brackt/app/models/user.ts
Claude d771ccbd15
Address all code review issues on username onboarding
- Replace case-sensitive unique constraint with functional unique index on
  lower(username) so DB-level uniqueness is case-insensitive (fix #1)
- Share USERNAME_RE from models/user.ts; add same format + uniqueness
  validation to the settings update-profile action (fix #2)
- Wrap updateUser calls in try/catch to handle race-condition DB errors
  gracefully in both onboarding and settings (fix #3)
- Add unit tests for suggestUsername, safeRedirectTo, USERNAME_RE, and
  isOnboardingExempt (fix #4)
- Guard suggestUsername against returning strings shorter than 3 chars (fix #5)
- Preserve the user's intended destination via redirectTo query param
  through the onboarding flow (fix #6)
- Treat empty username in settings as a validation error instead of a
  silent no-op (fix #7)
- Use exact/sub-path matching in isOnboardingExempt to prevent
  false-positive prefix matches like /loginpage (fix #8)

https://claude.ai/code/session_01UinBMAy9d6dQzzbcUAdq8J
2026-05-15 18:10:11 +00:00

128 lines
3.7 KiB
TypeScript

import { eq, inArray, and } from "drizzle-orm";
import { database } from "~/database/context";
import * as schema from "~/database/schema";
import { generateFlagConfig } from "~/lib/flag-generator";
export type User = typeof schema.users.$inferSelect;
export type NewUser = typeof schema.users.$inferInsert;
export const USERNAME_RE = /^[a-zA-Z0-9_-]{3,30}$/;
export function getUserDisplayName(
user: Pick<User, "username" | "displayName">
): string | null {
return user.username ?? user.displayName ?? null;
}
export async function createUser(data: NewUser): Promise<User> {
const db = database();
const id = data.id ?? crypto.randomUUID();
const [user] = await db
.insert(schema.users)
.values({ ...data, id, flagConfig: data.flagConfig ?? generateFlagConfig(id) })
.returning();
return user;
}
export async function findUserById(id: string): Promise<User | undefined> {
const db = database();
return await db.query.users.findFirst({
where: eq(schema.users.id, id),
});
}
export async function findUsersByIds(ids: string[]): Promise<User[]> {
if (ids.length === 0) return [];
const db = database();
return await db
.select()
.from(schema.users)
.where(inArray(schema.users.id, ids));
}
export async function findUserByUsername(username: string): Promise<User | undefined> {
const db = database();
return await db.query.users.findFirst({
where: (users, { sql }) => sql`lower(${users.username}) = lower(${username})`,
});
}
export async function updateUser(
id: string,
data: Partial<NewUser>
): Promise<User> {
const db = database();
const [user] = await db
.update(schema.users)
.set({ ...data, updatedAt: new Date() })
.where(eq(schema.users.id, id))
.returning();
return user;
}
export async function anonymizeUserAccount(id: string): Promise<void> {
const db = database();
const shortId = id.replace(/-/g, "").slice(0, 8);
await db.transaction(async (tx) => {
await tx.delete(schema.sessions).where(eq(schema.sessions.userId, id));
await tx.delete(schema.accounts).where(eq(schema.accounts.userId, id));
await tx
.update(schema.users)
.set({
email: `deleted-${shortId}@deleted.brackt.com`,
displayName: null,
username: null,
imageUrl: null,
customAvatarUrl: null,
flagConfig: null,
avatarType: "flag",
deletedAt: new Date(),
updatedAt: new Date(),
})
.where(eq(schema.users.id, id));
});
}
export async function findAdmins(): Promise<User[]> {
const db = database();
return await db.query.users.findMany({
where: eq(schema.users.isAdmin, true),
orderBy: (users, { asc }) => [asc(users.displayName)],
});
}
export async function isUserAdmin(userId: string): Promise<boolean> {
const user = await findUserById(userId);
return user?.isAdmin ?? false;
}
export async function setUserAdmin(userId: string, isAdmin: boolean): Promise<User> {
return await updateUser(userId, { isAdmin });
}
export async function findAllUsers(): Promise<User[]> {
const db = database();
return await db.query.users.findMany({
orderBy: (users, { asc }) => [asc(users.displayName)],
});
}
/**
* Returns true if the user currently owns a team in a draft-status season.
* Used to prevent timezone changes mid-draft.
*/
export async function isUserInActiveDraft(userId: string): Promise<boolean> {
const db = database();
const result = await db
.select({ id: schema.teams.id })
.from(schema.teams)
.innerJoin(schema.seasons, eq(schema.teams.seasonId, schema.seasons.id))
.where(
and(
eq(schema.teams.ownerId, userId),
eq(schema.seasons.status, "draft")
)
)
.limit(1);
return result.length > 0;
}