neta/server/auth/setup.ts

import "server-only";

import { count, eq } from "drizzle-orm";
import { getSqliteConnection } from "@/server/db/client";
import { appProfiles, appSetupState, authAuditEvents } from "@/server/db/schema";
import type { AuthAuditEventType } from "@/server/auth/types";
import { getDefaultDisplayName, normalizeAuthEmail } from "@/server/auth/validation";

const FIRST_FREELANCER_SETUP_KEY = "first_freelancer";
const SETUP_LOCK_TTL_MS = 10 * 60 * 1000;

export type FirstFreelancerSetupState = {
  available: boolean;
  locked: boolean;
  errorMessage?: string;
};

export async function getFirstFreelancerSetupState(): Promise<FirstFreelancerSetupState> {
  try {
    return readFirstFreelancerSetupState();
  } catch (error) {
    return {
      available: false,
      locked: false,
      errorMessage:
        error instanceof Error
          ? error.message
          : "İlk kurulum durumu okunamadı.",
    };
  }
}

export function readFirstFreelancerSetupState(): FirstFreelancerSetupState {
  const { db } = getSqliteConnection();
  const [{ value: freelancerCount }] = db
    .select({ value: count() })
    .from(appProfiles)
    .where(eq(appProfiles.role, "freelancer"))
    .all();

  if (freelancerCount > 0) {
    return { available: false, locked: false };
  }

  const [setupState] = db
    .select()
    .from(appSetupState)
    .where(eq(appSetupState.key, FIRST_FREELANCER_SETUP_KEY))
    .limit(1)
    .all();

  if (!setupState) {
    return { available: true, locked: false };
  }

  if (setupState.status === "completed") {
    return { available: false, locked: false };
  }

  const lockedAt = setupState.lockedAt?.getTime() ?? 0;
  const isStale = Date.now() - lockedAt > SETUP_LOCK_TTL_MS;

  return {
    available: isStale,
    locked: !isStale,
    errorMessage: isStale ? undefined : "İlk kurulum şu anda başka bir istek tarafından işleniyor.",
  };
}

export async function reserveFirstFreelancerSetup(email: string): Promise<boolean> {
  const normalizedEmail = normalizeAuthEmail(email);
  const { db } = getSqliteConnection();

  return db.transaction((tx) => {
    const [{ value: freelancerCount }] = tx
      .select({ value: count() })
      .from(appProfiles)
      .where(eq(appProfiles.role, "freelancer"))
      .all();

    if (freelancerCount > 0) {
      return false;
    }

    const [setupState] = tx
      .select()
      .from(appSetupState)
      .where(eq(appSetupState.key, FIRST_FREELANCER_SETUP_KEY))
      .limit(1)
      .all();

    const now = new Date();

    if (setupState?.status === "completed") {
      return false;
    }

    if (setupState?.status === "pending") {
      const lockedAt = setupState.lockedAt?.getTime() ?? 0;

      if (Date.now() - lockedAt <= SETUP_LOCK_TTL_MS) {
        return false;
      }
    }

    tx.insert(appSetupState)
      .values({
        key: FIRST_FREELANCER_SETUP_KEY,
        status: "pending",
        lockedBy: normalizedEmail,
        lockedAt: now,
        updatedAt: now,
      })
      .onConflictDoUpdate({
        target: appSetupState.key,
        set: {
          status: "pending",
          lockedBy: normalizedEmail,
          lockedAt: now,
          updatedAt: now,
        },
      })
      .run();

    tx.insert(authAuditEvents)
      .values({
        type: "setup_started",
        email: normalizedEmail,
        metadata: { source: "better_auth_user_create" },
      })
      .run();

    return true;
  });
}

export async function completeFirstFreelancerSetup(user: {
  id: string;
  email: string;
  name?: string | null;
}): Promise<void> {
  const normalizedEmail = normalizeAuthEmail(user.email);
  const now = new Date();
  const { db } = getSqliteConnection();

  db.transaction((tx) => {
    tx.insert(appProfiles)
      .values({
        authUserId: user.id,
        email: normalizedEmail,
        displayName: user.name || getDefaultDisplayName(normalizedEmail),
        role: "freelancer",
        disabled: false,
        createdAt: now,
        updatedAt: now,
      })
      .onConflictDoNothing()
      .run();

    tx.insert(appSetupState)
      .values({
        key: FIRST_FREELANCER_SETUP_KEY,
        status: "completed",
        lockedBy: normalizedEmail,
        lockedAt: now,
        completedAt: now,
        updatedAt: now,
      })
      .onConflictDoUpdate({
        target: appSetupState.key,
        set: {
          status: "completed",
          lockedBy: normalizedEmail,
          completedAt: now,
          updatedAt: now,
        },
      })
      .run();

    tx.insert(authAuditEvents)
      .values({
        type: "setup_completed",
        authUserId: user.id,
        email: normalizedEmail,
        metadata: { role: "freelancer" },
      })
      .run();
  });
}

export async function recordAuthAuditEvent(input: {
  type: AuthAuditEventType;
  authUserId?: string | null;
  email?: string | null;
  metadata?: Record<string, unknown> | null;
}): Promise<void> {
  const { db } = getSqliteConnection();

  db.insert(authAuditEvents)
    .values({
      type: input.type,
      authUserId: input.authUserId ?? null,
      email: input.email ? normalizeAuthEmail(input.email) : null,
      metadata: input.metadata ?? null,
    })
    .run();
}