Add effect because I coldn't resist

packages/backend/src/app.ts

@@ -1,8 +1,8 @@
 import cors from "@elysiajs/cors";
 import { swagger } from "@elysiajs/swagger";
-import { AttachmentId, PieceId, RequestId, SessionId, Sha256 } from "common";
+import { AttachmentId, PieceId, RequestId, SessionId, Sha256, UserId } from "common";
 import * as Function from "common/Function";
-import { Elysia, error, form, t } from "elysia";
+import { Elysia, error, t } from "elysia";
 import { sql } from "kysely";
 import { generateSessionId, initDatabase } from "./database";
 
@@ -148,6 +148,35 @@ const app = new Elysia()
 			.execute();
 	})
 
+	// --- MARK: USER MANAGEMENT -----------------------------------------------
+
+	.get("/user/:userId", async ({ db, params: { userId }, user }) => {
+
+		if (user === null) {
+			return error("Unauthorized");
+		}
+
+		const res = await db
+			.selectFrom("User")
+			.select(["userId", "username", "admin"])
+			.where("userId", "=", userId)
+			.executeTakeFirst();
+
+		if (res === undefined) {
+			return error("Not Found");
+		}
+
+		return {
+			userId: res.userId,
+			username: res.username,
+			admin: res.admin !== 0,
+		};
+	}, {
+		params: t.Object({
+			userId: tbranded<UserId>(),
+		}),
+	})
+
 	// --- MARK: PIECE CRUD ----------------------------------------------------
 
 	.post("/piece", async ({ db, body: { name, composer, lyricist, arranger }, user }) => {
@@ -182,19 +211,66 @@ const app = new Elysia()
 
 		let q = db
 			.selectFrom("Piece")
-			.selectAll()
+			.select("pieceId")
 			.orderBy(["name", "composer", "arranger"])
-			.limit(100);
+			.offset(query.offset ?? 0)
+			.limit(query.limit ?? 100);
 
-		if (query.id !== undefined) {
-			q = q.where("pieceId", "=", query.id);
+		if (query.name !== undefined) {
+			q = q.where("name", "like", "%" + query.name + "%");
+		}
+
+		if (query.author !== undefined) {
+			q = q.where((eb) => eb.or([
+				eb("composer", "like", "%" + query.author + "%"),
+				eb("arranger", "like", "%" + query.author + "%"),
+				eb("lyricist", "like", "%" + query.author + "%"),
+			]))
 		}
 
 		const res = await q.execute();
-		return res;
+		return res.map(({ pieceId }) => pieceId);
 	}, {
 		query: t.Object({
-			id: t.Optional(tbranded<PieceId>()),
+			name: t.Optional(t.String()),
+			author: t.Optional(t.String()),
+			offset: t.Optional(t.Integer({ minimum: 0 })),
+			limit: t.Optional(t.Integer({ minimum: 1, maximum: 100 })),
+		}),
+	})
+
+	.get("/piece/:pieceId", async ({ db, query, params: { pieceId }, user }) => {
+
+		if (user === null) {
+			return error("Unauthorized");
+		}
+
+		const piece = await db
+			.selectFrom("Piece")
+			.selectAll()
+			.where("pieceId", "=", pieceId)
+			.executeTakeFirst();
+
+		if (piece === undefined) {
+			return error("Not Found");
+		}
+
+		const attachments = await db
+			.selectFrom("Attachment")
+			.selectAll()
+			.where("pieceId", "=", pieceId)
+			.execute();
+
+		return {
+			...piece,
+			attachments: attachments.map(({ sha256, ...rest }) => ({
+				sha256: Buffer.from(sha256).toString("hex"),
+				...rest,
+			})),
+		}
+	}, {
+		params: t.Object({
+			pieceId: tbranded<PieceId>(),
 		}),
 	})
 
@@ -277,7 +353,10 @@ const app = new Elysia()
 			.returningAll()
 			.executeTakeFirstOrThrow();
 
-		return res;
+		return {
+			...res,
+			sha256: Buffer.from(res.sha256).toString("hex"),
+		};
 	}, {
 		body: t.Object({
 			filename: t.String({ minLength: 1 }),
@@ -289,26 +368,6 @@ const app = new Elysia()
 		}),
 	})
 
-	.get("piece/:pieceId/attachment", async ({ db, params: { pieceId }, user }) => {
-
-		if (user === null) {
-			return error("Unauthorized");
-		}
-
-		const res = await db
-			.selectFrom("Attachment")
-			.selectAll()
-			.where("pieceId", "=", pieceId)
-			.orderBy("filename")
-			.execute();
-
-		return res;
-	}, {
-		params: t.Object({
-			pieceId: tbranded<PieceId>(),
-		}),
-	})
-
 	/* NOTE The piece ID is reduntant, because attachment IDs are unique for the
 	 * entire DB, not just per piece. However, we consider a piece to be the
 	 * sole owner of an attachment, i.e. attachments are not shared (attachments
@@ -316,7 +375,7 @@ const app = new Elysia()
 	 * reflect the ownership in the URLs.
 	 */
 
-	.get("piece/:pieceId/attachment/:attachmentId", async ({ db, params: { pieceId, attachmentId }, user }) => {
+	.get("piece/:pieceId/attachment/:attachmentId", async ({ db, params: { pieceId, attachmentId }, user, set }) => {
 
 		if (user === null) {
 			return error("Unauthorized");
@@ -336,11 +395,8 @@ const app = new Elysia()
 			return error("Not Found");
 		}
 
-		return form({
-			filename: res.filename,
-			mediaType: res.mediaType,
-			data: new File([res.data], res.filename, { type: res.mediaType }),
-		});
+		set.headers["content-disposition"] = `attachment; filename="${res.filename}"`;
+		return Bun.file(res.data, { type: res.mediaType });
 	}, {
 		params: t.Object({
 			pieceId: tbranded<PieceId>(),