OwnCord/Server/db/admin_queries.go

package db

import (
	"context"
	"database/sql"
	"errors"
	"fmt"
	"path/filepath"
	"strings"

	"github.com/owncord/server/db/dbgen"
)

// ─── Setup ───────────────────────────────────────────────────────────────────

// UserCount returns the total number of registered users.
func (d *DB) UserCount(ctx context.Context) (int64, error) {
	count, err := d.q.UserCount(ctx)
	if err != nil {
		return 0, fmt.Errorf("UserCount: %w", err)
	}
	return count, nil
}

// ─── Server Stats ─────────────────────────────────────────────────────────────

// GetServerStats returns aggregate counts for the admin dashboard.
// DBSizeBytes is 0 for in-memory databases (page_count * page_size returns
// a meaningful value only for file-backed databases).
func (d *DB) GetServerStats(ctx context.Context) (*ServerStats, error) {
	stats := &ServerStats{}
	var err error

	if stats.UserCount, err = d.q.CountUsers(ctx); err != nil {
		return nil, fmt.Errorf("GetServerStats users: %w", err)
	}
	if stats.MessageCount, err = d.q.CountActiveMessages(ctx); err != nil {
		return nil, fmt.Errorf("GetServerStats messages: %w", err)
	}
	if stats.ChannelCount, err = d.q.CountChannels(ctx); err != nil {
		return nil, fmt.Errorf("GetServerStats channels: %w", err)
	}
	if stats.InviteCount, err = d.q.CountActiveInvites(ctx); err != nil {
		return nil, fmt.Errorf("GetServerStats invites: %w", err)
	}

	// page_count * page_size gives the database size in bytes. PRAGMAs are not
	// expressible as sqlc queries, so they stay on the raw connection.
	// For :memory: databases this still works (returns the in-memory size).
	var pageCount, pageSize int64
	if err := d.sqlDB.QueryRowContext(ctx, `PRAGMA page_count`).Scan(&pageCount); err != nil {
		return nil, fmt.Errorf("GetServerStats page_count: %w", err)
	}
	if err := d.sqlDB.QueryRowContext(ctx, `PRAGMA page_size`).Scan(&pageSize); err != nil {
		return nil, fmt.Errorf("GetServerStats page_size: %w", err)
	}
	stats.DBSizeBytes = pageCount * pageSize

	return stats, nil
}

// ─── User Management ──────────────────────────────────────────────────────────

// ListAllUsers returns users joined with their role name, ordered by ID.
// limit=0 returns no rows.
func (d *DB) ListAllUsers(ctx context.Context, limit, offset int) ([]UserWithRole, error) {
	rows, err := d.q.ListAllUsers(ctx, dbgen.ListAllUsersParams{
		Limit:  int64(limit),
		Offset: int64(offset),
	})
	if err != nil {
		return nil, fmt.Errorf("ListAllUsers: %w", err)
	}
	result := make([]UserWithRole, 0, len(rows))
	for _, r := range rows {
		result = append(result, UserWithRole{
			User: User{
				ID:         r.ID,
				Username:   r.Username,
				Avatar:     r.Avatar,
				RoleID:     r.RoleID,
				Status:     r.Status,
				CreatedAt:  r.CreatedAt,
				LastSeen:   r.LastSeen,
				Banned:     r.Banned != 0,
				BanReason:  r.BanReason,
				BanExpires: r.BanExpires,
			},
			RoleName: r.RoleName,
		})
	}
	return result, nil
}

// UpdateUserRole changes the role_id of a user.
func (d *DB) UpdateUserRole(ctx context.Context, userID, roleID int64) error {
	if err := d.q.UpdateUserRole(ctx, dbgen.UpdateUserRoleParams{
		RoleID: roleID,
		ID:     userID,
	}); err != nil {
		return fmt.Errorf("UpdateUserRole: %w", err)
	}
	return nil
}

// ForceLogoutUser deletes all sessions for the given user ID.
func (d *DB) ForceLogoutUser(ctx context.Context, userID int64) error {
	if err := d.q.ForceLogoutUser(ctx, userID); err != nil {
		return fmt.Errorf("ForceLogoutUser: %w", err)
	}
	return nil
}

// GetUserSessions returns all active sessions for the given user ID.
func (d *DB) GetUserSessions(ctx context.Context, userID int64) ([]Session, error) {
	rows, err := d.q.GetUserSessions(ctx, userID)
	if err != nil {
		return nil, fmt.Errorf("GetUserSessions: %w", err)
	}
	sessions := make([]Session, 0, len(rows))
	for _, s := range rows {
		sessions = append(sessions, sessionFromGen(s))
	}
	return sessions, nil
}

// ─── Channel Management (admin) ───────────────────────────────────────────────

// AdminCreateChannel creates a channel with full field control including position.
// No sqlc query covers this exact INSERT shape, so it stays on raw SQL.
func (d *DB) AdminCreateChannel(ctx context.Context, name, chanType, category, topic string, position int) (int64, error) {
	res, err := d.sqlDB.ExecContext(ctx,
		`INSERT INTO channels (name, type, category, topic, position)
		 VALUES (?, ?, ?, ?, ?)`,
		name, chanType, strToNullPtr(category), strToNullPtr(topic), position,
	)
	if err != nil {
		return 0, fmt.Errorf("AdminCreateChannel: %w", err)
	}
	return res.LastInsertId()
}

// AdminUpdateChannel updates all mutable channel fields.
func (d *DB) AdminUpdateChannel(ctx context.Context, id int64, name, topic string, slowMode, position int, archived bool) error {
	if err := d.q.AdminUpdateChannel(ctx, dbgen.AdminUpdateChannelParams{
		Name:     name,
		Topic:    strToNullPtr(topic),
		SlowMode: int64(slowMode),
		Position: int64(position),
		Archived: b2i64(archived),
		ID:       id,
	}); err != nil {
		return fmt.Errorf("AdminUpdateChannel: %w", err)
	}
	return nil
}

// AdminDeleteChannel removes a channel by ID (cascades to messages, etc.).
func (d *DB) AdminDeleteChannel(ctx context.Context, id int64) error {
	if err := d.q.DeleteChannel(ctx, id); err != nil {
		return fmt.Errorf("AdminDeleteChannel: %w", err)
	}
	return nil
}

// ─── Audit Log ────────────────────────────────────────────────────────────────

// LogAudit inserts an audit log entry.
func (d *DB) LogAudit(ctx context.Context, actorID int64, action, targetType string, targetID int64, detail string) error {
	if err := d.q.LogAudit(ctx, dbgen.LogAuditParams{
		ActorID:    actorID,
		Action:     action,
		TargetType: targetType,
		TargetID:   targetID,
		Detail:     detail,
	}); err != nil {
		return fmt.Errorf("LogAudit: %w", err)
	}
	return nil
}

// GetAuditLog returns audit log entries ordered newest-first with pagination.
func (d *DB) GetAuditLog(ctx context.Context, limit, offset int) ([]AuditEntry, error) {
	rows, err := d.q.GetAuditLog(ctx, dbgen.GetAuditLogParams{
		Limit:  int64(limit),
		Offset: int64(offset),
	})
	if err != nil {
		return nil, fmt.Errorf("GetAuditLog: %w", err)
	}
	entries := make([]AuditEntry, 0, len(rows))
	for _, r := range rows {
		entries = append(entries, AuditEntry{
			ID:         r.ID,
			ActorID:    r.ActorID,
			ActorName:  r.ActorName,
			Action:     r.Action,
			TargetType: r.TargetType,
			TargetID:   r.TargetID,
			Detail:     r.Detail,
			CreatedAt:  r.CreatedAt,
		})
	}
	return entries, nil
}

// ─── Settings ─────────────────────────────────────────────────────────────────

// GetSetting returns the value for the given settings key.
// Returns an error (wrapping sql.ErrNoRows) when the key does not exist.
func (d *DB) GetSetting(ctx context.Context, key string) (string, error) {
	value, err := d.q.GetSetting(ctx, key)
	if errors.Is(err, sql.ErrNoRows) {
		return "", fmt.Errorf("GetSetting: key %q: %w", key, ErrNotFound)
	}
	if err != nil {
		return "", fmt.Errorf("GetSetting: %w", err)
	}
	return value, nil
}

// SetSetting upserts a setting value for the given key.
func (d *DB) SetSetting(ctx context.Context, key, value string) error {
	if err := d.q.SetSetting(ctx, dbgen.SetSettingParams{
		Key:   key,
		Value: value,
	}); err != nil {
		return fmt.Errorf("SetSetting: %w", err)
	}
	return nil
}

// GetAllSettings returns all settings as a key→value map.
func (d *DB) GetAllSettings(ctx context.Context) (map[string]string, error) {
	rows, err := d.q.GetAllSettings(ctx)
	if err != nil {
		return nil, fmt.Errorf("GetAllSettings: %w", err)
	}
	result := make(map[string]string, len(rows))
	for _, s := range rows {
		result[s.Key] = s.Value
	}
	return result, nil
}

// CountUsersWithoutTOTP returns the number of non-banned users that do not
// currently have a confirmed TOTP secret.
func (d *DB) CountUsersWithoutTOTP(ctx context.Context) (int, error) {
	count, err := d.q.CountUsersWithoutTOTP(ctx)
	if err != nil {
		return 0, fmt.Errorf("CountUsersWithoutTOTP: %w", err)
	}
	return int(count), nil
}

// ─── Backup ───────────────────────────────────────────────────────────────────

// BackupTo creates an online backup of the database using SQLite's VACUUM INTO.
// The destination path must not already exist.
//
// Security: VACUUM INTO does not support bind parameters, so the path is
// interpolated into SQL. To prevent injection we enforce two structural guards:
//  1. The path must resolve to a location under safeRoot (after filepath.Clean
//     and filepath.Abs).
//  2. After structural validation, any single-quote, semicolon, double-dash,
//     or null byte in the cleaned path causes rejection as defence-in-depth.
//
// The caller in handleBackup constructs the path from a hardcoded directory
// and a timestamp — no user input reaches this function.
func (d *DB) BackupTo(ctx context.Context, path string) error {
	return d.BackupToSafe(ctx, path, filepath.Join("data", "backups"))
}

// BackupToSafe is the internal implementation that accepts an explicit safe
// root directory. Exported for testing with isolated directories.
func (d *DB) BackupToSafe(ctx context.Context, path, safeRoot string) error {
	clean := filepath.Clean(path)

	absRoot, err := filepath.Abs(safeRoot)
	if err != nil {
		return fmt.Errorf("BackupToSafe: resolving safe root: %w", err)
	}
	absClean, err := filepath.Abs(clean)
	if err != nil {
		return fmt.Errorf("BackupToSafe: resolving path: %w", err)
	}

	// Structural guard: path must be under the safe root directory.
	if !strings.HasPrefix(absClean, absRoot+string(filepath.Separator)) {
		return fmt.Errorf("BackupToSafe: path %q is not under safe root %q", absClean, absRoot)
	}

	// Defence-in-depth: only allow safe characters (alphanumeric, path separators,
	// hyphen, underscore, dot, space, colon, tilde). This is a strict allowlist —
	// anything else is rejected to prevent SQL injection via the interpolated path.
	for _, ch := range absClean {
		switch {
		case ch >= 'a' && ch <= 'z',
			ch >= 'A' && ch <= 'Z',
			ch >= '0' && ch <= '9',
			ch == '/' || ch == '\\' || ch == '-' || ch == '_' || ch == '.' || ch == ' ' || ch == ':' || ch == '~':
			// allowed (colon for Windows drive letters, tilde for temp paths)
		default:
			return fmt.Errorf("BackupToSafe: path contains forbidden character %q", string(ch))
		}
	}

	// Reject SQL comment sequences that could break the VACUUM INTO statement,
	// even though individual hyphens are allowed for filenames.
	if strings.Contains(absClean, "--") {
		return fmt.Errorf("BackupToSafe: path contains forbidden sequence %q", "--")
	}

	_, err = d.sqlDB.ExecContext(ctx, fmt.Sprintf("VACUUM INTO '%s'", absClean))
	if err != nil {
		return fmt.Errorf("BackupToSafe: %w", err)
	}
	return nil
}