Important Fixes, New mechanics, and many more

apps/web/server/api/v1/campaigns/[id]/characters.post.ts

@@ -0,0 +1,53 @@
+import { AbilityScoresSchema } from '@dng/shared'
+import { z } from 'zod'
+import { requireCampaignAccess, requireStageTwoSafeText, requireStageTwoUser, stageTwoApiError, stageTwoDatabase, stageTwoUuid } from '~/server/utils/stage-two-supabase'
+
+const BodySchema = z.object({
+  name: z.string().trim().min(1).max(80),
+  concept: z.string().trim().min(3).max(600),
+  controller: z.enum(['human', 'ai']).default('human'),
+  abilities: AbilityScoresSchema,
+  hp: z.number().int().min(0),
+  maxHp: z.number().int().min(1),
+  defense: z.number().int().min(1).max(40),
+  proficiency: z.number().int().min(1).max(10).default(2),
+  inventory: z.array(z.string().trim().min(1).max(120)).max(50).default([]),
+  statuses: z.array(z.string().trim().min(1).max(80)).max(12).default([]),
+  persona: z.record(z.string(), z.unknown()).default({}),
+}).strict().refine(value => value.hp <= value.maxHp, { message: 'hp must not exceed maxHp', path: ['hp'] })
+
+export default defineEventHandler(async (event) => {
+  try {
+    const user = await requireStageTwoUser(event)
+    const campaignId = stageTwoUuid(getRouterParam(event, 'id'), 'campaign id')
+    const access = await requireCampaignAccess(campaignId, user.id)
+    const body = BodySchema.parse(await readBody(event))
+    if (body.controller === 'ai' && !access.owner) {
+      throw createError({ statusCode: 403, statusMessage: 'Only the campaign owner can add AI heroes.' })
+    }
+    requireStageTwoSafeText([body.name, body.concept, ...body.inventory, ...body.statuses, JSON.stringify(body.persona)].join('\n'))
+    const rows = await stageTwoDatabase<Array<Record<string, unknown>>>('characters', {
+      method: 'POST',
+      prefer: 'return=representation',
+      body: JSON.stringify({
+        campaign_id: campaignId,
+        user_id: body.controller === 'human' ? user.id : null,
+        name: body.name,
+        concept: body.concept,
+        controller: body.controller,
+        abilities: body.abilities,
+        hp: body.hp,
+        max_hp: body.maxHp,
+        defense: body.defense,
+        proficiency: body.proficiency,
+        inventory: body.inventory,
+        statuses: body.statuses,
+        persona: body.persona,
+      }),
+    })
+    setResponseStatus(event, 201)
+    return { character: rows[0] }
+  } catch (error) {
+    stageTwoApiError(error)
+  }
+})

apps/web/server/api/v1/campaigns/[id]/invites.post.ts

@@ -0,0 +1,32 @@
+import { createHash, randomBytes } from 'node:crypto'
+import { z } from 'zod'
+import { requireCampaignAccess, requireStageTwoUser, stageTwoApiError, stageTwoDatabase, stageTwoUuid } from '~/server/utils/stage-two-supabase'
+
+const BodySchema = z.object({
+  maxUses: z.number().int().min(1).max(20).default(1),
+  expiresInHours: z.number().int().min(1).max(720).default(72),
+}).strict()
+
+export default defineEventHandler(async (event) => {
+  try {
+    const user = await requireStageTwoUser(event)
+    const campaignId = stageTwoUuid(getRouterParam(event, 'id'), 'campaign id')
+    await requireCampaignAccess(campaignId, user.id, true)
+    const body = BodySchema.parse((await readBody(event)) ?? {})
+    const token = randomBytes(32).toString('base64url')
+    const tokenHash = createHash('sha256').update(token).digest('hex')
+    const expiresAt = new Date(Date.now() + body.expiresInHours * 3_600_000).toISOString()
+    await stageTwoDatabase('invites', {
+      method: 'POST',
+      prefer: 'return=minimal',
+      body: JSON.stringify({
+        campaign_id: campaignId, created_by: user.id, token_hash: tokenHash,
+        max_uses: body.maxUses, expires_at: expiresAt,
+      }),
+    })
+    setResponseStatus(event, 201)
+    return { token, expiresAt, maxUses: body.maxUses }
+  } catch (error) {
+    stageTwoApiError(error)
+  }
+})

apps/web/server/api/v1/campaigns/[id]/members/[memberId].patch.ts

@@ -0,0 +1,26 @@
+import { z } from 'zod'
+import { requireCampaignAccess, requireStageTwoUser, stageTwoApiError, stageTwoDatabase, stageTwoUuid } from '~/server/utils/stage-two-supabase'
+
+const BodySchema = z.object({ aiTakeoverAllowed: z.boolean() }).strict()
+
+export default defineEventHandler(async (event) => {
+  try {
+    const user = await requireStageTwoUser(event)
+    const campaignId = stageTwoUuid(getRouterParam(event, 'id'), 'campaign id')
+    const memberId = stageTwoUuid(getRouterParam(event, 'memberId'), 'member id')
+    await requireCampaignAccess(campaignId, user.id, true)
+    const body = BodySchema.parse(await readBody(event))
+    const members = await stageTwoDatabase<Array<Record<string, unknown>>>(
+      `campaign_members?id=eq.${memberId}&campaign_id=eq.${campaignId}`,
+      {
+        method: 'PATCH',
+        prefer: 'return=representation',
+        body: JSON.stringify({ ai_takeover_allowed: body.aiTakeoverAllowed }),
+      },
+    )
+    if (!members[0]) throw createError({ statusCode: 404, statusMessage: 'Campaign member not found.' })
+    return { member: members[0] }
+  } catch (error) {
+    stageTwoApiError(error)
+  }
+})

apps/web/server/api/v1/campaigns/[id]/rounds/[roundId]/force.post.ts

@@ -0,0 +1,22 @@
+import { requireCampaignAccess, requireStageTwoUser, stageTwoApiError, stageTwoDatabase, stageTwoRpc, stageTwoUuid } from '~/server/utils/stage-two-supabase'
+
+export default defineEventHandler(async (event) => {
+  try {
+    const user = await requireStageTwoUser(event)
+    const campaignId = stageTwoUuid(getRouterParam(event, 'id'), 'campaign id')
+    const roundId = stageTwoUuid(getRouterParam(event, 'roundId'), 'round id')
+    await requireCampaignAccess(campaignId, user.id, true)
+    const rounds = await stageTwoDatabase<Array<{ id: string; status: string }>>(
+      `rounds?select=id,status&id=eq.${roundId}&campaign_id=eq.${campaignId}&limit=1`,
+    )
+    if (!rounds[0]) throw createError({ statusCode: 404, statusMessage: 'Round not found.' })
+    if (rounds[0].status !== 'open') throw createError({ statusCode: 409, statusMessage: 'Round is not open.' })
+    const jobId = await stageTwoRpc<string>('stage_two_force_round', {
+      p_round_id: roundId, p_owner_id: user.id,
+    })
+    setResponseStatus(event, 202)
+    return { jobId, status: 'queued' }
+  } catch (error) {
+    stageTwoApiError(error)
+  }
+})

apps/web/server/api/v1/campaigns/[id]/rounds/[roundId]/intent.put.ts

@@ -0,0 +1,34 @@
+import { z } from 'zod'
+import { requireCampaignAccess, requireStageTwoSafeText, requireStageTwoUser, stageTwoApiError, stageTwoDatabase, stageTwoRpc, stageTwoUuid } from '~/server/utils/stage-two-supabase'
+
+const BodySchema = z.object({
+  characterId: z.string().uuid(),
+  action: z.string().trim().min(1).max(2000),
+  ready: z.boolean().default(false),
+}).strict()
+
+export default defineEventHandler(async (event) => {
+  try {
+    const user = await requireStageTwoUser(event)
+    const campaignId = stageTwoUuid(getRouterParam(event, 'id'), 'campaign id')
+    const roundId = stageTwoUuid(getRouterParam(event, 'roundId'), 'round id')
+    await requireCampaignAccess(campaignId, user.id)
+    const rounds = await stageTwoDatabase<Array<{ id: string; status: string }>>(
+      `rounds?select=id,status&id=eq.${roundId}&campaign_id=eq.${campaignId}&limit=1`,
+    )
+    if (!rounds[0]) throw createError({ statusCode: 404, statusMessage: 'Round not found.' })
+    if (rounds[0].status !== 'open') throw createError({ statusCode: 409, statusMessage: 'Round is not open.' })
+    const body = BodySchema.parse(await readBody(event))
+    requireStageTwoSafeText(body.action)
+    const result = await stageTwoRpc<Record<string, unknown>>('stage_two_submit_intent', {
+      p_round_id: roundId,
+      p_user_id: user.id,
+      p_character_id: body.characterId,
+      p_action: body.action,
+      p_ready: body.ready,
+    })
+    return result
+  } catch (error) {
+    stageTwoApiError(error)
+  }
+})

apps/web/server/api/v1/campaigns/[id]/rounds/[roundId]/ready.post.ts

@@ -0,0 +1,36 @@
+import { z } from 'zod'
+import { requireCampaignAccess, requireStageTwoUser, stageTwoApiError, stageTwoDatabase, stageTwoRpc, stageTwoUuid } from '~/server/utils/stage-two-supabase'
+
+const BodySchema = z.object({ ready: z.boolean().default(true) }).strict()
+
+export default defineEventHandler(async (event) => {
+  try {
+    const user = await requireStageTwoUser(event)
+    const campaignId = stageTwoUuid(getRouterParam(event, 'id'), 'campaign id')
+    const roundId = stageTwoUuid(getRouterParam(event, 'roundId'), 'round id')
+    await requireCampaignAccess(campaignId, user.id)
+    const body = BodySchema.parse((await readBody(event)) ?? {})
+    const rounds = await stageTwoDatabase<Array<{ id: string; status: string }>>(
+      `rounds?select=id,status&id=eq.${roundId}&campaign_id=eq.${campaignId}&limit=1`,
+    )
+    if (!rounds[0]) throw createError({ statusCode: 404, statusMessage: 'Round not found.' })
+    if (rounds[0].status !== 'open') throw createError({ statusCode: 409, statusMessage: 'Round is not open.' })
+    const members = await stageTwoDatabase<Array<{ id: string }>>(
+      `campaign_members?select=id&campaign_id=eq.${campaignId}&user_id=eq.${user.id}&active=eq.true&limit=1`,
+    )
+    if (!members[0]) throw createError({ statusCode: 403, statusMessage: 'Active campaign membership not found.' })
+    const intents = await stageTwoDatabase<Array<{ character_id: string; action: string }>>(
+      `player_intents?select=character_id,action&round_id=eq.${roundId}&member_id=eq.${members[0].id}&limit=1`,
+    )
+    if (!intents[0]) throw createError({ statusCode: 409, statusMessage: 'Submit an action before marking ready.' })
+    return await stageTwoRpc<Record<string, unknown>>('stage_two_submit_intent', {
+      p_round_id: roundId,
+      p_user_id: user.id,
+      p_character_id: intents[0].character_id,
+      p_action: intents[0].action,
+      p_ready: body.ready,
+    })
+  } catch (error) {
+    stageTwoApiError(error)
+  }
+})

apps/web/server/api/v1/campaigns/[id]/rounds/[roundId]/retry.post.ts

@@ -0,0 +1,23 @@
+import { requireCampaignAccess, requireStageTwoUser, stageTwoApiError, stageTwoDatabase, stageTwoRpc, stageTwoUuid } from '~/server/utils/stage-two-supabase'
+
+export default defineEventHandler(async (event) => {
+  try {
+    const user = await requireStageTwoUser(event)
+    const campaignId = stageTwoUuid(getRouterParam(event, 'id'), 'campaign id')
+    const roundId = stageTwoUuid(getRouterParam(event, 'roundId'), 'round id')
+    await requireCampaignAccess(campaignId, user.id, true)
+    const rounds = await stageTwoDatabase<Array<{ id: string; status: string }>>(
+      `rounds?select=id,status&id=eq.${roundId}&campaign_id=eq.${campaignId}&limit=1`,
+    )
+    if (!rounds[0]) throw createError({ statusCode: 404, statusMessage: 'Round not found.' })
+    if (rounds[0].status !== 'failed') throw createError({ statusCode: 409, statusMessage: 'Only a failed round can be retried.' })
+    const jobId = await stageTwoRpc<string>('stage_two_retry_failed_round', {
+      p_round_id: roundId,
+      p_owner_id: user.id,
+    })
+    setResponseStatus(event, 202)
+    return { jobId, status: 'queued' }
+  } catch (error) {
+    stageTwoApiError(error)
+  }
+})