Files
pc_builder/app/controllers/computers_controller.ts
Kevin L'Hereec da71d33450
Build & Deploy / build (push) Failing after 5s
Build & Deploy / docker (push) Skipped
feat: add public read-only sharing for computers
Adds the ability for an owner to share a computer build via a public,
unauthenticated link, inspired by a feature request from the original
pcbuilder repo (no such feature actually existed there — implemented
from scratch here).

- New columns on computers: share_token (unique, nullable), share_enabled,
  share_show_sell_price, share_show_cost
- computer_share_service.ts: generates a non-guessable share token
  (crypto.randomBytes, base64url), enables/disables sharing, and supports
  rotating the token to invalidate previously distributed links
- ComputerShareController (authenticated, owner-scoped like the rest of
  the app): PUT /computers/:id/share to update settings, POST
  /computers/:id/share/rotate to rotate the token
- PublicComputerController + GET /share/:token (outside any auth/guest
  group, reachable anonymously): resolves only computers with
  share_enabled = true, 404 otherwise
- ComputerPublicTransformer: dedicated read-only projection that never
  leaks userId, and only includes sellPrice/cost when the owner opted in
  via share_show_sell_price / share_show_cost — everything else (title,
  scores, state, components, pictures) is always visible on a shared link
- ComputerShareModal.vue: owner-facing UI (toggle sharing, choose which
  prices to expose, copy the public link, revoke/rotate it) wired into
  computers/show.vue via a new 'Share' button
- share/show.vue: public page rendered with EmptyLayout (no authenticated
  header/sidebar)
- Boolean columns use a  cast since MySQL returns tinyint(1),
  not native booleans, through Lucid
- 6 new functional tests covering: enabling sharing, price visibility
  toggles, disabling sharing revokes the link, cross-user protection on
  the share settings endpoint (404), token rotation invalidating the old
  link, and anonymous access to a shared computer
2026-07-23 11:43:38 +02:00

152 lines
5.3 KiB
TypeScript

import type { HttpContext } from '@adonisjs/core/http'
import { existsSync, rmSync } from 'node:fs'
import Computer from '#models/computer'
import ComputerState from '#models/computer_state'
import Component from '#models/component'
import { storeComputerValidator } from '#validators/Computers/store'
import { handleComponents } from '#services/component_service'
import { handlePictures } from '#services/picture_service'
import type { Image } from '#types/UItypes'
import { updateComputerValidator } from '#validators/Computers/update'
/**
* Lucid's `serialize()` returns a loosely typed `ModelObject`
* (`{ [key: string]: any }`). It is not structurally assignable to the
* concrete prop shapes declared by the Vue pages (see
* `inertia/pages/types/UITypes.ts`), which live in a separate TypeScript
* project (the `inertia/**` tree is excluded from the backend tsconfig).
* Since the controller fully controls which columns/relations are
* preloaded and serialized, this cast documents that the runtime shape
* matches what the page expects at this boundary.
*/
function asPageProp<T>(value: unknown): T {
return value as T
}
export default class ComputersController {
async index({ auth, inertia }: HttpContext) {
const user = await auth.authenticate()
const computers = await Computer.query()
.where('user_id', user.id)
.preload('state')
.preload('components')
.preload('pictures', (picturesQuery) => {
picturesQuery.where('order', 1)
})
return inertia.render('computers/index', {
computers: asPageProp(computers.map((c) => c.serialize())),
})
}
async create({ auth, inertia }: HttpContext) {
const user = await auth.authenticate()
const states = await ComputerState.all()
const components = await Component.query()
.where('userId', user.id)
.whereNull('computerId')
.preload('type')
return inertia.render('computers/create', {
components: asPageProp(components.map((c) => c.serialize())),
states: asPageProp(states.map((s) => s.serialize())),
})
}
async store({ auth, request, response }: HttpContext) {
const user = await auth.authenticate()
const { pictures, componentsId, ...computerData } =
await request.validateUsing(storeComputerValidator)
await ComputerState.findOrFail(computerData.stateId)
const computer = await Computer.create({
...computerData,
userId: user.id,
})
await handleComponents(componentsId as number[], computer, user.id)
await handlePictures(pictures as Image[], request, computer)
return response.redirect('/computers')
}
async show({ auth, inertia, params }: HttpContext) {
const user = await auth.authenticate()
const computerId = params.id
const computer = await Computer.query()
.preload('state')
.preload('components', (componentsQuery) => {
componentsQuery.preload('type')
})
.preload('pictures', (picturesQuery) => {
picturesQuery.orderBy('order')
})
.where('user_id', user.id)
.andWhere('id', computerId)
.firstOrFail()
return inertia.render('computers/show', {
computer: asPageProp({ ...computer.serialize(), shareToken: computer.shareToken }),
})
}
async edit({ params, inertia, auth }: HttpContext) {
const user = await auth.authenticate()
const states = await ComputerState.all()
const computerId = params.id
const computer = await Computer.query()
.preload('state')
.preload('components', (componentsQuery) => {
componentsQuery.preload('type')
})
.preload('pictures')
.where('user_id', user.id)
.andWhere('id', computerId)
.firstOrFail()
const availableComponents = await Component.query()
.preload('type')
.where('user_id', user.id)
.whereNull('computer_id')
.whereNotIn(
'id',
computer.components.map((c) => c.id)
)
return inertia.render('computers/edit', {
computer: asPageProp(computer.serialize()),
availableComponents: asPageProp(availableComponents.map((c) => c.serialize())),
states: asPageProp(states.map((s) => s.serialize())),
})
}
async update({ auth, params, request, response }: HttpContext) {
const user = await auth.authenticate()
const computerId = params.id
const { pictures, componentsId, ...computerData } = await request.validateUsing(
updateComputerValidator
)
const computer = await Computer.query()
.where('user_id', user.id)
.andWhere('id', computerId)
.firstOrFail()
computer.merge(computerData)
await computer.save()
await handleComponents(componentsId as number[], computer, user.id)
await handlePictures(pictures as Image[], request, computer)
return response.redirect(`/computers/${computer.id}`)
}
async destroy({ auth, params, response }: HttpContext) {
const user = await auth.authenticate()
const computerId = params.id
const computer = await Computer.query()
.where('user_id', user.id)
.andWhere('id', computerId)
.firstOrFail()
const uploadsDir = `uploads/computer_${computer.id}`
await computer.related('components').query().update({ computerId: null })
if (existsSync(uploadsDir)) {
rmSync(uploadsDir, { recursive: true, force: true })
}
await computer.delete()
return response.redirect('/computers')
}
}