jb/shd.build
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

Separate login and display identities

Browse Source
This commit is contained in:
JB
2026-07-24 23:45:08 -04:00
parent 05acc022c7
commit c0834804d4
13 changed files with 182 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/routes/account/+page.server.ts
+58 -10
View File
@@ -9,11 +9,14 @@ export const load: PageServerLoad = async ({ cookies, url }) => {
const user = await getSessionUser(cookies);
if (!user) redirect(303, '/sign-in');
const database = await getDatabase();
const [builds, guides, favorites, ratings] = await Promise.all([
const [builds, guides, favorites, ratings, connection] = await Promise.all([
(await database.prepare('SELECT id, title, slug, visibility, updated_at FROM builds WHERE owner_id = ? ORDER BY updated_at DESC')).all(user.id),
(await database.prepare("SELECT id, title, slug, visibility, updated_at FROM builds WHERE owner_id = ? AND guide_body IS NOT NULL AND length(trim(guide_body)) > 0 ORDER BY updated_at DESC")).all(user.id),
(await database.prepare('SELECT builds.id, builds.title, builds.slug, users.username AS author FROM favorites JOIN builds ON builds.id = favorites.build_id JOIN users ON users.id = builds.owner_id WHERE favorites.user_id = ? ORDER BY favorites.created_at DESC')).all(user.id),
(await database.prepare('SELECT builds.id, builds.title, builds.slug, users.username AS author, ratings.value FROM ratings JOIN builds ON builds.id = ratings.build_id JOIN users ON users.id = builds.owner_id WHERE ratings.user_id = ? ORDER BY builds.updated_at DESC')).all(user.id)
(await database.prepare('SELECT builds.id, builds.title, builds.slug, COALESCE(user_profiles.display_name,users.username) AS author FROM favorites JOIN builds ON builds.id = favorites.build_id JOIN users ON users.id = builds.owner_id LEFT JOIN user_profiles ON user_profiles.user_id=users.id WHERE favorites.user_id = ? ORDER BY favorites.created_at DESC')).all(user.id),
(await database.prepare('SELECT builds.id, builds.title, builds.slug, COALESCE(user_profiles.display_name,users.username) AS author, ratings.value FROM ratings JOIN builds ON builds.id = ratings.build_id JOIN users ON users.id = builds.owner_id LEFT JOIN user_profiles ON user_profiles.user_id=users.id WHERE ratings.user_id = ? ORDER BY builds.updated_at DESC')).all(user.id),
(await database.prepare(`SELECT users.discord_id,users.password_hash,discord_profiles.username AS discord_username,
discord_profiles.display_name,discord_profiles.avatar_hash
FROM users LEFT JOIN discord_profiles ON discord_profiles.user_id=users.id WHERE users.id=?`)).get(user.id)
]);
const oauthErrorCode = url.searchParams.get('oauth_error');
const oauthErrors: Record<string, { title: string; message: string }> = {
@@ -36,20 +39,47 @@ export const load: PageServerLoad = async ({ cookies, url }) => {
message: 'Discord linking could not be completed. Your existing sign-in methods and account data were not changed.'
}
: null;
return { account: { builds, guides, favorites, ratings }, chooseUsername: url.searchParams.has('choose_username'), discordLinked: url.searchParams.has('discord_linked'), oauthError };
return {
account: { builds, guides, favorites, ratings },
discordConnection: connection?.discord_id ? {
id: String(connection.discord_id),
username: connection.discord_username ? String(connection.discord_username) : null,
displayName: connection.display_name ? String(connection.display_name) : null,
avatarHash: connection.avatar_hash ? String(connection.avatar_hash) : null,
canUnlink: typeof connection.password_hash === 'string'
} : null,
hasPassword: typeof connection?.password_hash === 'string',
chooseDisplayName: url.searchParams.has('choose_display_name'),
discordLinked: url.searchParams.has('discord_linked'),
oauthError
};
};
export const actions: Actions = {
changeUsername: async ({ request, cookies }) => {
changeLoginUsername: async ({ request, cookies }) => {
const user = await getSessionUser(cookies);
if (!user) redirect(303, '/sign-in');
const username = String((await request.formData()).get('username') ?? '').normalize('NFKC').trim();
if (username.length < 3 || username.length > 24 || !/^[\p{L}\p{N}_-]+$/u.test(username)) return fail(400, { usernameError: 'Use 3–24 letters, numbers, underscores, or hyphens.' });
if (['admin','administrator','moderator','shd','support'].includes(username.toLowerCase())) return fail(400, { usernameError: 'That username is reserved.' });
if (username.length < 3 || username.length > 32 || !/^[A-Za-z0-9_-]+$/.test(username)) return fail(400, { loginUsernameError: 'Use 3–32 ASCII letters, numbers, underscores, or hyphens.' });
if (['admin','administrator','moderator','shd','support'].includes(username.toLowerCase())) return fail(400, { loginUsernameError: 'That login username is reserved.' });
const database = await getDatabase();
if (await (await database.prepare('SELECT id FROM users WHERE username = ? COLLATE NOCASE AND id <> ?')).get(username, user.id)) return fail(409, { usernameError: 'That username is already in use.' });
if (await (await database.prepare('SELECT id FROM users WHERE username = ? COLLATE NOCASE AND id <> ?')).get(username, user.id)) return fail(409, { loginUsernameError: 'That login username is already in use.' });
await (await database.prepare('UPDATE users SET username = ? WHERE id = ?')).run(username, user.id);
return { usernameChanged: true };
return { loginUsernameChanged: true };
},
changeDisplayName: async ({ request, cookies }) => {
const user = await getSessionUser(cookies);
if (!user) redirect(303, '/sign-in');
const displayName = String((await request.formData()).get('displayName') ?? '').normalize('NFKC').trim();
const length = Array.from(displayName).length;
if (length < 2 || length > 40 || /[\p{C}\r\n]/u.test(displayName)) {
return fail(400, { displayNameError: 'Use 2–40 visible characters on one line.' });
}
const now = new Date().toISOString(), database = await getDatabase();
await (await database.prepare(`INSERT INTO user_profiles(user_id,display_name,updated_at) VALUES(?,?,?)
ON CONFLICT(user_id) DO UPDATE SET display_name=excluded.display_name,updated_at=excluded.updated_at`))
.run(user.id, displayName, now);
return { displayNameChanged: true };
},
changePassword: async ({ request, cookies }) => {
const user = await getSessionUser(cookies);
@@ -60,7 +90,8 @@ export const actions: Actions = {
if (next !== confirm) return fail(400, { passwordError: 'The new passwords do not match.' });
const database = await getDatabase();
const credential = await (await database.prepare('SELECT password_hash FROM users WHERE id = ?')).get(user.id);
if (typeof credential?.password_hash !== 'string' || !(await verifyPassword(credential.password_hash, current))) return fail(400, { passwordError: 'Your current password is incorrect.' });
if (typeof credential?.password_hash === 'string' && !(await verifyPassword(credential.password_hash, current))) return fail(400, { passwordError: 'Your current password is incorrect.' });
if (typeof credential?.password_hash !== 'string' && !user.discordLinked) return fail(400, { passwordError: 'A verified sign-in method is required before setting a password.' });
await (await database.prepare('UPDATE users SET password_hash = ? WHERE id = ?')).run(await hashPassword(next), user.id);
await (await database.prepare('DELETE FROM sessions WHERE user_id = ?')).run(user.id);
await createSession(cookies, user.id);
@@ -83,5 +114,22 @@ export const actions: Actions = {
}
cookies.delete('shd_session', { path: '/' });
redirect(303, '/?account_deleted=1');
},
unlinkDiscord: async ({ request, cookies }) => {
const user = await getSessionUser(cookies);
if (!user) redirect(303, '/sign-in');
const password = String((await request.formData()).get('password') ?? '');
const database = await getDatabase();
const credential = await (await database.prepare('SELECT password_hash,discord_id FROM users WHERE id=?')).get(user.id);
if (!credential?.discord_id) return fail(409, { discordUnlinkError: 'No Discord account is linked.' });
if (typeof credential.password_hash !== 'string') {
return fail(400, { discordUnlinkError: 'Add a password sign-in method before unlinking Discord so you do not lose access.' });
}
if (!(await verifyPassword(credential.password_hash, password))) {
return fail(400, { discordUnlinkError: 'Your password is incorrect.' });
}
await (await database.prepare('UPDATE users SET discord_id=NULL WHERE id=?')).run(user.id);
await (await database.prepare('DELETE FROM discord_profiles WHERE user_id=?')).run(user.id);
return { discordUnlinked: true };
}
};