|
| 1 | +import type { Metadata } from 'next' |
| 2 | +import { notFound } from 'next/navigation' |
| 3 | + |
| 4 | +import { quotePrefill } from '@forum/threads' |
| 5 | +import { requireSlot } from '@forum/theme-kit' |
| 6 | + |
| 7 | +import { ReplyForm } from '@/components/content/reply-form' |
| 8 | +import { getContainer } from '@/server/container' |
| 9 | +import { getActor } from '@/server/context' |
| 10 | +import { activeTheme } from '@/server/theme' |
| 11 | +import { buildReplyView } from '@/view/post-form' |
| 12 | + |
| 13 | +export const metadata: Metadata = { title: 'Reply' } |
| 14 | + |
| 15 | +function threadId(value: string): number | null { |
| 16 | + const match = /^(\d+)(?:-|$)/.exec(value) |
| 17 | + if (!match) return null |
| 18 | + const id = Number(match[1]) |
| 19 | + return Number.isSafeInteger(id) && id > 0 ? id : null |
| 20 | +} |
| 21 | + |
| 22 | +function quotedPostId(value: string | undefined): number | null { |
| 23 | + if (value === undefined || !/^[1-9]\d*$/.test(value)) return null |
| 24 | + const id = Number(value) |
| 25 | + return Number.isSafeInteger(id) ? id : null |
| 26 | +} |
| 27 | + |
| 28 | +export default async function ReplyPage({ |
| 29 | + params, |
| 30 | + searchParams, |
| 31 | +}: { |
| 32 | + params: Promise<{ slug: string }> |
| 33 | + searchParams: Promise<{ quote?: string }> |
| 34 | +}) { |
| 35 | + const [{ slug }, query] = await Promise.all([params, searchParams]) |
| 36 | + const id = threadId(slug) |
| 37 | + if (id === null) notFound() |
| 38 | + |
| 39 | + const actor = await getActor() |
| 40 | + const { authorizer, posts, threadWrites } = getContainer() |
| 41 | + if (threadWrites === null) notFound() |
| 42 | + |
| 43 | + const target = await threadWrites.replyTarget(id) |
| 44 | + if (!target || target.visibility !== 'visible') notFound() |
| 45 | + |
| 46 | + const scope = { |
| 47 | + forumId: target.forum.id, |
| 48 | + forum: await authorizer.forumMatrix(actor, target.forum.id), |
| 49 | + } |
| 50 | + if (!authorizer.can(actor, 'thread.view', scope)) notFound() |
| 51 | + if (!authorizer.can(actor, 'reply.post', scope)) notFound() |
| 52 | + |
| 53 | + const moderates = authorizer.can(actor, 'content.viewUnapproved', scope) |
| 54 | + const locked = target.isLocked && !moderates |
| 55 | + |
| 56 | + /* |
| 57 | + * The quote is resolved here, on the server, so quoting works with scripting |
| 58 | + * off: it is a link to this page, not a button that edits a textarea. The |
| 59 | + * quoted post is re-read through the visible-post lookup rather than trusted |
| 60 | + * from the query string — otherwise `?quote=<id>` is a way to paste any post |
| 61 | + * on the board, including one in a forum the quoter cannot see, into a forum |
| 62 | + * where everyone can. |
| 63 | + */ |
| 64 | + const quoteId = quotedPostId(query.quote) |
| 65 | + let prefill = '' |
| 66 | + if (quoteId !== null) { |
| 67 | + const quoted = await posts.findQuotable(id, quoteId) |
| 68 | + if (quoted) { |
| 69 | + prefill = quotePrefill({ |
| 70 | + postId: quoted.id, |
| 71 | + authorUsername: quoted.authorUsername, |
| 72 | + message: quoted.message, |
| 73 | + }) |
| 74 | + } |
| 75 | + } |
| 76 | + |
| 77 | + const view = buildReplyView({ |
| 78 | + thread: { id: target.threadId, title: target.title, slug: target.slug }, |
| 79 | + errorMessage: locked ? 'This thread is locked.' : null, |
| 80 | + }) |
| 81 | + |
| 82 | + const PostForm = requireSlot(activeTheme, 'PostForm') |
| 83 | + |
| 84 | + return ( |
| 85 | + <main id="board-content" tabIndex={-1} className="flex-1"> |
| 86 | + <PostForm |
| 87 | + {...view} |
| 88 | + regions={{ |
| 89 | + form: locked ? null : ( |
| 90 | + <ReplyForm |
| 91 | + threadId={target.threadId} |
| 92 | + seenLastPostId={target.lastPostId} |
| 93 | + prefill={prefill} |
| 94 | + canSubscribe={authorizer.can(actor, 'forum.subscribe', scope)} |
| 95 | + /> |
| 96 | + ), |
| 97 | + toolbar: null, |
| 98 | + }} |
| 99 | + /> |
| 100 | + </main> |
| 101 | + ) |
| 102 | +} |
0 commit comments