToObjects(\n result.rows as (unknown[] | Record)[],\n result.columns\n );\n\n const groups = groupRows.map(row => ({\n id: row.id,\n name: row.name,\n created_by: row.created_by,\n invite_code: row.invite_code,\n created_at: row.created_at,\n role: row.role,\n }));\n\n return c.json({ groups });\n});\n\n/**\n * GET /groups/:id - Get group details with members\n */\ngroupsRouter.get(\"/:id\", async (c) => {\n const user = c.get(\"user\") as User;\n const groupId = c.req.param(\"id\");\n\n // Check membership\n if (!await isGroupMember(groupId, user.id)) {\n return c.json({ error: \"Forbidden\", message: \"You are not a member of this group\" }, 403);\n }\n\n const group = await getGroupWithMembers(groupId);\n if (!group) {\n return c.json({ error: \"Not found\", message: \"Group not found\" }, 404);\n }\n\n return c.json({ group });\n});\n\n/**\n * PUT /groups/:id - Update group name\n */\ngroupsRouter.put(\"/:id\", async (c) => {\n const user = c.get(\"user\") as User;\n const groupId = c.req.param(\"id\");\n\n // Check ownership\n if (!await isGroupOwner(groupId, user.id)) {\n return c.json({ error: \"Forbidden\", message: \"Only group owners can update the group\" }, 403);\n }\n\n let body: { name?: string };\n try {\n body = await c.req.json();\n } catch {\n return c.json({ error: \"Invalid request\", message: \"Invalid JSON body\" }, 400);\n }\n\n if (!body.name || body.name.trim().length === 0) {\n return c.json({ error: \"Validation error\", message: \"Group name is required\" }, 400);\n }\n\n await sqlite.execute({\n sql: `UPDATE ${TABLE_PREFIX}groups SET name = ? WHERE id = ?`,\n args: [body.name.trim(), groupId],\n });\n\n const group = await getGroupWithMembers(groupId);\n return c.json({ group });\n});\n\n/**\n * POST /groups/:id/regenerate-invite - Generate a new invite code\n */\ngroupsRouter.post(\"/:id/regenerate-invite\", async (c) => {\n const user = c.get(\"user\") as User;\n const groupId = c.req.param(\"id\");\n\n // Check ownership\n if (!await isGroupOwner(groupId, user.id)) {\n return c.json({ error: \"Forbidden\", message: \"Only group owners can regenerate invite codes\" }, 403);\n }\n\n const newInviteCode = generateInviteCode();\n await sqlite.execute({\n sql: `UPDATE ${TABLE_PREFIX}groups SET invite_code = ? WHERE id = ?`,\n args: [newInviteCode, groupId],\n });\n\n return c.json({ invite_code: newInviteCode });\n});\n\n/**\n * POST /groups/join/:code - Join a group via invite code\n */\ngroupsRouter.post(\"/join/:code\", async (c) => {\n const user = c.get(\"user\") as User;\n const inviteCode = c.req.param(\"code\").toUpperCase();\n\n // Find group by invite code\n const groupResult = await sqlite.execute({\n sql: `SELECT * FROM ${TABLE_PREFIX}groups WHERE invite_code = ?`,\n args: [inviteCode],\n });\n\n if (groupResult.rows.length === 0) {\n return c.json({ error: \"Not found\", message: \"Invalid invite code\" }, 404);\n }\n\n const groupId = groupResult.rows[0].id as string;\n\n // Check if already a member\n if (await isGroupMember(groupId, user.id)) {\n return c.json({ error: \"Already joined\", message: \"You are already a member of this group\" }, 400);\n }\n\n // Add as member\n const now = Math.floor(Date.now() / 1000);\n await sqlite.execute({\n sql: `INSERT INTO ${TABLE_PREFIX}group_members (group_id, user_id, role, joined_at) VALUES (?, ?, 'member', ?)`,\n args: [groupId, user.id, now],\n });\n\n const group = await getGroupWithMembers(groupId);\n return c.json({ group, message: \"Successfully joined the group\" });\n});\n\n/**\n * DELETE /groups/:id/members/:userId - Remove a member from group\n */\ngroupsRouter.delete(\"/:id/members/:userId\", async (c) => {\n const user = c.get(\"user\") as User;\n const groupId = c.req.param(\"id\");\n const targetUserId = c.req.param(\"userId\");\n\n // Users can remove themselves, or owners can remove others\n const isSelf = targetUserId === user.id;\n const isOwner = await isGroupOwner(groupId, user.id);\n\n if (!isSelf && !isOwner) {\n return c.json({ error: \"Forbidden\", message: \"You can only remove yourself or be a group owner to remove others\" }, 403);\n }\n\n // Check if target is a member\n if (!await isGroupMember(groupId, targetUserId)) {\n return c.json({ error: \"Not found\", message: \"User is not a member of this group\" }, 404);\n }\n\n // Check if trying to remove the only owner\n if (await isGroupOwner(groupId, targetUserId)) {\n const ownersResult = await sqlite.execute({\n sql: `SELECT COUNT(*) as count FROM ${TABLE_PREFIX}group_members WHERE group_id = ? AND role = 'owner'`,\n args: [groupId],\n });\n const ownerCount = ownersResult.rows[0].count as number;\n \n if (ownerCount <= 1) {\n return c.json({ error: \"Cannot remove\", message: \"Cannot remove the only owner. Transfer ownership first or delete the group.\" }, 400);\n }\n }\n\n // Remove member\n await sqlite.execute({\n sql: `DELETE FROM ${TABLE_PREFIX}group_members WHERE group_id = ? AND user_id = ?`,\n args: [groupId, targetUserId],\n });\n\n return c.json({ success: true, message: \"Member removed from group\" });\n});\n\n/**\n * POST /groups/:id/members/:userId/promote - Promote member to owner\n */\ngroupsRouter.post(\"/:id/members/:userId/promote\", async (c) => {\n const user = c.get(\"user\") as User;\n const groupId = c.req.param(\"id\");\n const targetUserId = c.req.param(\"userId\");\n\n // Only owners can promote\n if (!await isGroupOwner(groupId, user.id)) {\n return c.json({ error: \"Forbidden\", message: \"Only group owners can promote members\" }, 403);\n }\n\n // Check if target is a member\n if (!await isGroupMember(groupId, targetUserId)) {\n return c.json({ error: \"Not found\", message: \"User is not a member of this group\" }, 404);\n }\n\n // Promote to owner\n await sqlite.execute({\n sql: `UPDATE ${TABLE_PREFIX}group_members SET role = 'owner' WHERE group_id = ? AND user_id = ?`,\n args: [groupId, targetUserId],\n });\n\n return c.json({ success: true, message: \"Member promoted to owner\" });\n});\n\n/**\n * DELETE /groups/:id - Delete a group (owner only)\n */\ngroupsRouter.delete(\"/:id\", async (c) => {\n const user = c.get(\"user\") as User;\n const groupId = c.req.param(\"id\");\n\n // Only owners can delete\n if (!await isGroupOwner(groupId, user.id)) {\n return c.json({ error: \"Forbidden\", message: \"Only group owners can delete the group\" }, 403);\n }\n\n // Delete group (cascades to members, interactions, etc.)\n await sqlite.execute({\n sql: `DELETE FROM ${TABLE_PREFIX}groups WHERE id = ?`,\n args: [groupId],\n });\n\n return c.json({ success: true, message: \"Group deleted\" });\n});\n\nexport { getGroupWithMembers, isGroupMember, isGroupOwner };\n","deleted","label",[176,158],"backend","permalink","https://www.val.town/x/shapedlines/loki/code/backend/groups.ts","extension","actionData","errors"]