app/lib/people-admin.server.ts

Functions

Imports

It imports app/db/schema.ts, app/lib/agent-keys.server.ts, app/lib/people.server.ts, app/lib/roles.ts. Imported by app/routes/people.tsx.

Source

1// Managing who is in Carrel (Owner only): add a person, set or remove their role on a project,
2// disable or re-enable them. Every change goes through here, with the Owner check inside each
3// function, so the page and any later tool meet the same rule.
4//
5// Carrel's rows decide what a person may do once they are in. Getting in is Cloudflare Access, which
6// Carrel does not manage: adding a person here does not let them past Access (people.tsx says where).
7
8import { and, asc, eq, isNull } from "drizzle-orm";
9import { drizzle } from "drizzle-orm/d1";
10
11import { people, projectMembers, projects } from "~/db/schema";
12import { agentEmail, isAgentName } from "~/lib/agent-keys.server";
13import type { Viewer } from "~/lib/people.server";
14import type { Role } from "~/lib/roles";
15
16/** A refusal the Owner reads on the page: the rule said no, and nothing changed. */
17export class PeopleRefusal extends Error {
18  constructor(message: string) {
19    super(message);
20    this.name = "PeopleRefusal";
21  }
22}
23
24/** Anyone but the Owner is answered as if the page did not exist. */
25function requireOwner(viewer: Viewer) {
26  if (!viewer.isOwner || viewer.isReviewer) throw new Response("Not found", { status: 404 });
27}
28
29export type PersonRow = {
30  id: number;
31  email: string;
32  name: string;
33  isOwner: boolean;
34  isReviewer: boolean;
35  disabledAt: string | null;
36  roles: { projectId: number; role: Exclude<Role, "owner"> }[];
37};
38
39export type ProjectRow = { id: number; slug: string; name: string; kind: "site" | "book" | null };
40
41export async function listPeople(db: D1Database, viewer: Viewer): Promise<{ people: PersonRow[]; projects: ProjectRow[] }> {
42  requireOwner(viewer);
43  const d = drizzle(db);
44  const [rows, members, projectRows] = await Promise.all([
45    d
46      .select({ id: people.id, email: people.email, name: people.name, isOwner: people.isOwner, isReviewer: people.isReviewer, disabledAt: people.disabledAt })
47      .from(people)
48      .orderBy(asc(people.email))
49      .all(),
50    d.select().from(projectMembers).all(),
51    d.select({ id: projects.id, slug: projects.slug, name: projects.name, site: projects.site, book: projects.book }).from(projects).orderBy(asc(projects.name)).all(),
52  ]);
53  return {
54    // The Owner first: the one row nothing here can change.
55    people: rows
56      .map((p) => ({ ...p, roles: members.filter((m) => m.personId === p.id).map(({ projectId, role }) => ({ projectId, role })) }))
57      .sort((a, b) => Number(b.isOwner) - Number(a.isOwner)),
58    projects: projectRows.map(({ site, book, ...p }) => ({ ...p, kind: site ? "site" : book ? "book" : null })),
59  };
60}
61
62const EMAIL = /^[^\s@'"<>]+@[^\s@'"<>]+\.[^\s@'"<>]+$/;
63
64/**
65 * Adds a person. Never an Owner: Carrel has one Owner, and this function cannot make another (the
66 * database refuses a second as well). An email already in Carrel is refused rather than changed.
67 */
68export async function addPerson(db: D1Database, viewer: Viewer, input: { email: string; name: string; reviewer: boolean }): Promise<PersonRow> {
69  requireOwner(viewer);
70  const email = input.email.trim().toLowerCase();
71  if (!EMAIL.test(email) || email.length > 254) throw new PeopleRefusal("That is not an email address.");
72  return insertPerson(db, { email, name: input.name.trim().slice(0, 200), isReviewer: input.reviewer });
73}
74
75/** Inserts a person who is never an Owner and has no role yet, refusing an email Carrel already has. */
76async function insertPerson(db: D1Database, values: { email: string; name: string; isReviewer: boolean }): Promise<PersonRow> {
77  const d = drizzle(db);
78  const existing = await d.select({ id: people.id }).from(people).where(eq(people.email, values.email)).get();
79  if (existing) throw new PeopleRefusal(`${values.email} is already in Carrel.`);
80  const [row] = await d
81    .insert(people)
82    .values({ ...values, isOwner: false })
83    .returning({ id: people.id, email: people.email, name: people.name, isOwner: people.isOwner, isReviewer: people.isReviewer, disabledAt: people.disabledAt });
84  return { ...row!, roles: [] };
85}
86
87/**
88 * Adds a named AI agent: the person row "agent:<name>" that an AGENT_KEY_<NAME> secret resolves to at
89 * the AI door. Never an Owner, never a reviewer, and it starts with no role on any project. Adding the
90 * row grants nothing by itself: the key is a Worker secret the Owner sets, and the role is set below.
91 */
92export async function addAgent(db: D1Database, viewer: Viewer, input: { name: string; label?: string }): Promise<PersonRow> {
93  requireOwner(viewer);
94  const name = input.name.trim().toLowerCase();
95  if (!isAgentName(name)) throw new PeopleRefusal("An agent's name is letters, digits, hyphens and underscores, up to 32, such as grok.");
96  return insertPerson(db, { email: agentEmail(name), name: input.label?.trim().slice(0, 200) || name, isReviewer: false });
97}
98
99async function target(db: D1Database, personId: number) {
100  const row = await drizzle(db)
101    .select({ id: people.id, email: people.email, isOwner: people.isOwner, isReviewer: people.isReviewer, disabledAt: people.disabledAt })
102    .from(people)
103    .where(eq(people.id, personId))
104    .get();
105  if (!row) throw new PeopleRefusal("No such person.");
106  return row;
107}
108
109/**
110 * Sets a person's role on a project, or removes it (role null). The Owner has no per-project role to
111 * set: the Owner is the Owner everywhere, and cannot be demoted here. A reviewer reads and flags only,
112 * so a reviewer can be a Reader and never an Editor.
113 */
114export async function setProjectRole(db: D1Database, viewer: Viewer, personId: number, projectId: number, role: "reader" | "editor" | null): Promise<void> {
115  requireOwner(viewer);
116  const person = await target(db, personId);
117  if (person.isOwner) throw new PeopleRefusal("The Owner's role cannot be changed: the Owner is the Owner on every project.");
118  if (role === "editor" && person.isReviewer) throw new PeopleRefusal(`${person.email} is a reviewer. Reviewers read and flag only, so they can be a Reader, never an Editor.`);
119  const d = drizzle(db);
120  const project = await d.select({ id: projects.id }).from(projects).where(eq(projects.id, projectId)).get();
121  if (!project) throw new PeopleRefusal("No such project.");
122  if (role === null) {
123    await d.delete(projectMembers).where(and(eq(projectMembers.projectId, projectId), eq(projectMembers.personId, personId)));
124    return;
125  }
126  await d
127    .insert(projectMembers)
128    .values({ projectId, personId, role })
129    .onConflictDoUpdate({ target: [projectMembers.projectId, projectMembers.personId], set: { role } });
130}
131
132/**
133 * Disables a person (they are refused at both doors at once, because every request looks the person
134 * up again) or re-enables them. The Owner cannot be disabled: that would lock Carrel with no one able
135 * to undo it.
136 */
137export async function setDisabled(db: D1Database, viewer: Viewer, personId: number, disabled: boolean, now = new Date()): Promise<void> {
138  requireOwner(viewer);
139  const person = await target(db, personId);
140  if (person.isOwner || person.id === viewer.id) throw new PeopleRefusal("The Owner cannot be disabled.");
141  await drizzle(db)
142    .update(people)
143    .set({ disabledAt: disabled ? now.toISOString() : null })
144    .where(disabled ? and(eq(people.id, personId), isNull(people.disabledAt)) : eq(people.id, personId));
145}