fix(housekeeping): address people moderation review

src/features/housekeeping/domains/people/commands/support-commands.ts

@@ -2,6 +2,7 @@ import "server-only";
 
 import { z } from "zod";
 import { PERMS } from "@/lib/permission-slugs";
+import { CANONICAL_TICKET_ID_PATTERN } from "@/lib/services/ticket-replies";
 import type { HousekeepingCommand } from "../../../foundation/commands/registry";
 import { anyCapability } from "../../../foundation/contracts";
 import {
@@ -24,26 +25,7 @@ export const SUPPORT_COMMAND_IDS = [
 type SupportCommandId = (typeof SUPPORT_COMMAND_IDS)[number];
 const positiveId = z.number().int().positive();
 const text = (max: number) => z.string().min(1).max(max).regex(/\S/u);
-const MAX_UNSIGNED_BIGINT = "18446744073709551615";
-function boundedDecimalPattern(maximum: string): RegExp {
-	const alternatives = [`[1-9]\\d{0,${maximum.length - 2}}`];
-	for (let index = 0; index < maximum.length; index += 1) {
-		const maximumDigit = Number(maximum[index]);
-		const minimumDigit = index === 0 ? 1 : 0;
-		const upperDigit = maximumDigit - 1;
-		if (upperDigit < minimumDigit) continue;
-		const digit =
-			upperDigit === minimumDigit
-				? String(minimumDigit)
-				: `[${minimumDigit}-${upperDigit}]`;
-		alternatives.push(
-			`${maximum.slice(0, index)}${digit}\\d{${maximum.length - index - 1}}`,
-		);
-	}
-	alternatives.push(maximum);
-	return new RegExp(`^(?:${alternatives.join("|")})$`, "u");
-}
-const bigintId = z.string().regex(boundedDecimalPattern(MAX_UNSIGNED_BIGINT));
+const bigintId = z.string().regex(CANONICAL_TICKET_ID_PATTERN);
 
 function command<I>(
 	service: Pick<PeopleMutationService, "execute">,

src/features/housekeeping/domains/people/inbox.ts

@@ -12,6 +12,7 @@ import {
 	type HousekeepingWorkItem,
 	ok,
 } from "../../foundation/contracts";
+import { isSafeHousekeepingHref } from "../../foundation/housekeeping-href";
 import { peopleModerationQuery } from "./queries/moderation";
 import { peopleSupportQuery } from "./queries/support";
 
@@ -41,17 +42,6 @@ export interface PeopleInboxAdapters {
 	): Promise<readonly HousekeepingWorkItem[]>;
 }
 
-function safeHref(href: string): boolean {
-	return (
-		href.startsWith("/ase/") &&
-		!href.includes("\\") &&
-		!Array.from(href).some((character) => {
-			const code = character.codePointAt(0) ?? 0;
-			return code < 32 || code === 127;
-		})
-	);
-}
-
 function createSource(
 	id: (typeof PEOPLE_INBOX_SOURCE_IDS)[number],
 	capability: CapabilityRequirement,
@@ -72,7 +62,7 @@ function createSource(
 						items: items
 							.filter(
 								(item) =>
-									safeHref(item.href) &&
+									isSafeHousekeepingHref(item.href) &&
 									satisfiesCapability(context, item.capability),
 							)
 							.slice(0, 25),

src/features/housekeeping/domains/people/pages/support.tsx

@@ -11,7 +11,10 @@ import {
 	peopleSupportQuery,
 } from "../queries/support";
 import { PeoplePageFrame, parsePeopleListInput } from "./page-state";
-import { PeopleCommandForm } from "./people-command-form";
+import {
+	PeopleCommandForm,
+	type PeopleCommandSubmission,
+} from "./people-command-form";
 
 interface Props {
 	readonly context: HousekeepingCapabilityContext;
@@ -34,6 +37,52 @@ function Queue({ queue }: { readonly queue: { tickets: number; helpTickets: numb
 	);
 }
 
+type PeopleTicketTemplate = Extract<
+	PeopleSupportQueryData,
+	{ readonly kind: "ticket-templates" }
+>["page"]["items"][number];
+
+export function ticketTemplateUpdateSubmission(
+	template: PeopleTicketTemplate,
+): PeopleCommandSubmission {
+	return {
+		commandId: "people.ticket-template.change",
+		input: { action: "update", id: template.id },
+		fields: [
+			{
+				name: "title",
+				label: "Title",
+				type: "text",
+				required: true,
+				maxLength: 255,
+				defaultValue: template.title,
+			},
+			{
+				name: "content",
+				label: "Content",
+				type: "text",
+				required: true,
+				maxLength: 5_000,
+				defaultValue: template.content,
+			},
+			{
+				name: "category",
+				label: "Category",
+				type: "text",
+				maxLength: 50,
+				defaultValue: template.category,
+			},
+			{
+				name: "sortOrder",
+				label: "Sort order",
+				type: "number",
+				min: 0,
+				defaultValue: template.sortOrder,
+			},
+		],
+	};
+}
+
 export function PeopleSupportPage({ context, result }: Props) {
 	return (
 		<PeoplePageFrame
@@ -66,11 +115,17 @@ export function PeopleSupportPage({ context, result }: Props) {
 										<h2>{template.title}</h2>
 										<p>{template.content}</p>
 										{context.has(PERMS.TICKETS_EDIT) ? (
-											<PeopleCommandForm
-												commandId="people.ticket-template.change"
-												buttonLabel="Delete template"
-												input={{ action: "delete", id: template.id }}
-											/>
+											<div className="space-y-3">
+												<PeopleCommandForm
+													{...ticketTemplateUpdateSubmission(template)}
+													buttonLabel="Update template"
+												/>
+												<PeopleCommandForm
+													commandId="people.ticket-template.change"
+													buttonLabel="Delete template"
+													input={{ action: "delete", id: template.id }}
+												/>
+											</div>
 										) : null}
 									</li>
 								))}

src/features/housekeeping/domains/people/people-widgets-production.test.ts

@@ -0,0 +1,100 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { PERMS } from "@/lib/permission-slugs";
+import type { HousekeepingCapabilityContext } from "../../foundation/contracts";
+
+const mocks = vi.hoisted(() => ({
+	execute: vi.fn(),
+	fetchTicketQueueOpenCounts: vi.fn(),
+}));
+
+vi.mock("@/lib/admin/ticket-queue-counts", () => ({
+	fetchTicketQueueOpenCounts: mocks.fetchTicketQueueOpenCounts,
+}));
+vi.mock("@/lib/db", () => {
+	return { db: { execute: mocks.execute } };
+});
+
+import { PEOPLE_WIDGETS } from "./widgets";
+
+function context(granted: readonly string[]): HousekeepingCapabilityContext {
+	const permissions = new Set(granted);
+	return {
+		actor: { id: 42, username: "operator", rank: 4 },
+		isSuperAdmin: false,
+		has: (slug) => permissions.has(slug),
+		hasAny: (...slugs) => slugs.some((slug) => permissions.has(slug)),
+		hasAll: (...slugs) => slugs.every((slug) => permissions.has(slug)),
+	};
+}
+
+async function load(granted: readonly string[]) {
+	return PEOPLE_WIDGETS[0].load(
+		context(granted),
+		new AbortController().signal,
+	);
+}
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	mocks.fetchTicketQueueOpenCounts.mockResolvedValue({
+		cmsOpen: 1,
+		helpOpen: 2,
+	});
+});
+
+describe("People production queue widget", () => {
+	it("wires ticket-only, CFH-only, ban-only, mixed, and denied contexts without unauthorized reads", async () => {
+		await expect(load([PERMS.MOD_TICKETS_VIEW])).resolves.toMatchObject({
+			ok: true,
+			data: { tickets: 1, helpTickets: 2, cfh: 0, activeBans: 0 },
+		});
+		expect(mocks.fetchTicketQueueOpenCounts).toHaveBeenCalledTimes(1);
+		expect(mocks.execute).not.toHaveBeenCalled();
+
+		vi.clearAllMocks();
+		mocks.execute.mockResolvedValueOnce([[{ total: 3 }], []]);
+		await expect(load([PERMS.MOD_CFH_VIEW])).resolves.toMatchObject({
+			ok: true,
+			data: { tickets: 0, helpTickets: 0, cfh: 3, activeBans: 0 },
+		});
+		expect(mocks.fetchTicketQueueOpenCounts).not.toHaveBeenCalled();
+		expect(mocks.execute).toHaveBeenCalledTimes(1);
+
+		vi.clearAllMocks();
+		mocks.execute.mockResolvedValueOnce([[{ total: 4 }], []]);
+		await expect(load([PERMS.MOD_BANS_VIEW])).resolves.toMatchObject({
+			ok: true,
+			data: { tickets: 0, helpTickets: 0, cfh: 0, activeBans: 4 },
+		});
+		expect(mocks.fetchTicketQueueOpenCounts).not.toHaveBeenCalled();
+		expect(mocks.execute).toHaveBeenCalledTimes(1);
+
+		vi.clearAllMocks();
+		mocks.fetchTicketQueueOpenCounts.mockResolvedValue({
+			cmsOpen: 1,
+			helpOpen: 2,
+		});
+		mocks.execute
+			.mockResolvedValueOnce([[{ total: 3 }], []])
+			.mockResolvedValueOnce([[{ total: 4 }], []]);
+		const mixed = await load([
+				PERMS.MOD_TICKETS_VIEW,
+				PERMS.MOD_CFH_VIEW,
+				PERMS.MOD_BANS_VIEW,
+			]);
+		expect(mocks.fetchTicketQueueOpenCounts).toHaveBeenCalledTimes(1);
+		expect(mocks.execute).toHaveBeenCalledTimes(2);
+		expect(mixed).toMatchObject({
+			ok: true,
+			data: { tickets: 1, helpTickets: 2, cfh: 3, activeBans: 4 },
+		});
+
+		vi.clearAllMocks();
+		await expect(load([])).resolves.toMatchObject({
+			ok: false,
+			error: { code: "FORBIDDEN" },
+		});
+		expect(mocks.fetchTicketQueueOpenCounts).not.toHaveBeenCalled();
+		expect(mocks.execute).not.toHaveBeenCalled();
+	});
+});

src/features/housekeeping/domains/people/search.ts

@@ -11,6 +11,7 @@ import {
 	type HousekeepingSearchProvider,
 	ok,
 } from "../../foundation/contracts";
+import { isSafeHousekeepingHref } from "../../foundation/housekeeping-href";
 import { peopleCommunityQuery } from "./queries/community";
 import { peopleSupportQuery } from "./queries/support";
 import { peopleUsersQuery } from "./queries/users";
@@ -47,17 +48,6 @@ export interface PeopleSearchAdapters {
 	): Promise<readonly PeopleSearchCandidate[]>;
 }
 
-function safeHref(href: string): href is `/ase/${string}` {
-	return (
-		href.startsWith("/ase/") &&
-		!href.includes("\\") &&
-		!Array.from(href).some((character) => {
-			const code = character.codePointAt(0) ?? 0;
-			return code < 32 || code === 127;
-		})
-	);
-}
-
 function boundedLimit(limit: number): number {
 	return Number.isFinite(limit) ? Math.min(25, Math.max(1, Math.trunc(limit))) : 25;
 }
@@ -82,7 +72,7 @@ function createProvider(
 					candidates
 						.filter(
 							(item) =>
-								safeHref(item.href) &&
+								isSafeHousekeepingHref(item.href) &&
 								satisfiesCapability(context, item.capability),
 						)
 						.slice(0, limit)

src/features/housekeeping/domains/people/services/mutations-server-auth.test.ts

@@ -93,4 +93,24 @@ describe("People production server authority", () => {
 		expect(alertUser).not.toHaveBeenCalled();
 		expect(audit).not.toHaveBeenCalled();
 	});
+
+	it("blocks Task 13 moderation work before intent audit or transport on actor mismatch", async () => {
+		resolveServerContext.mockResolvedValue(context([PERMS.MOD_ACTIONS]));
+		const result = await peopleMutationService.execute(
+			{
+				correlationId: "task13-server-authority",
+				expectedActorId: 99,
+				legacy: true,
+			},
+			"moderation.action",
+			{ action: "alert", userId: 7, message: "Stop" },
+		);
+		expect(result).toMatchObject({
+			ok: false,
+			error: { code: "FORBIDDEN" },
+			correlationId: "task13-server-authority",
+		});
+		expect(alertUser).not.toHaveBeenCalled();
+		expect(audit).not.toHaveBeenCalled();
+	});
 });

src/features/housekeeping/domains/people/widgets-production.ts

@@ -0,0 +1,43 @@
+import "server-only";
+
+import { sql } from "drizzle-orm";
+import { fetchTicketQueueOpenCounts } from "@/lib/admin/ticket-queue-counts";
+import { db } from "@/lib/db";
+import { createPeopleQueueAggregateLoader } from "./widgets";
+
+function count(value: unknown): number {
+	const parsed = Number(value);
+	if (!Number.isSafeInteger(parsed) || parsed < 0) {
+		throw new Error("invalid queue count");
+	}
+	return parsed;
+}
+
+export const loadPeopleQueueAggregate = createPeopleQueueAggregateLoader({
+	async support(signal) {
+		if (signal.aborted) throw new Error("aborted queue aggregate");
+		const counts = await fetchTicketQueueOpenCounts({ strict: true });
+		return { tickets: counts.cmsOpen, helpTickets: counts.helpOpen };
+	},
+	async cfh(signal) {
+		if (signal.aborted) throw new Error("aborted queue aggregate");
+		const result = await db.execute(
+			sql`SELECT COUNT(*) AS total FROM support_tickets WHERE state <> 2`,
+		);
+		if (!Array.isArray(result) || !Array.isArray(result[0])) {
+			throw new Error("invalid CFH queue count");
+		}
+		return count((result[0] as Array<{ total: unknown }>)[0]?.total);
+	},
+	async activeBans(signal) {
+		if (signal.aborted) throw new Error("aborted queue aggregate");
+		const result = await db.execute(sql`
+			SELECT COUNT(*) AS total FROM bans
+			WHERE ban_expire = 0 OR ban_expire > UNIX_TIMESTAMP()
+		`);
+		if (!Array.isArray(result) || !Array.isArray(result[0])) {
+			throw new Error("invalid ban queue count");
+		}
+		return count((result[0] as Array<{ total: unknown }>)[0]?.total);
+	},
+});

src/features/housekeeping/domains/people/widgets.ts

@@ -11,7 +11,6 @@ import {
 	ok,
 } from "../../foundation/contracts";
 import type { PeopleQueueSnapshot } from "./models";
-import { peopleSupportQuery } from "./queries/support";
 
 export interface PeopleWidgetAdapters {
 	queue(
@@ -20,6 +19,14 @@ export interface PeopleWidgetAdapters {
 	): Promise<PeopleQueueSnapshot>;
 }
 
+export interface PeopleQueueAggregateAdapters {
+	support(
+		signal: AbortSignal,
+	): Promise<Readonly<{ tickets: number; helpTickets: number }>>;
+	cfh(signal: AbortSignal): Promise<number>;
+	activeBans(signal: AbortSignal): Promise<number>;
+}
+
 const supportQueueCapability = anyCapability(
 	PERMS.TICKETS_VIEW,
 	PERMS.MOD_TICKETS_VIEW,
@@ -38,6 +45,40 @@ const queueCapability = anyCapability(
 	...banQueueCapability.slugs,
 );
 
+function count(value: unknown): number {
+	const parsed = Number(value);
+	if (!Number.isSafeInteger(parsed) || parsed < 0) {
+		throw new Error("invalid queue count");
+	}
+	return parsed;
+}
+
+export function createPeopleQueueAggregateLoader(
+	adapters: PeopleQueueAggregateAdapters,
+): PeopleWidgetAdapters["queue"] {
+	return async (context, signal) => {
+		const authorization = authorizeHousekeeping(context, queueCapability);
+		if (!authorization.ok) throw new Error("forbidden queue aggregate");
+		if (signal.aborted) throw new Error("aborted queue aggregate");
+		const supportAllowed = satisfiesCapability(context, supportQueueCapability);
+		const cfhAllowed = satisfiesCapability(context, cfhQueueCapability);
+		const bansAllowed = satisfiesCapability(context, banQueueCapability);
+		const [support, cfh, activeBans] = await Promise.all([
+			supportAllowed
+				? adapters.support(signal)
+				: Promise.resolve({ tickets: 0, helpTickets: 0 }),
+			cfhAllowed ? adapters.cfh(signal) : Promise.resolve(0),
+			bansAllowed ? adapters.activeBans(signal) : Promise.resolve(0),
+		]);
+		return {
+			tickets: count(support.tickets),
+			helpTickets: count(support.helpTickets),
+			cfh: count(cfh),
+			activeBans: count(activeBans),
+		};
+	};
+}
+
 export function createPeopleWidgets(
 	adapters: PeopleWidgetAdapters,
 ): readonly HousekeepingWidgetDefinition[] {
@@ -80,11 +121,8 @@ export function createPeopleWidgets(
 }
 
 export const PEOPLE_WIDGETS = createPeopleWidgets({
-	async queue(context) {
-		const result = await peopleSupportQuery.run(context, {
-			routeId: "people.support.queue",
-		});
-		if (!result.ok || result.data.kind !== "queue") throw new Error("queue");
-		return result.data.queue;
+	async queue(context, signal) {
+		const { loadPeopleQueueAggregate } = await import("./widgets-production");
+		return loadPeopleQueueAggregate(context, signal);
 	},
 });