famapp/src/modules/_core/share.ts

"use server";

import { createHash, randomBytes } from "crypto";
import { and, eq, isNull } from "drizzle-orm";
import { db } from "@/lib/db";
import { getCurrentSession } from "@/lib/session";
import { getEntityType } from "./registry";
import { shareLinks } from "./schema";

export type ShareLinkCapabilities = { read: boolean; write: boolean };

export type CreateShareLinkResult = {
  url: string;
  token: string;
  expiresAt: Date | null;
};

function hashToken(raw: string): string {
  return createHash("sha256").update(raw).digest("hex");
}

function buildUrl(token: string): string {
  const base = process.env["NEXTAUTH_URL"] ?? "http://localhost:3000";
  return `${base}/s/${token}`;
}

export async function createShareLink(
  entityType: string,
  entityId: string,
  opts: { expiresAt?: Date; capabilities?: Partial<ShareLinkCapabilities> } = {},
): Promise<CreateShareLinkResult> {
  const registration = getEntityType(entityType);
  if (!registration?.share?.canShare) {
    throw new Error(`Entity type "${entityType}" is not shareable`);
  }

  const { user, household } = await getCurrentSession();

  const rawToken = randomBytes(32).toString("base64url");
  const tokenHash = hashToken(rawToken);

  const capabilities: ShareLinkCapabilities = {
    read: opts.capabilities?.read ?? true,
    write: opts.capabilities?.write ?? false,
  };

  const expiresAt = opts.expiresAt ?? null;

  await db.insert(shareLinks).values({
    householdId: household.id,
    entityType,
    entityId,
    token: tokenHash,
    capabilities,
    createdBy: user.id,
    expiresAt,
  });

  return { url: buildUrl(rawToken), token: rawToken, expiresAt };
}

export async function resolveShareToken(rawToken: string): Promise<{
  entityType: string;
  entityId: string;
  capabilities: ShareLinkCapabilities;
  householdId: string;
  expiresAt: Date | null;
  createdBy: string;
} | null> {
  const tokenHash = hashToken(rawToken);

  const [link] = await db
    .select()
    .from(shareLinks)
    .where(and(eq(shareLinks.token, tokenHash), isNull(shareLinks.revokedAt)))
    .limit(1);

  if (!link) return null;

  if (link.expiresAt && link.expiresAt < new Date()) return null;

  return {
    entityType: link.entityType,
    entityId: link.entityId,
    capabilities: link.capabilities,
    householdId: link.householdId,
    expiresAt: link.expiresAt,
    createdBy: link.createdBy,
  };
}

export async function revokeShareLink(id: string): Promise<void> {
  const { household } = await getCurrentSession();

  await db
    .update(shareLinks)
    .set({ revokedAt: new Date() })
    .where(and(eq(shareLinks.id, id), eq(shareLinks.householdId, household.id)));
}

export type ActiveShareLink = typeof shareLinks.$inferSelect;

export async function getActiveShareLinks(): Promise<ActiveShareLink[]> {
  const { household } = await getCurrentSession();
  const now = new Date();

  const rows = await db
    .select()
    .from(shareLinks)
    .where(
      and(
        eq(shareLinks.householdId, household.id),
        isNull(shareLinks.revokedAt),
        // exclude already-expired links
      ),
    )
    .orderBy(shareLinks.createdAt);

  // Filter expired in JS since OR NULL handling is cleaner here
  return rows.filter((r) => !r.expiresAt || r.expiresAt > now);
}