OwnCord/Server/admin/handlers_users.go

package admin

import (
	"encoding/json"
	"errors"
	"math"
	"net/http"
	"time"

	"github.com/owncord/server/db"
	"github.com/owncord/server/permissions"
	"github.com/owncord/server/service"
)

// ─── User Handlers ───────────────────────────────────────────────────────────

func handleGetStats(database *db.DB, hub HubBroadcaster) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		stats, err := database.GetServerStats(r.Context())
		if err != nil {
			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to get stats")
			return
		}
		if hub != nil {
			stats.OnlineCount = hub.ClientCount()
		}
		writeJSON(w, http.StatusOK, stats)
	}
}

func handleListUsers(database *db.DB) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		limit := queryInt(r, "limit", 50, 1, 500)
		offset := queryInt(r, "offset", 0, 0, math.MaxInt32)

		users, err := database.ListAllUsers(r.Context(), limit, offset)
		if err != nil {
			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to list users")
			return
		}

		safe := make([]adminUserResponse, len(users))
		for i := range users {
			safe[i] = toAdminUserResponse(users[i])
		}
		writeJSON(w, http.StatusOK, safe)
	}
}

// patchUserRequest is the JSON body for PATCH /admin/api/users/{id}.
type patchUserRequest struct {
	RoleID    *int64  `json:"role_id"`
	Banned    *bool   `json:"banned"`
	BanReason *string `json:"ban_reason"`
	// BanDurationHours makes the ban temporary: it expires this many hours
	// from now (login re-checks via IsEffectivelyBanned). Omitted or 0 =
	// permanent. Only meaningful with banned=true.
	BanDurationHours *int `json:"ban_duration_hours"`
}

// maxBanDurationHours caps temporary bans at one year; anything longer is
// effectively permanent and should be issued as such.
const maxBanDurationHours = 24 * 365

// memberUnbanBroadcaster is an optional capability of HubBroadcaster: tell
// every connected client a user is back in the roster after an unban, the
// mirror of BroadcastMemberBan. It is checked with a type assertion instead
// of being added to HubBroadcaster directly (admin/types.go, not owned by
// this change) so this fix does not force every HubBroadcaster
// implementation — production and test doubles alike — to gain the method
// before it compiles. See the batch report's cross_batch note: *ws.Hub needs
// BroadcastMemberUnban(userID int64) wired up for this to take effect at
// runtime; until then the assertion below simply misses and the handler's
// existing (pre-fix) behavior is unchanged.
type memberUnbanBroadcaster interface {
	BroadcastMemberUnban(userID int64)
}

// writeModerationErr maps ModerationService errors onto admin API responses.
func writeModerationErr(w http.ResponseWriter, err error) {
	switch {
	case errors.Is(err, service.ErrForbidden):
		writeErr(w, http.StatusForbidden, "FORBIDDEN", err.Error())
	case errors.Is(err, service.ErrNotFound):
		writeErr(w, http.StatusNotFound, "NOT_FOUND", "user not found")
	case errors.Is(err, service.ErrBadRequest):
		writeErr(w, http.StatusBadRequest, "BAD_REQUEST", err.Error())
	default:
		writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "moderation action failed")
	}
}

func handlePatchUser(database *db.DB, hub HubBroadcaster, permInvalidator PermissionInvalidator, mod *service.ModerationService) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		id, err := pathInt64(r, "id")
		if err != nil {
			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "invalid user id")
			return
		}

		var req patchUserRequest
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "invalid request body")
			return
		}

		user, err := database.GetUserByID(r.Context(), id)
		if err != nil {
			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to fetch user")
			return
		}
		if user == nil {
			writeErr(w, http.StatusNotFound, "NOT_FOUND", "user not found")
			return
		}

		actor := actorFromContext(r)

		// Prevent admins from modifying their own role or ban status, which
		// could lock them out of the admin panel with no recovery path.
		if id == actor {
			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "cannot modify your own account via admin panel")
			return
		}

		// Authorize the role change before applying anything else. Without
		// this pre-flight, a PATCH combining banned + role_id would commit
		// and broadcast the ban first and only then attempt the role change:
		// if that role change was then refused (missing MANAGE_ROLES, or the
		// new role outranks the actor), the handler reported the whole
		// request as failed while the target was in fact banned, audited,
		// and already dropped from every connected client's member list
		// (OC-0215). Running every ChangeUserRole precondition up front,
		// before either mutation lands, keeps the PATCH all-or-nothing from
		// the caller's perspective.
		if req.RoleID != nil {
			if mod == nil {
				// Fail closed rather than fall back to an unchecked UPDATE.
				writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "moderation service unavailable")
				return
			}
			if _, _, _, err := mod.AuthorizeRoleChange(r.Context(), actor, id, *req.RoleID); err != nil {
				writeModerationErr(w, err)
				return
			}
		}

		// Ban/unban first: it routes through ModerationService, which enforces
		// BAN_MEMBERS + role hierarchy (the admin-auth perimeter alone does
		// not — any admin-panel actor could previously ban the owner). The
		// role change, if requested, was already authorized above, so a ban
		// committing here cannot be followed by a refused role change leaving
		// a half-applied PATCH behind.
		if req.Banned != nil {
			if mod == nil {
				// Fail closed rather than fall back to an unchecked UPDATE.
				writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "moderation service unavailable")
				return
			}
			banReason := ""
			if req.BanReason != nil {
				banReason = *req.BanReason
			}
			var banExpires *time.Time
			if req.BanDurationHours != nil && *req.BanDurationHours != 0 {
				hours := *req.BanDurationHours
				if hours < 0 || hours > maxBanDurationHours {
					writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "ban_duration_hours must be between 1 and 8760")
					return
				}
				t := time.Now().Add(time.Duration(hours) * time.Hour)
				banExpires = &t
			}
			var actionErr error
			if *req.Banned {
				actionErr = mod.BanUser(r.Context(), actor, id, banReason, banExpires)
			} else {
				actionErr = mod.UnbanUser(r.Context(), actor, id)
			}
			if actionErr != nil {
				writeModerationErr(w, actionErr)
				return
			}
			switch {
			case *req.Banned && hub != nil:
				hub.BroadcastMemberBan(id)
			case !*req.Banned && hub != nil:
				// Ban had no WS event on the way out (member_ban hard-deletes
				// the row client-side); unban needs one on the way back in, or
				// every already-connected client keeps the user missing from
				// its member store while a freshly connecting client sees them.
				if mub, ok := hub.(memberUnbanBroadcaster); ok {
					mub.BroadcastMemberUnban(id)
				}
			}
		}

		if req.RoleID != nil {
			// Routed through ModerationService, which re-runs the same
			// MANAGE_ROLES, actor-outranks-target, and assign-below-own-rank
			// checks the AuthorizeRoleChange pre-flight above already passed
			// (a second pass, not a redundant one: it catches anything that
			// changed in the window between the pre-flight and here, e.g. a
			// concurrent role delete), then commits and writes the audit row.
			if mod == nil {
				// Fail closed rather than fall back to an unchecked UPDATE.
				writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "moderation service unavailable")
				return
			}
			newRole, err := mod.ChangeUserRole(r.Context(), actor, id, *req.RoleID)
			if err != nil {
				writeModerationErr(w, err)
				return
			}
			if permInvalidator != nil {
				permInvalidator.InvalidateUser(id)
			}
			// Use the role ChangeUserRole already loaded and validated rather
			// than re-reading it: a re-read can race a concurrent role delete
			// (or a transient read error) and silently skip this whole
			// fan-out, leaving the demoted user's socket subscribed to
			// channels it can no longer read (OC-0045). The role change
			// itself already committed, so the fan-out must not be
			// conditional on anything past that point.
			if hub != nil {
				hub.BroadcastMemberUpdate(id, newRole.Name)
				// BroadcastMemberUpdate only revokes subscriptions the new
				// role can no longer read (hub_broadcast.go's
				// revokeUnreadableChannels); it never grants the ones the
				// new role newly gained READ_MESSAGES on. Without this,
				// a promoted user's sidebar is missing channels until
				// their next reconnect, unlike a role permission edit or
				// a role delete, which both re-derive visibility fully.
				hub.RefreshAllChannelVisibility()
			}
		}

		updated, err := database.GetUserByID(r.Context(), id)
		if err != nil {
			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to fetch updated user")
			return
		}
		writeJSON(w, http.StatusOK, toAdminUserResponseFromUser(r.Context(), database, updated))
	}
}

// handleForceLogout revokes every session of the target user. The route is
// gated on KICK_MEMBERS; ModerationService additionally enforces the
// actor-outranks-target hierarchy and writes the audit row.
func handleForceLogout(mod *service.ModerationService) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		id, err := pathInt64(r, "id")
		if err != nil {
			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "invalid user id")
			return
		}
		if mod == nil {
			// Fail closed rather than cut sessions without a hierarchy check.
			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "moderation service unavailable")
			return
		}

		if err := mod.ForceLogout(r.Context(), actorFromContext(r), id); err != nil {
			writeModerationErr(w, err)
			return
		}
		w.WriteHeader(http.StatusNoContent)
	}
}

// handleGetMe describes the calling principal so the admin panel can hide the
// surfaces its role cannot use. Perimeter-level: every authenticated principal
// may read its own permissions.
func handleGetMe() http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		user, userOK := r.Context().Value(adminUserKey).(*db.User)
		role, roleOK := r.Context().Value(adminRoleKey).(*db.Role)
		if !userOK || user == nil || !roleOK || role == nil {
			writeErr(w, http.StatusUnauthorized, "UNAUTHORIZED", "not authenticated")
			return
		}
		writeJSON(w, http.StatusOK, adminMeResponse{
			ID:           user.ID,
			Username:     user.Username,
			RoleID:       role.ID,
			RoleName:     role.Name,
			RolePosition: role.Position,
			Permissions:  role.Permissions,
			IsOwner:      role.Position >= permissions.OwnerRolePosition,
		})
	}
}