feat(admission): add group VPN exceptions
This commit is contained in:
@@ -63,7 +63,7 @@ export default async function AccountPage({
|
||||
.orderBy(desc(ipObservations.observedAt))
|
||||
.limit(100),
|
||||
discordIdentity(user),
|
||||
db.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, isDefault: groups.isDefault })
|
||||
db.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, anonymizedNetworksAllowed: groups.anonymizedNetworksAllowed, isDefault: groups.isDefault })
|
||||
.from(groups)
|
||||
.leftJoin(userGroupMemberships, eq(userGroupMemberships.groupId, groups.id))
|
||||
.where(or(eq(groups.isDefault, true), eq(userGroupMemberships.userId, user.id)))
|
||||
@@ -192,8 +192,8 @@ export default async function AccountPage({
|
||||
</form>
|
||||
<section className="mt-8 border border-line bg-panel p-6">
|
||||
<p className="font-mono text-[10px] font-bold uppercase tracking-widest text-muted">Access groups</p>
|
||||
{effectiveGroup ? <div className="mt-4 flex items-center justify-between gap-3"><span className="font-mono text-xs font-bold">{effectiveGroup.name}{effectiveGroup.isDefault ? " · default" : ""}</span><span className={`px-2 py-1 font-mono text-[9px] font-bold uppercase ${effectiveGroup.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{effectiveGroup.accessEnabled ? "Access on" : "Access off"}</span></div> : <p className="mt-4 text-sm text-accent">No default access group is configured.</p>}
|
||||
<p className="mt-4 text-xs leading-5 text-muted">Your effective group alone determines Minecraft access.</p>
|
||||
{effectiveGroup ? <div className="mt-4 flex flex-wrap items-center justify-between gap-3"><span className="font-mono text-xs font-bold">{effectiveGroup.name}{effectiveGroup.isDefault ? " · default" : ""}</span><div className="flex gap-2"><span className={`px-2 py-1 font-mono text-[9px] font-bold uppercase ${effectiveGroup.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{effectiveGroup.accessEnabled ? "Access on" : "Access off"}</span><span className="border border-line px-2 py-1 font-mono text-[9px] font-bold uppercase">VPN {effectiveGroup.anonymizedNetworksAllowed ? "allowed" : "denied"}</span></div></div> : <p className="mt-4 text-sm text-accent">No default access group is configured.</p>}
|
||||
<p className="mt-4 text-xs leading-5 text-muted">Your effective group alone determines Minecraft and VPN/proxy/Tor access.</p>
|
||||
</section>
|
||||
</aside>
|
||||
</div>
|
||||
|
||||
@@ -1,32 +1,44 @@
|
||||
"use server";
|
||||
|
||||
import { appSettings } from "@minecraft-account-manager/database";
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { appSettings, events } from "@minecraft-account-manager/database";
|
||||
import { getClientIp } from "@minecraft-account-manager/network";
|
||||
import { eq } from "drizzle-orm";
|
||||
import { headers } from "next/headers";
|
||||
import { redirect } from "next/navigation";
|
||||
import { parseAdmissionMessages } from "@/lib/admission-settings";
|
||||
import { requireAdminSession } from "@/lib/auth/require-admin";
|
||||
import { db } from "@/lib/database";
|
||||
|
||||
export async function saveDiscordSettings(formData: FormData) {
|
||||
await requireAdminSession();
|
||||
export async function saveAdmissionSettings(formData: FormData) {
|
||||
const admin = await requireAdminSession();
|
||||
const messages = parseAdmissionMessages(formData);
|
||||
if (!messages) redirect("/admin/settings?error=invalid-message");
|
||||
|
||||
const registrationMessage = String(formData.get("registrationMessage") ?? "").trim();
|
||||
|
||||
if (registrationMessage.length < 10 || registrationMessage.length > 500) {
|
||||
redirect("/admin/settings?error=invalid-message");
|
||||
}
|
||||
|
||||
await db
|
||||
.insert(appSettings)
|
||||
.values({
|
||||
id: "default",
|
||||
registrationMessage,
|
||||
})
|
||||
.onConflictDoUpdate({
|
||||
target: appSettings.id,
|
||||
set: {
|
||||
registrationMessage,
|
||||
updatedAt: new Date(),
|
||||
},
|
||||
});
|
||||
const requestHeaders = await headers();
|
||||
const ipAddress = getClientIp(requestHeaders, process.env.TRUST_PROXY === "true");
|
||||
await db.transaction(async (tx) => {
|
||||
const [previous] = await tx.select().from(appSettings).where(eq(appSettings.id, "default")).limit(1);
|
||||
const changedFields = (Object.keys(messages) as Array<keyof typeof messages>)
|
||||
.filter((field) => previous?.[field] !== messages[field]);
|
||||
await tx.insert(appSettings)
|
||||
.values({ id: "default", ...messages })
|
||||
.onConflictDoUpdate({
|
||||
target: appSettings.id,
|
||||
set: { ...messages, updatedAt: new Date() },
|
||||
});
|
||||
if (changedFields.length) {
|
||||
await tx.insert(events).values({
|
||||
id: randomUUID(),
|
||||
source: "/web/admin",
|
||||
type: "games.minecraft.account-manager.settings.admission-messages-updated",
|
||||
subject: "settings/default",
|
||||
time: new Date(),
|
||||
data: { changedFields, adminEmail: admin.email, adminName: admin.name },
|
||||
ipAddress: ipAddress ?? null,
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
redirect("/admin/settings?saved=1");
|
||||
}
|
||||
|
||||
@@ -3,11 +3,12 @@ import { asc, eq } from "drizzle-orm";
|
||||
import Link from "next/link";
|
||||
import { notFound } from "next/navigation";
|
||||
import { db } from "@/lib/database";
|
||||
import { addGroupMember, assignDefaultGroup, deleteGroup, removeGroupMember, setGroupAccess } from "../actions";
|
||||
import { addGroupMember, assignDefaultGroup, deleteGroup, removeGroupMember, setGroupAccess, setGroupAnonymizedNetworkAccess } from "../actions";
|
||||
|
||||
const savedMessages: Record<string, string> = {
|
||||
created: "Group created with access disabled.",
|
||||
access: "Group access policy updated.",
|
||||
"network-access": "Group VPN, proxy, and Tor policy updated.",
|
||||
"member-added": "User assigned to the group.",
|
||||
"member-removed": "User returned to the default group.",
|
||||
};
|
||||
@@ -54,13 +55,22 @@ export default async function GroupPage({
|
||||
<div className="mt-4 flex flex-wrap items-center gap-3"><h1 className="font-display text-5xl font-black uppercase sm:text-7xl">{group.name}</h1>{group.isDefault && <span className="bg-ink px-3 py-2 font-mono text-[9px] font-bold uppercase text-canvas">Default</span>}</div>
|
||||
<p className="mt-3 max-w-2xl text-sm leading-6 text-muted">{group.description ?? "No description."}</p>
|
||||
</div>
|
||||
<form action={setGroupAccess} className="border-l-2 border-accent pl-5">
|
||||
<input name="groupId" type="hidden" value={group.id} />
|
||||
<input name="accessEnabled" type="hidden" value={group.accessEnabled ? "no" : "yes"} />
|
||||
<p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Minecraft admission</p>
|
||||
<p className="mt-2 font-display text-2xl font-black uppercase">{group.accessEnabled ? "Allowed" : "Denied"}</p>
|
||||
<button className="mt-3 font-mono text-[9px] font-bold uppercase text-accent underline underline-offset-4" type="submit">Turn access {group.accessEnabled ? "off" : "on"}</button>
|
||||
</form>
|
||||
<div className="grid gap-6 sm:grid-cols-2">
|
||||
<form action={setGroupAccess} className="border-l-2 border-accent pl-5">
|
||||
<input name="groupId" type="hidden" value={group.id} />
|
||||
<input name="accessEnabled" type="hidden" value={group.accessEnabled ? "no" : "yes"} />
|
||||
<p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Minecraft admission</p>
|
||||
<p className="mt-2 font-display text-2xl font-black uppercase">{group.accessEnabled ? "Allowed" : "Denied"}</p>
|
||||
<button className="mt-3 font-mono text-[9px] font-bold uppercase text-accent underline underline-offset-4" type="submit">Turn access {group.accessEnabled ? "off" : "on"}</button>
|
||||
</form>
|
||||
<form action={setGroupAnonymizedNetworkAccess} className="border-l-2 border-accent pl-5">
|
||||
<input name="groupId" type="hidden" value={group.id} />
|
||||
<input name="anonymizedNetworksAllowed" type="hidden" value={group.anonymizedNetworksAllowed ? "no" : "yes"} />
|
||||
<p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">VPN / proxy / Tor</p>
|
||||
<p className="mt-2 font-display text-2xl font-black uppercase">{group.anonymizedNetworksAllowed ? "Allowed" : "Denied"}</p>
|
||||
<button className="mt-3 font-mono text-[9px] font-bold uppercase text-accent underline underline-offset-4" type="submit">Turn exceptions {group.anonymizedNetworksAllowed ? "off" : "on"}</button>
|
||||
</form>
|
||||
</div>
|
||||
</header>
|
||||
|
||||
{query.saved && <p className="mt-7 border-l-2 border-signal bg-panel px-5 py-4 font-mono text-xs font-bold uppercase tracking-wider" role="status">{savedMessages[query.saved] ?? "Group updated."}</p>}
|
||||
|
||||
@@ -33,6 +33,7 @@ export async function createGroup(formData: FormData) {
|
||||
slug,
|
||||
description: description || null,
|
||||
accessEnabled: false,
|
||||
anonymizedNetworksAllowed: false,
|
||||
isDefault: false,
|
||||
}).returning({ id: groups.id });
|
||||
} catch {
|
||||
@@ -44,6 +45,7 @@ export async function createGroup(formData: FormData) {
|
||||
name,
|
||||
slug,
|
||||
accessEnabled: false,
|
||||
anonymizedNetworksAllowed: false,
|
||||
});
|
||||
redirect(groupPath(group.id, "saved=created"));
|
||||
}
|
||||
@@ -65,6 +67,33 @@ export async function setGroupAccess(formData: FormData) {
|
||||
redirect(groupPath(group.id, "saved=access"));
|
||||
}
|
||||
|
||||
export async function setGroupAnonymizedNetworkAccess(formData: FormData) {
|
||||
const admin = await requireAdminSession();
|
||||
const groupId = String(formData.get("groupId") ?? "");
|
||||
const anonymizedNetworksAllowed = formData.get("anonymizedNetworksAllowed") === "yes";
|
||||
if (!UUID_PATTERN.test(groupId)) redirect("/admin/groups?error=unknown-group");
|
||||
const requestHeaders = await headers();
|
||||
const ipAddress = getClientIp(requestHeaders, process.env.TRUST_PROXY === "true");
|
||||
|
||||
const group = await db.transaction(async (tx) => {
|
||||
const [updated] = await tx.update(groups).set({ anonymizedNetworksAllowed, updatedAt: new Date() })
|
||||
.where(eq(groups.id, groupId)).returning({ id: groups.id, name: groups.name });
|
||||
if (!updated) return null;
|
||||
await tx.insert(events).values({
|
||||
id: randomUUID(),
|
||||
source: "/web/admin",
|
||||
type: "games.minecraft.account-manager.group.anonymized-network-access-updated",
|
||||
subject: `group/${updated.id}`,
|
||||
time: new Date(),
|
||||
data: { name: updated.name, anonymizedNetworksAllowed, adminEmail: admin.email, adminName: admin.name },
|
||||
ipAddress: ipAddress ?? null,
|
||||
});
|
||||
return updated;
|
||||
});
|
||||
if (!group) redirect("/admin/groups?error=unknown-group");
|
||||
redirect(groupPath(group.id, "saved=network-access"));
|
||||
}
|
||||
|
||||
export async function addGroupMember(formData: FormData) {
|
||||
const admin = await requireAdminSession();
|
||||
const groupId = String(formData.get("groupId") ?? "");
|
||||
|
||||
@@ -53,7 +53,7 @@ export default async function GroupsPage({ searchParams }: { searchParams: Promi
|
||||
</div>
|
||||
<p className="mt-1 font-mono text-[10px] text-muted">{group.slug} · {memberCount} members</p>
|
||||
</div>
|
||||
<span className={`px-3 py-2 font-mono text-[9px] font-bold uppercase ${group.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{group.accessEnabled ? "Access on" : "Access off"}</span>
|
||||
<div className="flex flex-col items-end gap-2"><span className={`px-3 py-2 font-mono text-[9px] font-bold uppercase ${group.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{group.accessEnabled ? "Access on" : "Access off"}</span><span className="font-mono text-[9px] font-bold uppercase text-muted">VPN {group.anonymizedNetworksAllowed ? "allowed" : "denied"}</span></div>
|
||||
</div>
|
||||
<p className="mt-4 min-h-12 text-sm leading-6 text-muted">{group.description ?? "No description."}</p>
|
||||
<div className="mt-5 flex items-center justify-between gap-4 border-t border-line pt-4">
|
||||
@@ -76,7 +76,7 @@ export default async function GroupsPage({ searchParams }: { searchParams: Promi
|
||||
<label className="text-sm font-bold">Slug<input className="mt-2 w-full border border-line bg-canvas px-4 py-3 font-mono font-normal outline-none focus:border-accent" maxLength={50} name="slug" pattern="[a-z0-9]+(?:-[a-z0-9]+)*" placeholder="ops" required /></label>
|
||||
</div>
|
||||
<label className="mt-5 block text-sm font-bold">Description<textarea className="mt-2 min-h-24 w-full border border-line bg-canvas px-4 py-3 font-normal outline-none focus:border-accent" maxLength={500} name="description" /></label>
|
||||
<p className="mt-4 text-xs text-muted">New groups start with access disabled.</p>
|
||||
<p className="mt-4 text-xs text-muted">New groups start with Minecraft access and VPN/proxy/Tor exceptions disabled.</p>
|
||||
<button className="mt-6 border border-ink bg-ink px-5 py-3 font-mono text-[10px] font-bold uppercase tracking-wider text-canvas" type="submit">Create group</button>
|
||||
</form>
|
||||
</main>
|
||||
|
||||
@@ -1,7 +1,8 @@
|
||||
import { appSettings } from "@minecraft-account-manager/database";
|
||||
import { eq } from "drizzle-orm";
|
||||
import { DEFAULT_ADMISSION_MESSAGES } from "@/lib/admission-settings";
|
||||
import { db } from "@/lib/database";
|
||||
import { saveDiscordSettings } from "../actions";
|
||||
import { saveAdmissionSettings } from "../actions";
|
||||
|
||||
export const dynamic = "force-dynamic";
|
||||
|
||||
@@ -12,7 +13,11 @@ export default async function SettingsPage({
|
||||
}) {
|
||||
const query = await searchParams;
|
||||
const [settings] = await db.select().from(appSettings).where(eq(appSettings.id, "default")).limit(1);
|
||||
const message = settings?.registrationMessage ?? "Please register your Minecraft account before joining.";
|
||||
const messages = {
|
||||
registrationMessage: settings?.registrationMessage ?? DEFAULT_ADMISSION_MESSAGES.registrationMessage,
|
||||
groupAccessDeniedMessage: settings?.groupAccessDeniedMessage ?? DEFAULT_ADMISSION_MESSAGES.groupAccessDeniedMessage,
|
||||
vpnDeniedMessage: settings?.vpnDeniedMessage ?? DEFAULT_ADMISSION_MESSAGES.vpnDeniedMessage,
|
||||
};
|
||||
const guildId = process.env.DISCORD_GUILD_ID?.trim();
|
||||
const inviteUrl = process.env.DISCORD_INVITE_URL?.trim();
|
||||
|
||||
@@ -29,23 +34,50 @@ export default async function SettingsPage({
|
||||
</dl>
|
||||
</section>
|
||||
|
||||
<form action={saveDiscordSettings} className="border border-line bg-panel p-7 shadow-[8px_8px_0_var(--color-shadow)] sm:p-9">
|
||||
<form action={saveAdmissionSettings} className="border border-line bg-panel p-7 shadow-[8px_8px_0_var(--color-shadow)] sm:p-9">
|
||||
{query.saved && <p className="mb-6 border-l-2 border-signal pl-4 font-mono text-xs font-bold uppercase tracking-wider" role="status">Settings saved</p>}
|
||||
{query.error && <p className="mb-6 border-l-2 border-accent pl-4 text-sm" role="alert">Check the configuration value and try again.</p>}
|
||||
|
||||
<label className="block font-mono text-xs font-bold uppercase tracking-wider" htmlFor="registrationMessage">Denied-player message</label>
|
||||
<textarea
|
||||
className="mt-3 min-h-32 w-full resize-y border border-line bg-canvas px-4 py-3 text-sm leading-6 outline-none focus:border-accent"
|
||||
defaultValue={message}
|
||||
id="registrationMessage"
|
||||
maxLength={500}
|
||||
minLength={10}
|
||||
name="registrationMessage"
|
||||
required
|
||||
/>
|
||||
<fieldset className="space-y-7">
|
||||
<legend className="font-display text-2xl font-black uppercase">Minecraft denial messages</legend>
|
||||
<p className="text-sm leading-6 text-muted">Each plain-text message is returned for one admission outcome. Messages must be between 10 and 500 characters.</p>
|
||||
<AdmissionMessageField description="Shown when the Minecraft identity is not registered." label="Registration required" name="registrationMessage" value={messages.registrationMessage} />
|
||||
<AdmissionMessageField description="Shown when the effective group has Minecraft access disabled." label="Group access disabled" name="groupAccessDeniedMessage" value={messages.groupAccessDeniedMessage} />
|
||||
<AdmissionMessageField description="Shown for VPN, proxy, or Tor connections when the effective group has no exception." label="VPN, proxy, or Tor denied" name="vpnDeniedMessage" value={messages.vpnDeniedMessage} />
|
||||
</fieldset>
|
||||
<button className="mt-8 border border-ink bg-ink px-6 py-3 font-mono text-xs font-bold uppercase tracking-[0.16em] text-canvas hover:bg-accent" type="submit">Save configuration</button>
|
||||
</form>
|
||||
</div>
|
||||
</main>
|
||||
);
|
||||
}
|
||||
|
||||
function AdmissionMessageField({
|
||||
description,
|
||||
label,
|
||||
name,
|
||||
value,
|
||||
}: {
|
||||
description: string;
|
||||
label: string;
|
||||
name: "registrationMessage" | "groupAccessDeniedMessage" | "vpnDeniedMessage";
|
||||
value: string;
|
||||
}) {
|
||||
const descriptionId = `${name}-description`;
|
||||
return (
|
||||
<div>
|
||||
<label className="block font-mono text-xs font-bold uppercase tracking-wider" htmlFor={name}>{label}</label>
|
||||
<p className="mt-2 text-xs leading-5 text-muted" id={descriptionId}>{description}</p>
|
||||
<textarea
|
||||
aria-describedby={descriptionId}
|
||||
className="mt-3 min-h-28 w-full resize-y border border-line bg-canvas px-4 py-3 text-sm leading-6 outline-none focus:border-accent"
|
||||
defaultValue={value}
|
||||
id={name}
|
||||
maxLength={500}
|
||||
minLength={10}
|
||||
name={name}
|
||||
required
|
||||
/>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
@@ -86,7 +86,7 @@ export default async function AdminUserPage({
|
||||
.orderBy(desc(ipObservations.observedAt))
|
||||
.limit(100),
|
||||
discordIdentity(user),
|
||||
db.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, isDefault: groups.isDefault })
|
||||
db.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, anonymizedNetworksAllowed: groups.anonymizedNetworksAllowed, isDefault: groups.isDefault })
|
||||
.from(groups)
|
||||
.leftJoin(userGroupMemberships, eq(userGroupMemberships.groupId, groups.id))
|
||||
.where(or(eq(groups.isDefault, true), eq(userGroupMemberships.userId, user.id)))
|
||||
@@ -208,7 +208,7 @@ export default async function AdminUserPage({
|
||||
|
||||
<section className="border border-line bg-panel p-6">
|
||||
<div className="flex items-center justify-between gap-3"><p className="font-mono text-[9px] font-bold uppercase tracking-widest text-muted">Access groups</p><Link className="font-mono text-[9px] font-bold uppercase underline underline-offset-4" href="/admin/groups">Manage</Link></div>
|
||||
{effectiveGroup ? <div className="mt-4 flex items-center justify-between gap-3"><Link className="font-mono text-xs font-bold underline decoration-line underline-offset-4" href={`/admin/groups/${effectiveGroup.id}`}>{effectiveGroup.name}{effectiveGroup.isDefault ? " · default" : ""}</Link><span className={`px-2 py-1 font-mono text-[9px] font-bold uppercase ${effectiveGroup.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{effectiveGroup.accessEnabled ? "On" : "Off"}</span></div> : <p className="mt-4 text-sm text-accent">No effective group configured.</p>}
|
||||
{effectiveGroup ? <div className="mt-4 flex flex-wrap items-center justify-between gap-3"><Link className="font-mono text-xs font-bold underline decoration-line underline-offset-4" href={`/admin/groups/${effectiveGroup.id}`}>{effectiveGroup.name}{effectiveGroup.isDefault ? " · default" : ""}</Link><div className="flex gap-2"><span className={`px-2 py-1 font-mono text-[9px] font-bold uppercase ${effectiveGroup.accessEnabled ? "bg-signal text-ink" : "bg-accent text-canvas"}`}>{effectiveGroup.accessEnabled ? "Access on" : "Access off"}</span><span className="border border-line px-2 py-1 font-mono text-[9px] font-bold uppercase">VPN {effectiveGroup.anonymizedNetworksAllowed ? "allowed" : "denied"}</span></div></div> : <p className="mt-4 text-sm text-accent">No effective group configured.</p>}
|
||||
</section>
|
||||
|
||||
<section className="border border-line bg-panel p-6">
|
||||
|
||||
@@ -1,12 +1,15 @@
|
||||
"use server";
|
||||
|
||||
import { randomUUID } from "node:crypto";
|
||||
import {
|
||||
formatManagedDiscordNickname,
|
||||
lookupJavaProfile,
|
||||
updateGuildNickname,
|
||||
} from "@minecraft-account-manager/minecraft";
|
||||
import { minecraftAccounts, users } from "@minecraft-account-manager/database";
|
||||
import { and, eq, isNull, ne } from "drizzle-orm";
|
||||
import { events, groups, minecraftAccounts, userGroupMemberships, users } from "@minecraft-account-manager/database";
|
||||
import { getClientIp } from "@minecraft-account-manager/network";
|
||||
import { and, eq, isNull, ne, sql } from "drizzle-orm";
|
||||
import { headers } from "next/headers";
|
||||
import { redirect } from "next/navigation";
|
||||
import { recordAdminEvent } from "@/lib/audit";
|
||||
import { requireAdminSession } from "@/lib/auth/require-admin";
|
||||
@@ -19,6 +22,12 @@ function userPath(userId: string, query?: string) {
|
||||
return `/admin/users/${encodeURIComponent(userId)}${query ? `?${query}` : ""}`;
|
||||
}
|
||||
|
||||
function userRegistryPath(search: string, result: "saved=group" | "error=invalid-group-assignment") {
|
||||
const query = new URLSearchParams(result);
|
||||
if (search) query.set("q", search);
|
||||
return `/admin/users?${query.toString()}`;
|
||||
}
|
||||
|
||||
async function targetUser(userId: string) {
|
||||
if (!UUID_PATTERN.test(userId)) return null;
|
||||
const [user] = await db.select().from(users).where(eq(users.id, userId)).limit(1);
|
||||
@@ -72,6 +81,61 @@ async function recordSyncFailure(
|
||||
);
|
||||
}
|
||||
|
||||
export async function assignUserGroupFromRegistry(formData: FormData) {
|
||||
const admin = await requireAdminSession();
|
||||
const userId = String(formData.get("userId") ?? "");
|
||||
const groupId = String(formData.get("groupId") ?? "");
|
||||
const search = String(formData.get("search") ?? "").trim().slice(0, 100);
|
||||
if (!UUID_PATTERN.test(userId) || !UUID_PATTERN.test(groupId)) redirect(userRegistryPath(search, "error=invalid-group-assignment"));
|
||||
|
||||
const [[user], [targetGroup]] = await Promise.all([
|
||||
db.select({ id: users.id }).from(users).where(eq(users.id, userId)).limit(1),
|
||||
db.select({ id: groups.id, name: groups.name, isDefault: groups.isDefault }).from(groups).where(eq(groups.id, groupId)).limit(1),
|
||||
]);
|
||||
if (!user || !targetGroup) redirect(userRegistryPath(search, "error=invalid-group-assignment"));
|
||||
|
||||
const requestHeaders = await headers();
|
||||
const ipAddress = getClientIp(requestHeaders, process.env.TRUST_PROXY === "true");
|
||||
try {
|
||||
await db.transaction(async (tx) => {
|
||||
await tx.execute(sql`select ${users.id} from ${users} where ${users.id} = ${user.id} for update`);
|
||||
const [previous] = await tx.select({ id: groups.id, name: groups.name })
|
||||
.from(userGroupMemberships)
|
||||
.innerJoin(groups, eq(groups.id, userGroupMemberships.groupId))
|
||||
.where(eq(userGroupMemberships.userId, user.id))
|
||||
.limit(1);
|
||||
if (targetGroup.isDefault) {
|
||||
await tx.delete(userGroupMemberships).where(eq(userGroupMemberships.userId, user.id));
|
||||
} else {
|
||||
await tx.insert(userGroupMemberships).values({ userId: user.id, groupId: targetGroup.id })
|
||||
.onConflictDoUpdate({
|
||||
target: userGroupMemberships.userId,
|
||||
set: { groupId: targetGroup.id },
|
||||
});
|
||||
}
|
||||
await tx.insert(events).values({
|
||||
id: randomUUID(),
|
||||
source: "/web/admin",
|
||||
type: "games.minecraft.account-manager.group.assignment-updated",
|
||||
subject: `user/${user.id}`,
|
||||
time: new Date(),
|
||||
data: {
|
||||
groupId: targetGroup.id,
|
||||
groupName: targetGroup.name,
|
||||
previousGroupId: previous?.id ?? null,
|
||||
previousGroupName: previous?.name ?? "everyone",
|
||||
adminEmail: admin.email,
|
||||
adminName: admin.name,
|
||||
},
|
||||
ipAddress: ipAddress ?? null,
|
||||
});
|
||||
});
|
||||
} catch {
|
||||
redirect(userRegistryPath(search, "error=invalid-group-assignment"));
|
||||
}
|
||||
redirect(userRegistryPath(search, "saved=group"));
|
||||
}
|
||||
|
||||
export async function updateUserName(formData: FormData) {
|
||||
const admin = await requireAdminSession();
|
||||
const userId = String(formData.get("userId") ?? "");
|
||||
|
||||
@@ -1,14 +1,16 @@
|
||||
import { minecraftAccounts, users } from "@minecraft-account-manager/database";
|
||||
import { and, eq, ilike, isNull, or, sql } from "drizzle-orm";
|
||||
import { groups, minecraftAccounts, userGroupMemberships, users } from "@minecraft-account-manager/database";
|
||||
import { and, asc, desc, eq, ilike, isNull, or, sql } from "drizzle-orm";
|
||||
import Link from "next/link";
|
||||
import { UserGroupSelect } from "@/components/user-group-select";
|
||||
import { db } from "@/lib/database";
|
||||
import { assignUserGroupFromRegistry } from "./actions";
|
||||
|
||||
export const dynamic = "force-dynamic";
|
||||
|
||||
export default async function AdminUsersPage({
|
||||
searchParams,
|
||||
}: {
|
||||
searchParams: Promise<{ q?: string; error?: string }>;
|
||||
searchParams: Promise<{ q?: string; error?: string; saved?: string }>;
|
||||
}) {
|
||||
const query = await searchParams;
|
||||
const search = query.q?.trim().slice(0, 100) ?? "";
|
||||
@@ -31,33 +33,41 @@ export default async function AdminUsersPage({
|
||||
)
|
||||
: undefined;
|
||||
|
||||
const results = await db
|
||||
.select({
|
||||
id: users.id,
|
||||
firstName: users.firstName,
|
||||
discordUsername: users.discordUsername,
|
||||
discordGlobalName: users.discordGlobalName,
|
||||
discordUserId: users.discordUserId,
|
||||
onboardingCompletedAt: users.onboardingCompletedAt,
|
||||
primaryUsername: minecraftAccounts.username,
|
||||
accountCount: sql<number>`(
|
||||
select count(*)::int from ${minecraftAccounts} account_count
|
||||
where account_count.user_id = ${users.id}
|
||||
and account_count.deleted_at is null
|
||||
)`,
|
||||
})
|
||||
.from(users)
|
||||
.leftJoin(
|
||||
minecraftAccounts,
|
||||
and(
|
||||
eq(minecraftAccounts.userId, users.id),
|
||||
eq(minecraftAccounts.isPrimary, true),
|
||||
isNull(minecraftAccounts.deletedAt),
|
||||
),
|
||||
)
|
||||
.where(where)
|
||||
.orderBy(users.firstName, users.discordUsername)
|
||||
.limit(100);
|
||||
const [results, allGroups, memberships] = await Promise.all([
|
||||
db
|
||||
.select({
|
||||
id: users.id,
|
||||
firstName: users.firstName,
|
||||
discordUsername: users.discordUsername,
|
||||
discordGlobalName: users.discordGlobalName,
|
||||
discordUserId: users.discordUserId,
|
||||
onboardingCompletedAt: users.onboardingCompletedAt,
|
||||
primaryUsername: minecraftAccounts.username,
|
||||
accountCount: sql<number>`(
|
||||
select count(*)::int from ${minecraftAccounts} account_count
|
||||
where account_count.user_id = ${users.id}
|
||||
and account_count.deleted_at is null
|
||||
)`,
|
||||
})
|
||||
.from(users)
|
||||
.leftJoin(
|
||||
minecraftAccounts,
|
||||
and(
|
||||
eq(minecraftAccounts.userId, users.id),
|
||||
eq(minecraftAccounts.isPrimary, true),
|
||||
isNull(minecraftAccounts.deletedAt),
|
||||
),
|
||||
)
|
||||
.where(where)
|
||||
.orderBy(users.firstName, users.discordUsername)
|
||||
.limit(100),
|
||||
db.select({ id: groups.id, name: groups.name, isDefault: groups.isDefault })
|
||||
.from(groups).orderBy(desc(groups.isDefault), asc(groups.name)),
|
||||
db.select({ userId: userGroupMemberships.userId, groupId: userGroupMemberships.groupId })
|
||||
.from(userGroupMemberships),
|
||||
]);
|
||||
const defaultGroup = allGroups.find((group) => group.isDefault);
|
||||
const groupByUser = new Map(memberships.map((membership) => [membership.userId, membership.groupId]));
|
||||
|
||||
return (
|
||||
<main className="mx-auto max-w-6xl px-6 py-14">
|
||||
@@ -79,13 +89,14 @@ export default async function AdminUsersPage({
|
||||
</form>
|
||||
</div>
|
||||
|
||||
{query.error && <p className="mt-7 border-l-2 border-accent bg-panel px-5 py-4 text-sm text-accent" role="alert">The requested user could not be found.</p>}
|
||||
{query.error && <p className="mt-7 border-l-2 border-accent bg-panel px-5 py-4 text-sm text-accent" role="alert">{query.error === "invalid-group-assignment" ? "The user or group no longer exists. No group change was applied." : "The requested user could not be found."}</p>}
|
||||
{query.saved === "group" && <p className="mt-7 border-l-2 border-signal bg-panel px-5 py-4 text-sm" role="status">User group updated.</p>}
|
||||
|
||||
<div className="mt-8 overflow-x-auto border border-line bg-panel shadow-[8px_8px_0_var(--color-shadow)]">
|
||||
<table className="w-full min-w-[760px] border-collapse text-left">
|
||||
<table className="w-full min-w-[900px] border-collapse text-left">
|
||||
<caption className="sr-only">Registered portal users</caption>
|
||||
<thead className="border-b border-line font-mono text-[10px] uppercase tracking-widest text-muted">
|
||||
<tr><th className="p-4" scope="col">User</th><th className="p-4" scope="col">Discord</th><th className="p-4" scope="col">Primary</th><th className="p-4" scope="col">Accounts</th><th className="p-4" scope="col">Status</th></tr>
|
||||
<tr><th className="p-4" scope="col">User</th><th className="p-4" scope="col">Discord</th><th className="p-4" scope="col">Primary</th><th className="p-4" scope="col">Accounts</th><th className="p-4" scope="col">Group</th><th className="p-4" scope="col">Status</th></tr>
|
||||
</thead>
|
||||
<tbody className="divide-y divide-line">
|
||||
{results.map((user) => (
|
||||
@@ -94,10 +105,11 @@ export default async function AdminUsersPage({
|
||||
<td className="p-4"><div className="font-mono text-xs font-bold">{user.discordGlobalName ?? user.discordUsername}</div><div className="mt-1 font-mono text-[10px] text-muted">@{user.discordUsername}</div><div className="mt-1 font-mono text-[9px] text-muted">{user.discordUserId}</div></td>
|
||||
<td className="p-4 font-mono text-xs">{user.primaryUsername ?? "—"}</td>
|
||||
<td className="p-4 font-mono text-xs">{user.accountCount}</td>
|
||||
<td className="p-4">{defaultGroup ? <UserGroupSelect action={assignUserGroupFromRegistry} effectiveGroupId={groupByUser.get(user.id) ?? defaultGroup.id} groups={allGroups} search={search} userId={user.id} userLabel={user.firstName ?? user.discordUsername} /> : <span className="text-xs text-accent">Default group missing</span>}</td>
|
||||
<td className="p-4"><span className={`border px-2 py-1 font-mono text-[9px] uppercase tracking-wider ${user.onboardingCompletedAt ? "border-line text-muted" : "border-accent text-accent"}`}>{user.onboardingCompletedAt ? "Ready" : "Onboarding"}</span></td>
|
||||
</tr>
|
||||
))}
|
||||
{!results.length && <tr><td className="p-8 text-muted" colSpan={5}>No users match that search.</td></tr>}
|
||||
{!results.length && <tr><td className="p-8 text-muted" colSpan={6}>No users match that search.</td></tr>}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { isRequestTimestampFresh, resolveEffectiveGroup, verifyHashedToken } from "@minecraft-account-manager/auth";
|
||||
import { gameAdmissionDenialReason, isRequestTimestampFresh, resolveEffectiveGroup, verifyHashedToken } from "@minecraft-account-manager/auth";
|
||||
import { problemDetails, velocityAccessRequestSchema } from "@minecraft-account-manager/contracts";
|
||||
import {
|
||||
appSettings,
|
||||
@@ -13,6 +13,7 @@ import {
|
||||
} from "@minecraft-account-manager/database";
|
||||
import { and, eq, isNull, lt, sql } from "drizzle-orm";
|
||||
import { NextResponse } from "next/server";
|
||||
import { admissionDenialMessage, DEFAULT_ADMISSION_MESSAGES } from "@/lib/admission-settings";
|
||||
import { db } from "@/lib/database";
|
||||
import { isUniqueConstraintViolation } from "@/lib/database-errors";
|
||||
import { getIpIntelligence, toAuditIpData } from "@/lib/ip-intelligence";
|
||||
@@ -20,7 +21,6 @@ import { logger } from "@/lib/logger";
|
||||
import { problemInstance, problemResponse } from "@/lib/problem-response";
|
||||
|
||||
const MAX_CLOCK_SKEW_MS = 45_000;
|
||||
const DEFAULT_DENIAL_MESSAGE = "Please register your Minecraft account before joining.";
|
||||
|
||||
function methodNotAllowed(request: Request) {
|
||||
const response = problemResponse(problemDetails(
|
||||
@@ -111,35 +111,13 @@ async function handleVelocityAccess(request: Request) {
|
||||
}
|
||||
|
||||
const [settings] = await db.select().from(appSettings).where(eq(appSettings.id, "default")).limit(1);
|
||||
const denialMessage = settings?.registrationMessage ?? DEFAULT_DENIAL_MESSAGE;
|
||||
const admissionMessages = {
|
||||
registrationMessage: settings?.registrationMessage ?? DEFAULT_ADMISSION_MESSAGES.registrationMessage,
|
||||
groupAccessDeniedMessage: settings?.groupAccessDeniedMessage ?? DEFAULT_ADMISSION_MESSAGES.groupAccessDeniedMessage,
|
||||
vpnDeniedMessage: settings?.vpnDeniedMessage ?? DEFAULT_ADMISSION_MESSAGES.vpnDeniedMessage,
|
||||
};
|
||||
|
||||
let [knownAccount] = await db
|
||||
.select({ id: minecraftAccounts.id })
|
||||
.from(minecraftAccounts)
|
||||
.where(
|
||||
and(
|
||||
eq(minecraftAccounts.minecraftUuid, input.minecraftUuid),
|
||||
isNull(minecraftAccounts.deletedAt),
|
||||
),
|
||||
)
|
||||
.limit(1);
|
||||
if (!knownAccount) {
|
||||
[knownAccount] = await db
|
||||
.select({ id: minecraftAccounts.id })
|
||||
.from(minecraftAccounts)
|
||||
.where(
|
||||
and(
|
||||
isNull(minecraftAccounts.minecraftUuid),
|
||||
sql`lower(${minecraftAccounts.username}) = lower(${input.username})`,
|
||||
isNull(minecraftAccounts.deletedAt),
|
||||
),
|
||||
)
|
||||
.limit(1);
|
||||
}
|
||||
|
||||
const intelligence = knownAccount
|
||||
? await getIpIntelligence(input.ipAddress)
|
||||
: { classification: "unknown" as const, provider: null };
|
||||
const intelligence = await getIpIntelligence(input.ipAddress);
|
||||
const auditIpData = toAuditIpData(intelligence);
|
||||
|
||||
const decision = await db.transaction(async (tx) => {
|
||||
@@ -209,23 +187,24 @@ async function handleVelocityAccess(request: Request) {
|
||||
classification: intelligence.classification,
|
||||
observedAt: occurredAt,
|
||||
});
|
||||
return { allowed: false as const, message: denialMessage };
|
||||
return { allowed: false as const, message: admissionDenialMessage("not_registered", admissionMessages) };
|
||||
}
|
||||
|
||||
const [explicitGroup] = await tx
|
||||
.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled })
|
||||
.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, anonymizedNetworksAllowed: groups.anonymizedNetworksAllowed })
|
||||
.from(userGroupMemberships)
|
||||
.innerJoin(groups, eq(groups.id, userGroupMemberships.groupId))
|
||||
.where(eq(userGroupMemberships.userId, account.userId))
|
||||
.limit(1);
|
||||
const [defaultGroup] = await tx
|
||||
.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled })
|
||||
.select({ id: groups.id, name: groups.name, accessEnabled: groups.accessEnabled, anonymizedNetworksAllowed: groups.anonymizedNetworksAllowed })
|
||||
.from(groups)
|
||||
.where(eq(groups.isDefault, true))
|
||||
.limit(1);
|
||||
const effectiveGroup = resolveEffectiveGroup(explicitGroup ?? null, defaultGroup ?? null);
|
||||
|
||||
if (!effectiveGroup?.accessEnabled) {
|
||||
const denialReason = gameAdmissionDenialReason(effectiveGroup ?? null, intelligence.classification);
|
||||
if (denialReason) {
|
||||
await tx.insert(events).values({
|
||||
id: randomUUID(),
|
||||
source: `/velocity/${input.serverId}`,
|
||||
@@ -235,7 +214,9 @@ async function handleVelocityAccess(request: Request) {
|
||||
actorUserId: account.userId,
|
||||
data: {
|
||||
username: input.username,
|
||||
reason: "group_access_disabled",
|
||||
reason: denialReason,
|
||||
accessGroup: effectiveGroup?.name ?? null,
|
||||
accessGroupId: effectiveGroup?.id ?? null,
|
||||
ipIntelligence: auditIpData,
|
||||
},
|
||||
ipAddress: input.ipAddress,
|
||||
@@ -251,9 +232,14 @@ async function handleVelocityAccess(request: Request) {
|
||||
classification: intelligence.classification,
|
||||
observedAt: occurredAt,
|
||||
});
|
||||
return { allowed: false as const, message: "Your account group does not currently have server access." };
|
||||
return {
|
||||
allowed: false as const,
|
||||
message: admissionDenialMessage(denialReason, admissionMessages),
|
||||
};
|
||||
}
|
||||
|
||||
if (!effectiveGroup) throw new Error("Effective access group is unavailable after admission approval");
|
||||
|
||||
if (account.minecraftUuid !== input.minecraftUuid || account.username !== input.username) {
|
||||
await tx
|
||||
.update(minecraftAccounts)
|
||||
@@ -304,6 +290,7 @@ async function handleVelocityAccess(request: Request) {
|
||||
uuidBackfilled: account.minecraftUuid === null,
|
||||
ipIntelligence: auditIpData,
|
||||
accessGroup: effectiveGroup.name,
|
||||
accessGroupId: effectiveGroup.id,
|
||||
},
|
||||
ipAddress: input.ipAddress,
|
||||
correlationId: input.requestId,
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
import { renderToStaticMarkup } from "react-dom/server";
|
||||
import { describe, expect, it } from "vitest";
|
||||
import { UserGroupSelect } from "./user-group-select";
|
||||
|
||||
describe("UserGroupSelect", () => {
|
||||
it("renders the effective group and preserves the active search", () => {
|
||||
const markup = renderToStaticMarkup(<UserGroupSelect
|
||||
action={async () => undefined}
|
||||
effectiveGroupId="group-ops"
|
||||
groups={[{ id: "group-everyone", name: "everyone" }, { id: "group-ops", name: "Ops" }]}
|
||||
search="alex smith"
|
||||
userId="user-one"
|
||||
userLabel="Alex"
|
||||
/>);
|
||||
|
||||
expect(markup).toContain('aria-label="Group for Alex"');
|
||||
expect(markup).toContain('<option value="group-ops" selected="">Ops</option>');
|
||||
expect(markup).toContain('<input type="hidden" name="search" value="alex smith"/>');
|
||||
expect(markup).toContain("Apply group");
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,60 @@
|
||||
"use client";
|
||||
|
||||
import { useFormStatus } from "react-dom";
|
||||
|
||||
export function UserGroupSelect({
|
||||
action,
|
||||
effectiveGroupId,
|
||||
groups,
|
||||
search,
|
||||
userId,
|
||||
userLabel,
|
||||
}: {
|
||||
action: (formData: FormData) => Promise<void>;
|
||||
effectiveGroupId: string;
|
||||
groups: Array<{ id: string; name: string }>;
|
||||
search: string;
|
||||
userId: string;
|
||||
userLabel: string;
|
||||
}) {
|
||||
const helpId = `group-help-${userId}`;
|
||||
return (
|
||||
<form action={action} className="flex items-center gap-2">
|
||||
<input name="userId" type="hidden" value={userId} />
|
||||
<input name="search" type="hidden" value={search} />
|
||||
<span className="sr-only" id={helpId}>Changing this selection applies the group immediately.</span>
|
||||
<GroupSelectControl effectiveGroupId={effectiveGroupId} groups={groups} helpId={helpId} userLabel={userLabel} />
|
||||
</form>
|
||||
);
|
||||
}
|
||||
|
||||
function GroupSelectControl({
|
||||
effectiveGroupId,
|
||||
groups,
|
||||
helpId,
|
||||
userLabel,
|
||||
}: {
|
||||
effectiveGroupId: string;
|
||||
groups: Array<{ id: string; name: string }>;
|
||||
helpId: string;
|
||||
userLabel: string;
|
||||
}) {
|
||||
const { pending } = useFormStatus();
|
||||
return (
|
||||
<>
|
||||
<select
|
||||
aria-describedby={helpId}
|
||||
aria-label={`Group for ${userLabel}`}
|
||||
className="max-w-44 border border-line bg-canvas px-3 py-2 font-mono text-xs outline-none focus:border-accent disabled:cursor-wait disabled:opacity-60"
|
||||
defaultValue={effectiveGroupId}
|
||||
disabled={pending}
|
||||
name="groupId"
|
||||
onChange={(event) => event.currentTarget.form?.requestSubmit()}
|
||||
>
|
||||
{groups.map((group) => <option key={group.id} value={group.id}>{group.name}</option>)}
|
||||
</select>
|
||||
<span aria-live="polite" className="sr-only">{pending ? "Updating group." : ""}</span>
|
||||
<button className="sr-only focus:not-sr-only" disabled={pending} type="submit">Apply group</button>
|
||||
</>
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
import { describe, expect, it } from "vitest";
|
||||
import { admissionDenialMessage, DEFAULT_ADMISSION_MESSAGES, parseAdmissionMessages } from "./admission-settings";
|
||||
|
||||
describe("admission message settings", () => {
|
||||
it("normalizes three independently configured denial messages", () => {
|
||||
const formData = new FormData();
|
||||
formData.set("registrationMessage", " Register your account before joining. ");
|
||||
formData.set("groupAccessDeniedMessage", "This group cannot access the server right now.");
|
||||
formData.set("vpnDeniedMessage", "VPN access requires a host-approved exception.");
|
||||
|
||||
expect(parseAdmissionMessages(formData)).toEqual({
|
||||
registrationMessage: "Register your account before joining.",
|
||||
groupAccessDeniedMessage: "This group cannot access the server right now.",
|
||||
vpnDeniedMessage: "VPN access requires a host-approved exception.",
|
||||
});
|
||||
});
|
||||
|
||||
it("selects the configured message for each admission denial reason", () => {
|
||||
expect(admissionDenialMessage("not_registered", DEFAULT_ADMISSION_MESSAGES)).toBe(DEFAULT_ADMISSION_MESSAGES.registrationMessage);
|
||||
expect(admissionDenialMessage("group_access_disabled", DEFAULT_ADMISSION_MESSAGES)).toBe(DEFAULT_ADMISSION_MESSAGES.groupAccessDeniedMessage);
|
||||
expect(admissionDenialMessage("anonymized_network_disallowed", DEFAULT_ADMISSION_MESSAGES)).toBe(DEFAULT_ADMISSION_MESSAGES.vpnDeniedMessage);
|
||||
});
|
||||
|
||||
it("rejects missing, short, overlong, or control-character messages", () => {
|
||||
for (const invalid of ["short", "a".repeat(501), "Denied\nInjected"] as const) {
|
||||
const formData = new FormData();
|
||||
formData.set("registrationMessage", DEFAULT_ADMISSION_MESSAGES.registrationMessage);
|
||||
formData.set("groupAccessDeniedMessage", DEFAULT_ADMISSION_MESSAGES.groupAccessDeniedMessage);
|
||||
formData.set("vpnDeniedMessage", invalid);
|
||||
expect(parseAdmissionMessages(formData)).toBeNull();
|
||||
}
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,37 @@
|
||||
export interface AdmissionMessages {
|
||||
registrationMessage: string;
|
||||
groupAccessDeniedMessage: string;
|
||||
vpnDeniedMessage: string;
|
||||
}
|
||||
|
||||
export const DEFAULT_ADMISSION_MESSAGES: AdmissionMessages = {
|
||||
registrationMessage: "Please register your Minecraft account before joining.",
|
||||
groupAccessDeniedMessage: "Your account group does not currently have server access. Contact a host if you believe this is a mistake.",
|
||||
vpnDeniedMessage: "VPN, proxy, and Tor connections are not allowed. Contact a host to request an exception.",
|
||||
} as const;
|
||||
|
||||
export function admissionDenialMessage(
|
||||
reason: "not_registered" | "group_access_disabled" | "anonymized_network_disallowed",
|
||||
messages: AdmissionMessages,
|
||||
) {
|
||||
if (reason === "not_registered") return messages.registrationMessage;
|
||||
if (reason === "group_access_disabled") return messages.groupAccessDeniedMessage;
|
||||
return messages.vpnDeniedMessage;
|
||||
}
|
||||
|
||||
const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
|
||||
|
||||
function messageValue(formData: FormData, name: string) {
|
||||
const value = String(formData.get(name) ?? "").trim();
|
||||
return value.length >= 10 && value.length <= 500 && !CONTROL_CHARACTERS.test(value)
|
||||
? value
|
||||
: null;
|
||||
}
|
||||
|
||||
export function parseAdmissionMessages(formData: FormData) {
|
||||
const registrationMessage = messageValue(formData, "registrationMessage");
|
||||
const groupAccessDeniedMessage = messageValue(formData, "groupAccessDeniedMessage");
|
||||
const vpnDeniedMessage = messageValue(formData, "vpnDeniedMessage");
|
||||
if (!registrationMessage || !groupAccessDeniedMessage || !vpnDeniedMessage) return null;
|
||||
return { registrationMessage, groupAccessDeniedMessage, vpnDeniedMessage };
|
||||
}
|
||||
Reference in New Issue
Block a user