feat: add signed Discord command foundation and daily check-ins

src/discord/routes.ts

@@ -0,0 +1,62 @@
+import { createPublicKey, verify } from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { Hono } from 'hono';
+import { bodyLimit } from 'hono/body-limit';
+import { ZodError } from 'zod';
+import { publicUser, type AppDatabase } from '../auth';
+import { users, discordReceipts } from '../db/schema';
+import { ApiError, HabitService } from '../habits/service';
+import { ControlStore } from './state';
+import { interactionSchema, type Context, type Reply } from './types';
+import { dailyAction, today } from './daily';
+import { message } from './ui';
+
+export type CommandConfig = { publicKey: string; applicationId: string; origin: string };
+export function createDiscordRoutes(db: AppDatabase, config: CommandConfig, now = Date.now, changed: (userId: string) => void = () => {}) {
+  const app = new Hono();
+  const key = /^[a-f\d]{64}$/i.test(config.publicKey) ? createPublicKey({ key: Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), Buffer.from(config.publicKey, 'hex')]), format: 'der', type: 'spki' }) : null;
+  app.use('*', bodyLimit({ maxSize: 64 * 1024 }));
+  app.post('/', async c => {
+    c.header('Cache-Control', 'no-store');
+    if (!key) return c.json({ error: 'Discord commands are not configured.' }, 503);
+    const signature = c.req.header('X-Signature-Ed25519') ?? '', timestamp = c.req.header('X-Signature-Timestamp') ?? '';
+    const body = await c.req.text();
+    if (!/^\d{10,12}$/.test(timestamp) || Math.abs(now() - Number(timestamp) * 1000) > 300000 || !/^[a-f\d]{128}$/i.test(signature) || !verify(null, Buffer.from(timestamp + body), key, Buffer.from(signature, 'hex')))
+      return c.json({ error: 'Invalid request signature.' }, 401);
+    let value: unknown;
+    try { value = JSON.parse(body); } catch { return c.json({ error: "Malformed JSON." }, 400); }
+    const parsed = interactionSchema.safeParse(value);
+    if (!parsed.success || parsed.data.application_id !== config.applicationId) return c.json({ error: 'Invalid interaction.' }, 400);
+    const i = parsed.data;
+    if (i.type === 1) return c.json({ type: 1 });
+    const profile = i.guild_id ? i.member?.user : i.user;
+    if (!profile || ![2, 3, 4, 5].includes(i.type)) return c.json({ error: 'Unsupported interaction.' }, 400);
+    const reply = db.transaction((): Reply => {
+      const existing = db.select().from(users).where(eq(users.discordId, profile.id)).get();
+      const userId = existing?.id ?? crypto.randomUUID();
+      if (!existing) db.insert(users).values({ id: userId, discordId: profile.id, username: profile.username, globalName: profile.global_name, avatarHash: profile.avatar, createdAt: now(), updatedAt: now() }).run();
+      const receipt = db.select().from(discordReceipts).where(eq(discordReceipts.id, i.id)).get();
+      if (receipt && receipt.expiresAt > now()) return receipt.response;
+      const user = publicUser(db.select().from(users).where(eq(users.id, userId)).get()!);
+      const controls = new ControlStore(db, userId, now()); controls.prune();
+      const service = new HabitService(db, user, now()); service.sync();
+      const ctx: Context = { db, service, controls, interaction: i, now: now(), origin: config.origin, changed: () => changed(userId) };
+      let result: Reply;
+      try {
+        if (i.type === 4) result = { type: 8, data: { choices: [] } };
+        else if (i.type === 2 && i.data?.name === 'today') result = today(ctx);
+        else if ([3, 5].includes(i.type)) {
+          const state = controls.read(i.data?.custom_id ?? '');
+          result = dailyAction(ctx, state.action, state.payload) ?? message(ctx, 'Run /today to get started.', [], false);
+        } else result = message(ctx, 'Run /today to get started.', [], false);
+      } catch (error) {
+        if (!(error instanceof ApiError) && !(error instanceof ZodError)) throw error;
+        result = message(ctx, error instanceof ApiError ? error.message : 'Check the entered values and try again.', [], false);
+      }
+      db.insert(discordReceipts).values({ id: i.id, userId, response: result, expiresAt: now() + 86400000 }).run();
+      return result;
+    });
+    return c.json(reply);
+  });
+  return app;
+}