hacklab/T-HUB
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Tactical Media Broadcast Hub — initial release

Browse source 
Self-hosted multi-platform broadcast newsroom for activist collectives:
publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style
column wall with hostile-content-safe rendering, live control room with Auto
Director, bridged chat governance with polls and quorum, distributed sandboxed
transcode workers, encrypted content-addressed archive, monthly analytics.

MIT licensed. See README.md and docs/.
This commit is contained in:
glass beadian 2026-10-10 11:56:42 +00:00
commit aa5e262f3a
880 changed files with 111042 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

45
apps/api/src/publishing/poll-approval.ts Normal file
View file

@ -0,0 +1,45 @@
import { ConflictException } from '@nestjs/common';
import { canonicalPostHash } from '@tactical-media-broadcast-hub/publishing-execution';
import type { PoolClient } from 'pg';
import { ApprovalGateService } from './approval-gate.service.js';
import type { DraftPost } from './publishing.service.js';
/** E2's transactional publishing seam. A System audit actor delegates to a
* live Owner/Admin approval principal so the existing dispatch authorization
* continues to validate a real, revocable membership; no permission bypass. */
export async function transitionPollDraft(client: PoolClient, input: {
workspaceId: string; draftId: string; pollId: string; passed: boolean;
text?: string; reason: string; escalate?: boolean;
}): Promise<void> {
const current = (await client.query('SELECT * FROM drafts WHERE id = $1 FOR UPDATE', [input.draftId])).rows[0];
if (!current || !['editing', 'in_review'].includes(String(current.state))) throw new ConflictException('poll subject is no longer reviewable');
if (input.escalate) return;
if (input.passed && input.text !== undefined) {
// Separate writes are necessary: the revision trigger voids approval
// whenever content changes. Approve only the resulting revision/hash.
await client.query("UPDATE drafts SET post = jsonb_set(post, '{text}', to_jsonb($2::text)), updated_at = now() WHERE id = $1", [input.draftId, input.text]);
}
const draft = (await client.query('SELECT * FROM drafts WHERE id = $1', [input.draftId])).rows[0]!;
let reviewer: string | null = null;
if (input.passed) {
reviewer = (await client.query(`SELECT m.user_id FROM memberships m
JOIN role_permissions rp ON rp.role = m.role AND rp.permission = 'approval.grant'
WHERE m.workspace_id = $1 AND m.status = 'active' AND m.role IN ('Owner', 'Admin')
ORDER BY CASE m.role WHEN 'Owner' THEN 0 ELSE 1 END, m.user_id LIMIT 1`, [input.workspaceId])).rows[0]?.user_id as string | undefined ?? null;
if (!reviewer) throw new ConflictException('poll approval needs a live Owner/Admin authorizing principal');
const gate = new ApprovalGateService();
const evaluation = await gate.evaluate(client, input.workspaceId, input.draftId, draft.post as DraftPost, reviewer);
if (evaluation.blocked.length) throw new ConflictException({ code: 'OUTSIDE_POLICY', message: 'poll passed but E1 still blocks the draft', verdicts: evaluation.blocked });
await gate.recordFiredInTxn(client, input.workspaceId, input.draftId, reviewer, evaluation.verdicts);
}
await client.query(`UPDATE drafts SET state = $2, reviewer_user_id = $3,
approved_revision = CASE WHEN $2 = 'approved' THEN revision ELSE NULL END,
approved_hash = $4, approved_at = CASE WHEN $2 = 'approved' THEN now() ELSE NULL END,
review_reason = $5, updated_at = now() WHERE id = $1`,
[input.draftId, input.passed ? 'approved' : 'rejected', reviewer,
input.passed ? canonicalPostHash(draft.post as DraftPost) : null, input.reason]);
await client.query("SELECT audit_append($1, NULL, 'System', $2, 'draft', $3, $4)", [input.workspaceId,
input.passed ? 'draft.approved' : 'draft.rejected', input.draftId,
{ actor: `system:chat-poll-gate:${input.pollId}`, pollId: input.pollId,
authorizingUserId: reviewer, from: current.state, to: input.passed ? 'approved' : 'rejected', reason: input.reason }]);
}