deps: update fastify to 5.7.4

#CODE_OF_CONDUCT.md#

@@ -0,0 +1,3 @@
+# Code of Conduct
+
+Our Code of Conduct can be found here: https://docs.nhcarrigan.com/#/coc

.gitea/workflows/ci.yml

@@ -8,8 +8,9 @@ on:
       - main
 
 jobs:
-  lint:
-    name: Lint and Test
+  ci:
+    name: CI
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout Source Files
@@ -25,14 +26,22 @@ jobs:
         with:
           version: 10
 
+      - name: Ensure Dependencies are Pinned
+        uses: naomi-lgbt/dependency-pin-check@main
+        with:
+          language: javascript
+          dev-dependencies: true
+          peer-dependencies: true
+          optional-dependencies: true
+
       - name: Install Dependencies
         run: pnpm install
 
-      - name: Verify Build
-        run: pnpm run build
-
       - name: Lint Source Files
         run: pnpm run lint
 
+      - name: Verify Build
+        run: pnpm run build
+
       - name: Run Tests
         run: pnpm run test

.gitea/workflows/security.yml

@@ -0,0 +1,177 @@
+name: Security Scan and Upload
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '0 0 * * 1'
+  workflow_dispatch:
+
+jobs:
+  security-audit:
+    name: Security & DefectDojo Upload
+    runs-on: ubuntu-latest
+    continue-on-error: true
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # --- AUTO-SETUP PROJECT ---
+      - name: Ensure DefectDojo Product Exists
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
+          PRODUCT_NAME: ${{ github.repository }} 
+          PRODUCT_TYPE_ID: 1 
+        run: |
+          sudo apt-get install jq -y > /dev/null
+          
+          echo "Checking connection to $DD_URL..."
+          
+          # Check if product exists - capture HTTP code to debug connection issues
+          RESPONSE=$(curl --write-out "%{http_code}" --silent --output /tmp/response.json \
+            -H "Authorization: Token $DD_TOKEN" \
+            "$DD_URL/api/v2/products/?name=$PRODUCT_NAME")
+          
+          # If response is not 200, print error
+          if [ "$RESPONSE" != "200" ]; then
+            echo "::error::Failed to query DefectDojo. HTTP Code: $RESPONSE"
+            cat /tmp/response.json
+            exit 1
+          fi
+
+          COUNT=$(cat /tmp/response.json | jq -r '.count')
+          
+          if [ "$COUNT" = "0" ]; then
+            echo "Creating product '$PRODUCT_NAME'..."
+            curl -s -X POST "$DD_URL/api/v2/products/" \
+              -H "Authorization: Token $DD_TOKEN" \
+              -H "Content-Type: application/json" \
+              -d '{ "name": "'"$PRODUCT_NAME"'", "description": "Auto-created by Gitea Actions", "prod_type": '$PRODUCT_TYPE_ID' }'
+          else
+            echo "Product '$PRODUCT_NAME' already exists."
+          fi
+
+      # --- 1. TRIVY (Dependencies & Misconfig) ---
+      - name: Install Trivy
+        run: |
+          sudo apt-get install wget apt-transport-https gnupg lsb-release -y
+          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
+          echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
+          sudo apt-get update && sudo apt-get install trivy -y
+
+      - name: Run Trivy (FS Scan)
+        run: |
+          trivy fs . --scanners vuln,misconfig --format json --output trivy-results.json --exit-code 0
+
+      - name: Upload Trivy to DefectDojo
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
+        run: |
+          echo "Uploading Trivy results..."
+          # Generate today's date in YYYY-MM-DD format
+          TODAY=$(date +%Y-%m-%d)
+          
+          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
+            -H "Authorization: Token $DD_TOKEN" \
+            -F "active=true" \
+            -F "verified=true" \
+            -F "scan_type=Trivy Scan" \
+            -F "engagement_name=CI/CD Pipeline" \
+            -F "product_name=${{ github.repository }}" \
+            -F "scan_date=$TODAY" \
+            -F "auto_create_context=true" \
+            -F "file=@trivy-results.json")
+          
+          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
+            echo "::error::Upload Failed with HTTP $HTTP_CODE"
+            echo "--- SERVER RESPONSE ---"
+            cat response.txt
+            echo "-----------------------"
+            exit 1
+          else
+            echo "Upload Success!"
+          fi
+
+      # --- 2. GITLEAKS (Secrets) ---
+      - name: Install Gitleaks
+        run: |
+          wget -qO gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.18.0/gitleaks_8.18.0_linux_x64.tar.gz
+          tar -xzf gitleaks.tar.gz
+          sudo mv gitleaks /usr/local/bin/ && chmod +x /usr/local/bin/gitleaks
+
+      - name: Run Gitleaks
+        run: gitleaks detect --source . -v --report-path gitleaks-results.json --report-format json --no-git || true
+
+      - name: Upload Gitleaks to DefectDojo
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
+        run: |
+          echo "Uploading Gitleaks results..."  
+          TODAY=$(date +%Y-%m-%d)
+
+          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
+            -H "Authorization: Token $DD_TOKEN" \
+            -F "active=true" \
+            -F "verified=true" \
+            -F "scan_type=Gitleaks Scan" \
+            -F "engagement_name=CI/CD Pipeline" \
+            -F "product_name=${{ github.repository }}" \
+            -F "scan_date=$TODAY" \
+            -F "auto_create_context=true" \
+            -F "file=@gitleaks-results.json")
+
+          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
+             echo "::error::Upload Failed with HTTP $HTTP_CODE"
+             echo "--- SERVER RESPONSE ---"
+             cat response.txt
+             echo "-----------------------"
+             exit 1
+          else
+             echo "Upload Success!"
+          fi
+
+      # --- 3. SEMGREP (SAST) ---
+      - name: Install Semgrep (via pipx)
+        run: |
+          sudo apt-get install pipx -y
+          pipx install semgrep
+          # Add pipx binary path to GITHUB_PATH so next steps can see 'semgrep'
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Run Semgrep
+        run: semgrep scan --config=p/security-audit --config=p/owasp-top-ten --json --output semgrep-results.json . || true
+
+      - name: Upload Semgrep to DefectDojo
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
+        run: |
+          echo "Uploading Semgrep results..."
+          TODAY=$(date +%Y-%m-%d)
+          
+          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
+            -H "Authorization: Token $DD_TOKEN" \
+            -F "active=true" \
+            -F "verified=true" \
+            -F "scan_type=Semgrep JSON Report" \
+            -F "engagement_name=CI/CD Pipeline" \
+            -F "product_name=${{ github.repository }}" \
+            -F "scan_date=$TODAY" \
+            -F "auto_create_context=true" \
+            -F "file=@semgrep-results.json")
+
+          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
+             echo "::error::Upload Failed with HTTP $HTTP_CODE"
+             echo "--- SERVER RESPONSE ---"
+             cat response.txt
+             echo "-----------------------"
+             exit 1
+          else
+             echo "Upload Success!"
+          fi

.npmrc

@@ -0,0 +1,25 @@
+# Package Manager Configuration
+# Force pnpm usage - breaks npm/yarn intentionally
+node-linker=pnpm
+
+# Security: Disable all lifecycle scripts
+ignore-scripts=true
+enable-pre-post-scripts=false
+
+# Security: Require packages to be 10+ days old before installation
+minimum-release-age=14400
+
+# Security: Verify package integrity hashes
+verify-store-integrity=true
+
+# Security: Enforce strict trust policies
+trust-policy=strict
+
+# Security: Strict peer dependency resolution
+strict-peer-dependencies=true
+
+# Performance: Use symlinks for node_modules
+symlink=true
+
+# Lockfile: Ensure lockfile is not modified during install
+frozen-lockfile=false

README.md

@@ -18,7 +18,7 @@ This page is currently deployed. [View the live website.]
 
 ## Feedback and Bugs
 
-If you have feedback or a bug report, please feel free to open a GitHub issue!
+If you have feedback or a bug report, please [log a ticket on our forum](https://support.nhcarrigan.com).
 
 ## Contributing
 

package.json

@@ -27,7 +27,7 @@
     "@nhcarrigan/logger": "1.0.0",
     "@prisma/client": "6.14.0",
     "discord.js": "14.21.0",
-    "fastify": "5.5.0",
+    "fastify": "5.7.4",
     "node-schedule": "2.1.1"
   }
 }

pnpm-lock.yaml

@@ -18,8 +18,8 @@ importers:
         specifier: 14.21.0
         version: 14.21.0
       fastify:
-        specifier: 5.5.0
-        version: 5.5.0
+        specifier: 5.7.4
+        version: 5.7.4
       node-schedule:
         specifier: 2.1.1
         version: 2.1.1
@@ -305,8 +305,8 @@ packages:
     resolution: {integrity: sha512-Z5kJ+wU3oA7MMIqVR9tyZRtjYPr4OC004Q4Rw7pgOKUOKkJfZ3O24nz3WYfGRpMDNmcOi3TwQOmgm7B7Tpii0w==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@fastify/ajv-compiler@4.0.2':
-    resolution: {integrity: sha512-Rkiu/8wIjpsf46Rr+Fitd3HRP+VsxUFDDeag0hs9L0ksfnwx2g7SPQQTFL0E8Qv+rfXzQOxBJnjUB9ITUDjfWQ==}
+  '@fastify/ajv-compiler@4.0.5':
+    resolution: {integrity: sha512-KoWKW+MhvfTRWL4qrhUwAAZoaChluo0m0vbiJlGMt2GXvL4LVPQEjt8kSpHI3IBq5Rez8fg+XeH3cneztq+C7A==}
 
   '@fastify/error@4.2.0':
     resolution: {integrity: sha512-RSo3sVDXfHskiBZKBPRgnQTtIqpi/7zhJOEmAxCiBcM7d0uwdGdxLlsCaLzGs8v8NnxIRlfG0N51p5yFaOentQ==}
@@ -377,6 +377,9 @@ packages:
     resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
     engines: {node: '>= 8'}
 
+  '@pinojs/redact@0.4.0':
+    resolution: {integrity: sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==}
+
   '@pkgr/core@0.1.2':
     resolution: {integrity: sha512-fdDH1LSGfZdTH2sxdpVMw31BanV28K/Gry0cVFxaNP77neJSkd82mM8ErPNYs9e+0O7SdHBLTDzDgwUuy18RnQ==}
     engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
@@ -1233,15 +1236,11 @@ packages:
   fast-querystring@1.1.2:
     resolution: {integrity: sha512-g6KuKWmFXc0fID8WWH0jit4g0AGBoJhCkJMb1RmbsSEUNvQ+ZC8D6CUZ+GtF8nMzSPXnhiePyyqqipzNNEnHjg==}
 
-  fast-redact@3.5.0:
-    resolution: {integrity: sha512-dwsoQlS7h9hMeYUq1W++23NDcBLV4KqONnITDV9DjfS3q1SgDGVrBdvvTLUotWtPSD7asWDV9/CmsZPy8Hf70A==}
-    engines: {node: '>=6'}
-
   fast-uri@3.0.6:
     resolution: {integrity: sha512-Atfo14OibSv5wAp4VWNsFYE1AchQRTv9cBGWET4pZWHzYshFSS9NQI6I57rdKn9croWVMbYFbLhJ+yJvmZIIHw==}
 
-  fastify@5.5.0:
-    resolution: {integrity: sha512-ZWSWlzj3K/DcULCnCjEiC2zn2FBPdlZsSA/pnPa/dbUfLvxkD/Nqmb0XXMXLrWkeM4uQPUvjdJpwtXmTfriXqw==}
+  fastify@5.7.4:
+    resolution: {integrity: sha512-e6l5NsRdaEP8rdD8VR0ErJASeyaRbzXYpmkrpr2SuvuMq6Si3lvsaVy5C+7gLanEkvjpMDzBXWE5HPeb/hgTxA==}
 
   fastq@1.19.1:
     resolution: {integrity: sha512-GwLTyxkCXjXbxqIhTsMI2Nui8huMPtnxg7krajPJAjnEG/iiOS7i+zCtWGZR9G0NBKbXKh6X9m9UIsYX/N6vvQ==}
@@ -1801,14 +1800,14 @@ packages:
     resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==}
     engines: {node: '>=12'}
 
-  pino-abstract-transport@2.0.0:
-    resolution: {integrity: sha512-F63x5tizV6WCh4R6RHyi2Ml+M70DNRXt/+HANowMflpgGFMAym/VKm6G7ZOQRjqN7XbGxK1Lg9t6ZrtzOaivMw==}
+  pino-abstract-transport@3.0.0:
+    resolution: {integrity: sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==}
 
   pino-std-serializers@7.0.0:
     resolution: {integrity: sha512-e906FRY0+tV27iq4juKzSYPbUj2do2X2JX4EzSca1631EB2QJQUqGbDuERal7LCtOpxl6x3+nvo9NPZcmjkiFA==}
 
-  pino@9.9.0:
-    resolution: {integrity: sha512-zxsRIQG9HzG+jEljmvmZupOMDUQ0Jpj0yAgE28jQvvrdYTlEaiGwelJpdndMl/MBuRr70heIj83QyqJUWaU8mQ==}
+  pino@10.3.0:
+    resolution: {integrity: sha512-0GNPNzHXBKw6U/InGe79A3Crzyk9bcSyObF9/Gfo9DLEf5qj5RF50RSjsu0W1rZ6ZqRGdzDFCRBQvi9/rSGPtA==}
     hasBin: true
 
   pkg-types@2.2.0:
@@ -2123,8 +2122,9 @@ packages:
     resolution: {integrity: sha512-JJoOEKTfL1urb1mDoEblhD9NhEbWmq9jHEMEnxoC4ujUaZ4itA8vKgwkFAyNClgxplLi9tsUKX+EduK0p/l7sg==}
     engines: {node: ^14.18.0 || >=16.0.0}
 
-  thread-stream@3.1.0:
-    resolution: {integrity: sha512-OqyPZ9u96VohAyMfJykzmivOrY2wfMSf3C5TtFJVgN+Hm6aj+voFhlK+kZEIv2FBh1X6Xp3DlnCOfEQ3B2J86A==}
+  thread-stream@4.0.0:
+    resolution: {integrity: sha512-4iMVL6HAINXWf1ZKZjIPcz5wYaOdPhtO8ATvZ+Xqp3BTdaqtAwQkNmKORqcIo5YkQqGXq5cwfswDwMqqQNrpJA==}
+    engines: {node: '>=20'}
 
   tinybench@2.9.0:
     resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
@@ -2570,7 +2570,7 @@ snapshots:
       '@eslint/core': 0.15.2
       levn: 0.4.1
 
-  '@fastify/ajv-compiler@4.0.2':
+  '@fastify/ajv-compiler@4.0.5':
     dependencies:
       ajv: 8.17.1
       ajv-formats: 3.0.1(ajv@8.17.1)
@@ -2655,6 +2655,8 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.19.1
 
+  '@pinojs/redact@0.4.0': {}
+
   '@pkgr/core@0.1.2': {}
 
   '@prisma/client@6.14.0(prisma@6.14.0(typescript@5.9.2))(typescript@5.9.2)':
@@ -3751,13 +3753,11 @@ snapshots:
     dependencies:
       fast-decode-uri-component: 1.0.1
 
-  fast-redact@3.5.0: {}
-
   fast-uri@3.0.6: {}
 
-  fastify@5.5.0:
+  fastify@5.7.4:
     dependencies:
-      '@fastify/ajv-compiler': 4.0.2
+      '@fastify/ajv-compiler': 4.0.5
       '@fastify/error': 4.2.0
       '@fastify/fast-json-stringify-compiler': 5.0.3
       '@fastify/proxy-addr': 5.0.0
@@ -3766,7 +3766,7 @@ snapshots:
       fast-json-stringify: 6.0.1
       find-my-way: 9.3.0
       light-my-request: 6.6.0
-      pino: 9.9.0
+      pino: 10.3.0
       process-warning: 5.0.0
       rfdc: 1.4.1
       secure-json-parse: 4.0.0
@@ -4326,25 +4326,25 @@ snapshots:
 
   picomatch@4.0.3: {}
 
-  pino-abstract-transport@2.0.0:
+  pino-abstract-transport@3.0.0:
     dependencies:
       split2: 4.2.0
 
   pino-std-serializers@7.0.0: {}
 
-  pino@9.9.0:
+  pino@10.3.0:
     dependencies:
+      '@pinojs/redact': 0.4.0
       atomic-sleep: 1.0.0
-      fast-redact: 3.5.0
       on-exit-leak-free: 2.1.2
-      pino-abstract-transport: 2.0.0
+      pino-abstract-transport: 3.0.0
       pino-std-serializers: 7.0.0
       process-warning: 5.0.0
       quick-format-unescaped: 4.0.4
       real-require: 0.2.0
       safe-stable-stringify: 2.5.0
       sonic-boom: 4.2.0
-      thread-stream: 3.1.0
+      thread-stream: 4.0.0
 
   pkg-types@2.2.0:
     dependencies:
@@ -4707,7 +4707,7 @@ snapshots:
       '@pkgr/core': 0.1.2
       tslib: 2.8.1
 
-  thread-stream@3.1.0:
+  thread-stream@4.0.0:
     dependencies:
       real-require: 0.2.0
 

src/buttons/leaderboard.ts

@@ -0,0 +1,91 @@
+/**
+ * @copyright NHCarrigan
+ * @license Naomi's Public License
+ * @author Naomi Carrigan
+ */
+
+import { MessageFlags } from "discord.js";
+import { checkGuildEntitlement } from "../modules/checkEntitlement.js";
+import { sendUnentitledResponse } from "../modules/sendUnentitledResponse.js";
+import { errorHandler } from "../utils/errorHandler.js";
+import type { Button } from "../interfaces/button.js";
+
+/**
+ * Handles the `/leaderboard` button.
+ * @param pavelle - Pavelle's instance.
+ * @param interaction - The interaction payload from Discord.
+ */
+// eslint-disable-next-line max-lines-per-function -- Lazy.
+export const leaderboard: Button = async(pavelle, interaction) => {
+  try {
+    const isEntitled = await checkGuildEntitlement(pavelle, interaction.guild);
+    if (!isEntitled) {
+      await sendUnentitledResponse(interaction);
+      return;
+    }
+    const members = await pavelle.db.users.findMany({
+      where: {
+        serverId: interaction.guild.id,
+      },
+    });
+
+    const sorted = members.sort((a, b) => {
+      return b.points - a.points;
+    });
+
+    const topTen = sorted.slice(0, 10).map((member, index) => {
+      return `- **#${(index + 1).toString()}:** <@${member.userId}> - ${member.points.toString()} point(s).`;
+    }).
+      join("\n");
+    const yourScore = sorted.find((member) => {
+      return member.userId === interaction.member.id;
+    });
+    const yourRank = yourScore
+      ? `You are rank #${(sorted.indexOf(yourScore) + 1).toString()} with ${yourScore.points.toString()} points.`
+      : "You are not ranked. Try throwing some stuff!";
+    await interaction.editReply({
+      allowedMentions: {
+        parse: [],
+      },
+      components: [
+        {
+          // eslint-disable-next-line @typescript-eslint/naming-convention -- Discord API convention.
+          accent_color: null,
+
+          components: [
+            {
+              content: "# Leaderboard",
+              type:    10,
+            },
+            {
+              divider: true,
+              spacing: 1,
+              type:    14,
+            },
+            {
+              content: "## Top 10 Members",
+              type:    10,
+            },
+            {
+              content: topTen,
+              type:    10,
+            },
+            {
+              content: `-# ${yourRank}`,
+              type:    10,
+            },
+          ],
+          spoiler: false,
+          type:    17,
+        },
+      ],
+      flags: [ MessageFlags.IsComponentsV2 ],
+    });
+  } catch (error) {
+    const id = await errorHandler(error, "leaderboard command");
+    await interaction.editReply({
+      content:
+      `An error occurred while processing your request. Please try again later, or join our support server and provide this ID: ${id}`,
+    });
+  }
+};

src/buttons/throwButton.ts

@@ -0,0 +1,105 @@
+/**
+ * @copyright NHCarrigan
+ * @license Naomi's Public License
+ * @author Naomi Carrigan
+ */
+
+import { MessageFlags } from "discord.js";
+import { checkGuildEntitlement } from "../modules/checkEntitlement.js";
+import { generateScore } from "../modules/generateScore.js";
+import { getCachedCount } from "../modules/getCachedCount.js";
+import { getConfig } from "../modules/getConfig.js";
+import { getThrowComponents } from "../modules/getThrowComponents.js";
+import { sendUnentitledResponse } from "../modules/sendUnentitledResponse.js";
+import { errorHandler } from "../utils/errorHandler.js";
+import { getRandomValue } from "../utils/getRandomValue.js";
+import type { Button } from "../interfaces/button.js";
+
+/**
+ * Handles the `/throw` button interaction.
+ * @param pavelle - Pavelle's Discord instance.
+ * @param interaction - The command interaction payload from Discord.
+ */
+// eslint-disable-next-line max-lines-per-function -- Big logic, but lotsa components
+export const throwButton: Button = async(pavelle, interaction) => {
+  try {
+    const { member, guild } = interaction;
+    const count = getCachedCount(pavelle, `${guild.id}-${member.id}`);
+    if (count <= 0) {
+      await interaction.editReply({
+        components: [
+          {
+            // eslint-disable-next-line @typescript-eslint/naming-convention -- Discord API convention.
+            accent_color: null,
+            components:   [
+              {
+                content:
+                  // eslint-disable-next-line stylistic/max-len -- long string.
+                  "Oopsie! You are out of throws! Your count resets at the top of every hour.",
+                type: 10,
+              },
+            ],
+            spoiler: false,
+            type:    17,
+          },
+        ],
+        flags: [ MessageFlags.IsComponentsV2 ],
+      });
+      return;
+    }
+    const isEntitled = await checkGuildEntitlement(pavelle, guild);
+    if (!isEntitled) {
+      await sendUnentitledResponse(interaction);
+      return;
+    }
+    pavelle.throwCache.set(`${guild.id}-${member.id}`, count - 1);
+    await guild.members.fetch().catch(() => {
+      return null;
+    });
+    const target = getRandomValue([ ...guild.members.cache.values() ]);
+    const score = generateScore();
+    const { theme, spoiler } = await getConfig(pavelle, guild.id);
+    const updated = await pavelle.db.users.upsert({
+      create: {
+        points:   score,
+        serverId: guild.id,
+        userId:   member.id,
+      },
+      update: {
+        points: {
+          increment: score,
+        },
+      },
+      where: {
+        // eslint-disable-next-line @typescript-eslint/naming-convention -- Prisma index convention.
+        serverId_userId: {
+          serverId: guild.id,
+          userId:   member.id,
+        },
+      },
+    });
+    const components = getThrowComponents(
+      pavelle,
+      member.id,
+      target.id,
+      guild.id,
+      theme,
+      score,
+      spoiler,
+      updated.points,
+    );
+    await interaction.editReply({
+      allowedMentions: {
+        parse: [ ],
+      },
+      components: components,
+      flags:      [ MessageFlags.IsComponentsV2 ],
+    });
+  } catch (error) {
+    const id = await errorHandler(error, "throw command");
+    await interaction.editReply({
+      content:
+      `An error occurred while processing your request. Please try again later, or join our support server and provide this ID: ${id}`,
+    });
+  }
+};

src/commands/leaderboard.ts

@@ -5,6 +5,8 @@
  */
 
 import { MessageFlags } from "discord.js";
+import { checkGuildEntitlement } from "../modules/checkEntitlement.js";
+import { sendUnentitledResponse } from "../modules/sendUnentitledResponse.js";
 import { errorHandler } from "../utils/errorHandler.js";
 import type { Command } from "../interfaces/command.js";
 
@@ -16,6 +18,11 @@ import type { Command } from "../interfaces/command.js";
 // eslint-disable-next-line max-lines-per-function -- Lazy.
 export const leaderboard: Command = async(pavelle, interaction) => {
   try {
+    const isEntitled = await checkGuildEntitlement(pavelle, interaction.guild);
+    if (!isEntitled) {
+      await sendUnentitledResponse(interaction);
+      return;
+    }
     const members = await pavelle.db.users.findMany({
       where: {
         serverId: interaction.guild.id,
@@ -27,16 +34,19 @@ export const leaderboard: Command = async(pavelle, interaction) => {
     });
 
     const topTen = sorted.slice(0, 10).map((member, index) => {
-      return `- **#${index.toString()}:** <@${member.userId}> - ${member.points.toString()} point(s).`;
+      return `- **#${(index + 1).toString()}:** <@${member.userId}> - ${member.points.toString()} point(s).`;
     }).
       join("\n");
     const yourScore = sorted.find((member) => {
       return member.userId === interaction.member.id;
     });
     const yourRank = yourScore
-      ? `You are rank #${sorted.indexOf(yourScore).toString()} with ${yourScore.points.toString()} points.`
+      ? `You are rank #${(sorted.indexOf(yourScore) + 1).toString()} with ${yourScore.points.toString()} points.`
       : "You are not ranked. Try throwing some stuff!";
     await interaction.editReply({
+      allowedMentions: {
+        parse: [],
+      },
       components: [
         {
           // eslint-disable-next-line @typescript-eslint/naming-convention -- Discord API convention.

src/commands/throwCmd.ts

@@ -87,7 +87,7 @@ export const throwCmd: Command = async(pavelle, interaction) => {
     );
     await interaction.editReply({
       allowedMentions: {
-        parse: [ "users" ],
+        parse: [ ],
       },
       components: components,
       flags:      [ MessageFlags.IsComponentsV2 ],

src/config/handlers.ts

@@ -4,22 +4,39 @@
  * @author Naomi Carrigan
  */
 
+import { leaderboard as leaderboardButton } from "../buttons/leaderboard.js";
+import { throwButton } from "../buttons/throwButton.js";
 import { about } from "../commands/about.js";
 import { config } from "../commands/config.js";
 import { leaderboard } from "../commands/leaderboard.js";
 import { throwCmd } from "../commands/throwCmd.js";
+import type { Button } from "../interfaces/button.js";
 import type { Command } from "../interfaces/command.js";
 
-const defaultHandler: Command = async(_lynira, interaction) => {
+const defaultCommandHandler: Command = async(_lynira, interaction) => {
   await interaction.editReply({
     content: "This command is not implemented yet.",
   });
 };
 
-export const handlers: { _default: Command } & Record<string, Command> = {
-  _default:    defaultHandler,
+const defaultButtonHandler: Button = async(_pavelle, interaction) => {
+  await interaction.editReply({
+    content: "This button is not implemented yet.",
+  });
+};
+
+const commandHandlers: { _default: Command } & Record<string, Command> = {
+  _default:    defaultCommandHandler,
   about:       about,
   config:      config,
   leaderboard: leaderboard,
   throw:       throwCmd,
 };
+
+const buttonHandlers: { _default: Button } & Record<string, Button> = {
+  _default:    defaultButtonHandler,
+  leaderboard: leaderboardButton,
+  throw:       throwButton,
+};
+
+export { commandHandlers, buttonHandlers };

src/index.ts

@@ -11,6 +11,7 @@ import {
   Events,
 } from "discord.js";
 import { scheduleJob } from "node-schedule";
+import { processButton } from "./modules/processButton.js";
 import { processCommand } from "./modules/processCommand.js";
 import { instantiateServer } from "./server/serve.js";
 import { logger } from "./utils/logger.js";
@@ -32,13 +33,15 @@ pavelle.discord.once(Events.ClientReady, () => {
 });
 
 pavelle.discord.on(Events.InteractionCreate, (interaction) => {
-  if (!interaction.isChatInputCommand()) {
-    return;
-  }
   if (!interaction.inCachedGuild()) {
     return;
   }
-  void processCommand(pavelle, interaction);
+  if (interaction.isChatInputCommand()) {
+    void processCommand(pavelle, interaction);
+  }
+  if (interaction.isButton()) {
+    void processButton(pavelle, interaction);
+  }
 });
 
 pavelle.discord.on(Events.Error, (error) => {

src/interfaces/button.ts

@@ -0,0 +1,12 @@
+/**
+ * @copyright nhcarrigan
+ * @license Naomi's Public License
+ * @author Naomi Carrigan
+ */
+import type { Pavelle } from "./pavelle.js";
+import type { ButtonInteraction } from "discord.js";
+
+export type Button = (
+  pavelle: Pavelle,
+  interaction: ButtonInteraction<"cached">
+)=> Promise<void>;

src/modules/generateScore.ts

@@ -4,6 +4,7 @@
  * @author Naomi Carrigan
  */
 
+import { randomInt } from "node:crypto";
 import { Score } from "../interfaces/score.js";
 
 /**
@@ -13,7 +14,7 @@ import { Score } from "../interfaces/score.js";
  * @returns The number of points the user earned.
  */
 export const generateScore = (): number => {
-  const random = Math.floor(Math.random() * 100);
+  const random = randomInt(1, 101);
   if (random < 10) {
     return Score.COUNTER;
   }

src/modules/getCachedCount.ts

@@ -13,5 +13,5 @@ import type { Pavelle } from "../interfaces/pavelle.js";
  * @returns The number of throws remaining.
  */
 export const getCachedCount = (pavelle: Pavelle, id: string): number => {
-  return pavelle.throwCache.get(id) ?? 3;
+  return pavelle.throwCache.get(id) ?? 10;
 };

src/modules/getThrowComponents.ts

@@ -144,6 +144,27 @@ export const getThrowComponents = (
           content: `-# You now have ${total.toString()} point(s).\n-# You have ${count.toString()} remaining throws for the hour.`,
           type:    10,
         },
+        {
+          components: [
+            {
+              // eslint-disable-next-line @typescript-eslint/naming-convention -- Discord API convention.
+              custom_id: "throw",
+              disabled:  false,
+              label:     "Throw another!",
+              style:     3,
+              type:      2,
+            },
+            {
+              // eslint-disable-next-line @typescript-eslint/naming-convention -- Discord API convention.
+              custom_id: "leaderboard",
+              disabled:  false,
+              label:     "Check leaderboard",
+              style:     1,
+              type:      2,
+            },
+          ],
+          type: 1,
+        },
       ],
       spoiler: false,
       type:    17,

src/modules/processButton.ts

@@ -0,0 +1,20 @@
+/**
+ * @copyright nhcarrigan
+ * @license Naomi's Public License
+ * @author Naomi Carrigan
+ */
+
+import { buttonHandlers as handlers } from "../config/handlers.js";
+import type { Button } from "../interfaces/button.js";
+
+/**
+ * Process a button interaction.
+ * @param pavelle - The Pavelle instance.
+ * @param interaction - The interaction to process.
+ */
+export const processButton: Button = async(pavelle, interaction) => {
+  await interaction.deferReply();
+  const commandName = interaction.customId;
+  // eslint-disable-next-line no-underscore-dangle -- Accessing private property for command handler.
+  await (handlers[commandName] ?? handlers._default)(pavelle, interaction);
+};

src/modules/processCommand.ts

@@ -4,7 +4,7 @@
  * @author Naomi Carrigan
  */
 
-import { handlers } from "../config/handlers.js";
+import { commandHandlers as handlers } from "../config/handlers.js";
 import type { Command } from "../interfaces/command.js";
 
 /**

src/modules/sendUnentitledResponse.ts

@@ -11,6 +11,7 @@ import {
   MessageFlags,
   TextDisplayBuilder,
   type ChatInputCommandInteraction,
+  type ButtonInteraction,
 } from "discord.js";
 
 /**
@@ -18,7 +19,7 @@ import {
  * @param interaction - The interaction object from Discord.
  */
 export const sendUnentitledResponse = async(
-  interaction: ChatInputCommandInteraction,
+  interaction: ChatInputCommandInteraction | ButtonInteraction,
 ): Promise<void> => {
   const components = [
     new TextDisplayBuilder().setContent(

src/server/serve.ts

@@ -19,7 +19,7 @@ const html = `<!DOCTYPE html>
   <body>
     <main>
     <h1>Pavelle</h1>
-    <img src="https://cdn.nhcarrigan.com/new-avatars/pavelle.png" width="250" alt="Pavelle" />
+    <img src="https://cdn.nhcarrigan.com/new-avatars/pavelle-full.png" width="250" alt="Pavelle" />
     <section>
       <p>Discord bot that allows you to throw things (like cake) at your fellow server members. </p>
       <a href="https://discord.com/oauth2/authorize?client_id=1405735335949766716" class="social-button discord-button" style="display: inline-block; background-color: #5865F2; color: white; padding: 10px 20px; text-decoration: none; border-radius: 4px; margin: 5px;">