flowtyped everything, some functional, safety, and structural changes

api/auth.js

@@ -1,6 +1,11 @@
-module.exports = (R, $) => {
-  R.post('/api/auth/token', async (ctx) => {
-    const { token } = ctx.request.body
+// @flow
+import { type Context } from 'koa'
+import { type AppContext, type Router } from '../Roleypoly'
+import ksuid from 'ksuid'
+
+export default (R: Router, $: AppContext) => {
+  R.post('/api/auth/token', async (ctx: Context) => {
+    const { token } = ((ctx.request.body: any): { token: string })
 
     if (token == null || token === '') {
       ctx.body = { err: 'token_missing' }
@@ -29,14 +34,15 @@ module.exports = (R, $) => {
     }
   })
 
-  R.get('/api/auth/user', async ctx => {
-    if (ctx.session.accessToken === undefined) {
+  R.get('/api/auth/user', async (ctx: Context) => {
+    const { accessToken } = (ctx.session: { accessToken?: string })
+    if (accessToken === undefined) {
       ctx.body = { err: 'not_logged_in' }
       ctx.status = 401
       return
     }
 
-    const user = await $.discord.getUser(ctx.session.accessToken)
+    const user = await $.discord.getUser(accessToken)
     ctx.session.userId = user.id
     ctx.session.avatarHash = user.avatar
 
@@ -48,8 +54,8 @@ module.exports = (R, $) => {
     }
   })
 
-  R.get('/api/auth/redirect', ctx => {
-    const url = $.discord.getAuthUrl()
+  R.get('/api/auth/redirect', async (ctx: Context) => {
+    const url = $.discord.getAuthUrl(ksuid.randomSync().string)
     if (ctx.query.url === '✔️') {
       ctx.body = { url }
       return
@@ -58,11 +64,11 @@ module.exports = (R, $) => {
     ctx.redirect(url)
   })
 
-  R.post('/api/auth/logout', ctx => {
+  R.post('/api/auth/logout', async (ctx: Context) => {
     ctx.session = null
   })
 
-  R.get('/api/oauth/bot', ctx => {
+  R.get('/api/oauth/bot', async (ctx: Context) => {
     const url = $.discord.getBotJoinUrl()
     if (ctx.query.url === '✔️') {
       ctx.body = { url }
@@ -72,7 +78,7 @@ module.exports = (R, $) => {
     ctx.redirect(url)
   })
 
-  R.get('/api/oauth/bot/callback', ctx => {
-    console.log(ctx.request)
+  R.get('/api/oauth/bot/callback', async (ctx: Context) => {
+    // console.log(ctx.request)
   })
 }

api/index.js

@@ -1,9 +1,14 @@
-const log = new (require('../logger'))('api/index')
-const glob = require('glob')
+// @flow
+import logger from '../logger'
+import glob from 'glob'
+
+import type { Router, AppContext } from '../Roleypoly'
+
+const log = logger(__filename)
 
 const PROD = process.env.NODE_ENV === 'production'
 
-module.exports = async (router, ctx, { forceClear = false } = {}) => {
+export default async (router: Router, ctx: AppContext, { forceClear = false }: { forceClear: boolean } = {}) => {
   const apis = glob.sync(`./api/**/!(index).js`)
   log.debug('found apis', apis)
 
@@ -18,7 +23,8 @@ module.exports = async (router, ctx, { forceClear = false } = {}) => {
       if (forceClear) {
         delete require.cache[require.resolve(pathname)]
       }
-      require(pathname)(router, ctx)
+      // $FlowFixMe this isn't an important error. potentially dangerous, but irrelevant.
+      require(pathname).default(router, ctx)
     } catch (e) {
       log.error(`couldn't mount ${a}`, e)
     }

api/servers.js

@@ -1,5 +1,10 @@
-module.exports = (R, $) => {
-  R.get('/api/servers', async (ctx) => {
+// @flow
+import { type Context } from 'koa'
+import { type AppContext, type Router } from '../Roleypoly'
+import { type ServerModel } from '../models/Server'
+
+export default (R: Router, $: AppContext) => {
+  R.get('/api/servers', async (ctx: Context) => {
     try {
       const { userId } = ctx.session
       const srv = $.discord.getRelevantServers(userId)
@@ -11,7 +16,7 @@ module.exports = (R, $) => {
     }
   })
 
-  R.get('/api/server/:id', async (ctx) => {
+  R.get('/api/server/:id', async (ctx: Context) => {
     const { userId } = ctx.session
     const { id } = ctx.params
 
@@ -28,17 +33,21 @@ module.exports = (R, $) => {
       gm = $.discord.gm(id, userId)
     } else if ($.discord.isRoot(userId)) {
       gm = $.discord.fakeGm({ id: userId })
-    } else {
+    }
+
+    if (gm == null) {
       ctx.body = { err: 'not_a_member' }
       ctx.status = 400
       return
     }
+
     const server = await $.P.presentableServer(srv, gm)
 
+    // $FlowFixMe bad koa type
     ctx.body = server
   })
 
-  R.get('/api/server/:id/slug', async (ctx) => {
+  R.get('/api/server/:id/slug', async (ctx: Context) => {
     // const { userId } = ctx.session
     const { id } = ctx.params
 
@@ -52,16 +61,25 @@ module.exports = (R, $) => {
       return
     }
 
+    // $FlowFixMe bad koa type
     ctx.body = await $.P.serverSlug(srv)
   })
 
-  R.patch('/api/server/:id', async (ctx) => {
-    const { userId } = ctx.session
-    const { id } = ctx.params
+  R.patch('/api/server/:id', async (ctx: Context) => {
+    const { userId } = (ctx.session: { userId: string })
+    const { id } = (ctx.params: { id: string })
 
     let gm = $.discord.gm(id, userId)
-    if (gm == null && $.discord.isRoot(userId)) {
-      gm = $.discord.fakeGm({ id: userId })
+    if (gm == null) {
+      if ($.discord.isRoot(userId)) {
+        gm = $.discord.fakeGm({ id: userId })
+      } else {
+        ctx.status = 403
+        ctx.body = {
+          err: 'not permitted'
+        }
+        return
+      }
     }
 
     // check perms
@@ -71,7 +89,7 @@ module.exports = (R, $) => {
       return
     }
 
-    const { message = null, categories = null } = ctx.request.body
+    const { message, categories } = ((ctx.request.body: any): $Shape<ServerModel>)
 
     // todo make less nasty
     await $.server.update(id, {
@@ -82,32 +100,33 @@ module.exports = (R, $) => {
     ctx.body = { ok: true }
   })
 
-  R.get('/api/admin/servers', async ctx => {
-    const { userId } = ctx.session
+  R.get('/api/admin/servers', async (ctx: Context) => {
+    const { userId } = (ctx.session: { userId: string })
     if (!$.discord.isRoot(userId)) {
       return
     }
 
-    ctx.body = $.discord.client.guilds.map(g => ({ url: `${process.env.APP_URL}/s/${g.id}`, name: g.name, members: g.members.array().length, roles: g.roles.array().length }))
+    ctx.body = $.discord.client.guilds.map(g => ({ url: `${$.config.appUrl}/s/${g.id}`, name: g.name, members: g.members.array().length, roles: g.roles.array().length }))
   })
 
-  R.patch('/api/servers/:server/roles', async ctx => {
-    const { userId } = ctx.session
-    const { server } = ctx.params
+  R.patch('/api/servers/:server/roles', async (ctx: Context) => {
+    const { userId } = (ctx.session: { userId: string })
+    const { server } = (ctx.params: { server: string })
 
     let gm = $.discord.gm(server, userId)
-    if (gm == null && $.discord.isRoot(userId)) {
-      gm = $.discord.fakeGm({ id: userId })
+    if (gm == null) {
+      if ($.discord.isRoot(userId)) {
+        gm = $.discord.fakeGm({ id: userId })
+      } else {
+        ctx.status = 403
+        ctx.body = {
+          err: 'not permitted'
+        }
+        return
+      }
     }
 
-    // check perms
-    // if (!$.discord.getPermissions(gm).canManageRoles) {
-    //   ctx.status = 403
-    //   ctx.body = { err: 'cannot_manage_roles' }
-    //   return
-    // }
-
-    const { added, removed } = ctx.request.body
+    const { added, removed } = ((ctx.request.body: any): { added: string[], removed: string[] })
 
     const allowedRoles = await $.server.getAllowedRoles(server)
 
@@ -118,13 +137,20 @@ module.exports = (R, $) => {
     }
 
     setTimeout(() => {
+      if (gm == null) {
+        ctx.body = {
+          err: 'guild member disappeared on remove, this should never happen.'
+        }
+        ctx.status = 500
+
+        return
+      }
+
       if (removed.length > 0) {
         gm.removeRoles(removed.filter(pred))
       }
     }, 1000)
 
-    // console.log('role patch', { added, removed, allowedRoles, addedFiltered: added.filterNot(pred), removedFiltered: removed.filterNot(pred) })
-
     ctx.body = { ok: true }
   })
 }

api/servers_test.js

@@ -1,25 +1,28 @@
-module.exports = (R, $) => {
-  R.get('/api/~/relevant-servers/:user', (ctx, next) => {
+// @flow
+import { type Context } from 'koa'
+import { type AppContext, type Router } from '../Roleypoly'
+export default (R: Router, $: AppContext) => {
+  R.get('/api/~/relevant-servers/:user', async (ctx: Context, next: () => void) => {
     // ctx.body = 'ok'
     const srv = $.discord.getRelevantServers(ctx.params.user)
-    ctx.body = $.discord.presentableServers(srv, ctx.params.user)
+    ctx.body = $.P.presentableServers(srv, ctx.params.user)
   })
 
-  R.get('/api/~/roles/:id/:userId', (ctx, next) => {
-    // ctx.body = 'ok'
-    const { id, userId } = ctx.params
+  // R.get('/api/~/roles/:id/:userId', (ctx, next) => {
+  //   // ctx.body = 'ok'
+  //   const { id, userId } = ctx.params
 
-    const srv = $.discord.client.guilds.get(id)
+  //   const srv = $.discord.client.guilds.get(id)
 
-    if (srv === undefined) {
-      ctx.body = { err: 'not found' }
-      ctx.status = 404
-      return
-    }
+  //   if (srv === undefined) {
+  //     ctx.body = { err: 'not found' }
+  //     ctx.status = 404
+  //     return
+  //   }
 
-    const gm = srv.members.get(userId)
-    const roles = $.discord.presentableRoles(id, gm)
+  //   const gm = srv.members.get(userId)
+  //   const roles = $.P.presentableRoles(id, gm)
 
-    ctx.boy = roles
-  })
+  //   ctx.boy = roles
+  // })
 }

api/ui.js

@@ -1,17 +1,36 @@
-// note, this file only contains stuff for complicated routes.
-// next.js will handle anything beyond this.
-module.exports = (R, $) => {
-  const processMappings = mapping => {
+// @flow
+import { type Context } from 'koa'
+import { type AppContext, type Router } from '../Roleypoly'
+export default (R: Router, $: AppContext) => {
+  // note, this file only contains stuff for complicated routes.
+  // next.js will handle anything beyond this.
+  const processMappings = (mapping: { [path: string]: { path: string, noAutoFix?: boolean } }) => {
     for (let p in mapping) {
-      R.get(p, ctx => {
-        return $.ui.render(ctx.req, ctx.res, mapping[p], { ...ctx.query, ...ctx.params })
+      R.get(p, (ctx: Context) => {
+        return $.ui.render(ctx.req, ctx.res, mapping[p].path || mapping[p], { ...ctx.query, ...ctx.params })
       })
+
+      const { path } = mapping[p]
+      if (!mapping[p].noAutoFix) {
+        R.get(path, ctx => ctx.redirect(p))
+      }
     }
   }
 
   processMappings({
-    '/s/add': '/_internal/_server_add',
-    '/s/:id': '/_internal/_server',
-    '/test': '/test'
+    '/s/add': { path: '/_internal/_server_add' },
+    '/s/:id': { path: '/_internal/_server', noAutoFix: true },
+    '/test': { path: '/test_wwsw' }
   })
+
+  // edge cases
+  R.get('/_internal/_server', (ctx: Context) => {
+    if (ctx.query.id) {
+      return ctx.redirect(`/s/${ctx.query.id}`)
+    }
+
+    return ctx.redirect('/s/add')
+  })
+
+  R.get('/s/', (ctx: Context) => ctx.redirect('/s/add'))
 }