[WIP] Create actor UI for each instance

.github/workflows/main.yaml

@@ -6,6 +6,9 @@ on:
     branches: ["**"]
     tags: ["*.*.*"]
 
+env:
+  AUBE_ALLOWED_UNPOPULAR_PACKAGES: pglite-cli
+
 jobs:
   check:
     runs-on: ubuntu-latest

.gitignore

@@ -1,5 +1,11 @@
 .DS_Store
+*.graphql
+*.graphql.ts
+__generated__/
 
 .pgdata/
+
 node_modules/
 packages/*/dist/
+
+index.db

.oxfmtrc.json

@@ -8,6 +8,7 @@
     "**/dist/*.{cjs,d.cts,d.mts,d.ts,js,mjs}",
     ".agents/skills/",
     ".claude/skills/",
-    "plans/"
+    "plans/",
+    "**/__generated__/**"
   ]
 }

.oxlintrc.json

@@ -23,8 +23,13 @@
       "always",
       { "ignoreConsecutiveComments": true }
     ],
+    "eslint/curly": ["error", "multi-line"],
+    "node/no-top-level-await": "off",
+    "oxc/no-optional-chaining": "off",
+    "oxc/no-async-await": "off",
     "eslint/eqeqeq": ["off", "smart"],
     "eslint/func-style": ["off"],
+    "eslint/max-lines-per-function": "off",
     "eslint/id-length": ["warn", { "exceptionPatterns": ["^_", "^[Tertv]$"] }],
     "eslint/init-declarations": "off",
     "eslint/max-params": ["warn", { "max": 4 }],
@@ -34,7 +39,7 @@
     "eslint/prefer-destructuring": ["warn", { "object": true, "array": false }],
     "eslint/no-continue": "off",
     "eslint/no-eq-null": "off",
-    "eslint/no-magic-numbers": "warn",
+    "eslint/no-magic-numbers": "off",
     "eslint/no-ternary": "off",
     "eslint/no-nested-ternary": "off",
     "eslint/no-undefined": "off",
@@ -45,6 +50,7 @@
       "error",
       { "allowSeparatedGroups": true, "ignoreDeclarationSort": true }
     ],
+    "oxc/no-rest-spread-properties": "off",
     "import/consistent-type-specifier-style": "off",
     "import/exports-last": "off",
     "import/group-exports": "off",

CONTRIBUTING.md

@@ -102,7 +102,7 @@ mise run dev
 
 `mise run check` runs all checks currently configured in *mise.toml*:
 
- -  TypeScript type checking with `tsgo --noEmit`.
+ -  TypeScript type checking with `tsc --noEmit`.
  -  TypeScript/JavaScript formatting with `oxfmt --check`.
  -  Markdown formatting with `hongdown --check`.
  -  *mise.toml* formatting with `mise fmt --check`.

mise.toml

@@ -2,12 +2,11 @@ min_version = "2026.6.10"
 
 [tools]
 "aqua:dahlia/hongdown" = "0.4.3"
-"github:nushell/nushell" = "latest"
+"github:nushell/nushell" = "0.114.1"
 node = "26"
-"npm:@typescript/native-preview" = "7.0.0-dev.20260620.1"
-"npm:oxlint" = "latest"
-"npm:oxlint-tsgolint" = "latest"
-"npm:pglite-cli" = "latest"
+"npm:oxlint" = "1.75.0"
+"npm:oxlint-tsgolint" = "7.0.2001"
+"npm:pglite-cli" = "0.0.1"
 oxfmt = "0.55.0"
 pnpm = "11"
 
@@ -17,18 +16,34 @@ auto = true
 [hooks]
 postinstall = ["mise deps", "mise generate git-pre-commit --task check --write"]
 
+[tasks.build]
+description = "Build the project"
+depends = ["build:web"]
+silent = "stdout"
+
+[tasks."build:server"]
+description = "Build the project except web"
+run = "pnpm --parallel -F @drfed/graphql -F @drfed/models -F @drfed/drfed build"
+silent = "stdout"
+
 [tasks."build:web"]
 description = "Build SolidStart frontend server"
+depends = [
+  { task = "generate:graphql-schema", args = [
+    "--output-file",
+    "packages/web/schema.graphql",
+  ] },
+]
 dir = "./packages/web"
-run = "pnpm run build"
+run = "pnpm exec relay-compiler --noWatchman && pnpm run build"
 
 [tasks.check]
 description = "Check all"
 depends = ["check:*"]
 
 [tasks."check:types"]
 description = "Check TypeScript types"
-run = "pnpm --recursive exec tsgo --noEmit"
+run = "pnpm --recursive exec tsc --noEmit"
 
 [tasks."check:lint"]
 description = "Check linting"
@@ -77,11 +92,6 @@ run = """
 node scripts/add-license/main.mts
 """
 
-[tasks.build]
-description = "Build the project"
-run = "pnpm run --parallel --recursive build"
-silent = "stdout"
-
 [tasks.test]
 description = "Run tests"
 depends = ["build"]
@@ -130,7 +140,7 @@ description = "Generate GraphQL schema"
 usage = """
 flag "-o --output-file <file>" help="The output file for the generated GraphQL schema.  - for stdout.  Defaults to -"
 """
-depends = ["build"]
+depends = ["build:server"]
 run = """
 #!/usr/bin/env nu
 let output_file = (if "usage_output_file" in $env { $env.usage_output_file } else { "-" })
@@ -154,7 +164,11 @@ run = "node scripts/dev.mts"
 raw_args = true
 description = "Run SolidStart frontend server"
 dir = "./packages/web"
-run = "pnpm run dev"
+run = """
+#!/usr/bin/env nu
+mise run generate:graphql-schema --output-file ./packages/web/schema.graphql
+pnpm run dev
+"""
 
 [tasks."drfed-server"]
 description = "Invoke drfed-server command"

packages/drfed/package.json

@@ -51,7 +51,8 @@
   },
   "tsdown": {
     "dts": {
-      "sourcemap": true
+      "sourcemap": true,
+      "tsconfig": "../../tsconfig.drfed.json"
     },
     "sourcemap": true
   },

packages/drfed/src/seed.ts

@@ -22,10 +22,12 @@ export default async function seedData(db: Database): Promise<void> {
   });
 }
 
+const sessionId = "00000000-0000-4000-8000-000000000000";
 const accountId = "00000000-0000-4000-8000-000000000001";
 const memberId = "00000000-0000-4000-8000-000000000002";
 const pendingMemberId = "00000000-0000-4000-8000-000000000003";
 const created = new Date("2026-06-24T00:00:00.000Z");
+const tokenHash = "dev-token-hash";
 
 async function seedAccounts(db: Database): Promise<void> {
   await db
@@ -51,4 +53,17 @@ async function seedAccounts(db: Database): Promise<void> {
       },
     ])
     .onConflictDoNothing();
+  await db
+    .insert(schema.sessions)
+    .values([
+      {
+        id: sessionId,
+        accountId,
+        tokenHash,
+      },
+    ])
+    .onConflictDoUpdate({
+      target: schema.sessions.id,
+      set: { tokenHash },
+    });
 }

packages/graphql/package.json

@@ -76,7 +76,8 @@
       "src/schema.ts"
     ],
     "dts": {
-      "sourcemap": true
+      "sourcemap": true,
+      "tsconfig": "../../tsconfig.graphql.json"
     },
     "sourcemap": true
   },
@@ -100,11 +101,13 @@
     "@pothos/plugin-drizzle": "^0.17.4",
     "@pothos/plugin-errors": "^4.9.1",
     "@pothos/plugin-relay": "^4.7.0",
+    "@pothos/plugin-scope-auth": "^4.1.7",
     "@upyo/core": "catalog:",
     "@upyo/mock": "catalog:",
     "drizzle-orm": "catalog:",
     "graphql": "catalog:",
     "graphql-scalars": "^1.25.0",
-    "graphql-yoga": "^5.21.2"
+    "graphql-yoga": "^5.21.2",
+    "uuid": "catalog:"
   }
 }

packages/graphql/src/auth/hash.ts

@@ -34,6 +34,8 @@ export const hashSecret = async (raw: string): Promise<string> =>
 
 const textEncoder = new TextEncoder();
 
+// FIXME: We should use `SubtleCrypto.verify()` instead of comparing the HMACs
+// ourselves.  https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/verify#hmac
 export async function equalSecretHashes(
   leftHash: string,
   rightHash: string,
@@ -47,6 +49,8 @@ export async function equalSecretHashes(
 
   return difference === 0;
 }
+// FIXME: We should store the key in a secure place and not generate it
+// every time the server starts.
 const compareKey = await crypto.subtle.generateKey(
   { name: "HMAC", hash: "SHA-256" },
   false,

packages/graphql/src/builder.ts

@@ -21,6 +21,7 @@ import SchemaBuilder, { type ObjectRef } from "@pothos/core";
 import DrizzlePlugin from "@pothos/plugin-drizzle";
 import ErrorsPlugin from "@pothos/plugin-errors";
 import RelayPlugin from "@pothos/plugin-relay";
+import ScopeAuthPlugin from "@pothos/plugin-scope-auth";
 import type { Transport } from "@upyo/core";
 import { getTableConfig } from "drizzle-orm/pg-core";
 import { DateTimeResolver, UUIDResolver } from "graphql-scalars";
@@ -95,6 +96,10 @@ export interface SchemaTypes {
   };
   DefaultFieldNullability: false;
   DrizzleRelations: typeof relations;
+  AuthScopes: {
+    authenticated: boolean;
+    admin: boolean;
+  };
 }
 
 export type DrFedSchemaTypes =
@@ -118,8 +123,17 @@ export const builder = new SchemaBuilder<SchemaTypes>({
     getTableConfig,
     relations,
   },
-  plugins: [DrizzlePlugin, RelayPlugin, ErrorsPlugin],
+  plugins: [DrizzlePlugin, RelayPlugin, ErrorsPlugin, ScopeAuthPlugin],
   errors: { defaultTypes: [] },
+  scopeAuth: {
+    authorizeOnSubscribe: true,
+    authScopes(context) {
+      return {
+        authenticated: Boolean(context.session),
+        admin: Boolean(context.account?.admin),
+      };
+    },
+  },
 });
 
 builder.addScalarType("DateTime", DateTimeResolver);

packages/graphql/src/index.ts

@@ -62,6 +62,10 @@ export function createYogaServer(
 ): YogaServerInstance<ServerContext, UserContext> {
   const options = fillOptions(_options);
   return createYoga({
+    cors: {
+      origin: [...options.origins],
+      credentials: true,
+    },
     async context(ctx) {
       const anonymous = { db, request: ctx.request, ...options };
       const accessToken = getAccessToken(ctx.request.headers);
@@ -92,7 +96,14 @@ function mockTransport() {
 const fillOptions = (opt: YogaServerOptions): Required<YogaServerOptions> => ({
   mailer: opt?.mailer ?? mockTransport(),
   emailFrom: opt?.emailFrom ?? "[email protected]",
-  origins: opt?.origins ?? new Set(["https://drfed.org"]),
+  // FIXME: Properly parametrize the following allowlist:
+  origins:
+    opt?.origins ??
+    new Set([
+      "https://drfed.org",
+      "http://localhost:3000",
+      "http://0.0.0.0:3000",
+    ]),
 });
 
 const getAccessToken = (headers: Headers) =>