Checkpoint SHD dashboard design system

src/routes/account/+page.server.ts

@@ -0,0 +1,47 @@
+import { createSession, getSessionUser } from '$lib/server/auth/session';
+import { hashPassword, verifyPassword } from '$lib/server/auth/password';
+import { getDatabase } from '$lib/server/database';
+import { fail, redirect } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
+
+export const load: PageServerLoad = async ({ cookies, url }) => {
+	const user = await getSessionUser(cookies);
+	if (!user) redirect(303, '/sign-in');
+	const database = await getDatabase();
+	const [builds, guides, favorites, ratings] = await Promise.all([
+		(await database.prepare('SELECT id, title, slug, visibility, updated_at FROM builds WHERE owner_id = ? ORDER BY updated_at DESC')).all(user.id),
+		(await database.prepare("SELECT id, title, slug, visibility, updated_at FROM builds WHERE owner_id = ? AND guide_body IS NOT NULL AND length(trim(guide_body)) > 0 ORDER BY updated_at DESC")).all(user.id),
+		(await database.prepare('SELECT builds.id, builds.title, builds.slug, users.username AS author FROM favorites JOIN builds ON builds.id = favorites.build_id JOIN users ON users.id = builds.owner_id WHERE favorites.user_id = ? ORDER BY favorites.created_at DESC')).all(user.id),
+		(await database.prepare('SELECT builds.id, builds.title, builds.slug, users.username AS author, ratings.value FROM ratings JOIN builds ON builds.id = ratings.build_id JOIN users ON users.id = builds.owner_id WHERE ratings.user_id = ? ORDER BY builds.updated_at DESC')).all(user.id)
+	]);
+	return { account: { builds, guides, favorites, ratings }, chooseUsername: url.searchParams.has('choose_username'), discordLinked: url.searchParams.has('discord_linked'), oauthError: url.searchParams.has('oauth_error') };
+};
+
+export const actions: Actions = {
+	changeUsername: async ({ request, cookies }) => {
+		const user = await getSessionUser(cookies);
+		if (!user) redirect(303, '/sign-in');
+		const username = String((await request.formData()).get('username') ?? '').normalize('NFKC').trim();
+		if (username.length < 3 || username.length > 24 || !/^[\p{L}\p{N}_-]+$/u.test(username)) return fail(400, { usernameError: 'Use 3–24 letters, numbers, underscores, or hyphens.' });
+		if (['admin','administrator','moderator','shd','support'].includes(username.toLowerCase())) return fail(400, { usernameError: 'That username is reserved.' });
+		const database = await getDatabase();
+		if (await (await database.prepare('SELECT id FROM users WHERE username = ? COLLATE NOCASE AND id <> ?')).get(username, user.id)) return fail(409, { usernameError: 'That username is already in use.' });
+		await (await database.prepare('UPDATE users SET username = ? WHERE id = ?')).run(username, user.id);
+		return { usernameChanged: true };
+	},
+	changePassword: async ({ request, cookies }) => {
+		const user = await getSessionUser(cookies);
+		if (!user) redirect(303, '/sign-in');
+		const form = await request.formData();
+		const current = String(form.get('currentPassword') ?? ''), next = String(form.get('newPassword') ?? ''), confirm = String(form.get('confirmPassword') ?? '');
+		if (next.length < 12 || next.length > 128) return fail(400, { passwordError: 'Use between 12 and 128 characters.' });
+		if (next !== confirm) return fail(400, { passwordError: 'The new passwords do not match.' });
+		const database = await getDatabase();
+		const credential = await (await database.prepare('SELECT password_hash FROM users WHERE id = ?')).get(user.id);
+		if (typeof credential?.password_hash !== 'string' || !(await verifyPassword(credential.password_hash, current))) return fail(400, { passwordError: 'Your current password is incorrect.' });
+		await (await database.prepare('UPDATE users SET password_hash = ? WHERE id = ?')).run(await hashPassword(next), user.id);
+		await (await database.prepare('DELETE FROM sessions WHERE user_id = ?')).run(user.id);
+		await createSession(cookies, user.id);
+		return { passwordChanged: true };
+	}
+};