436 lines
15 KiB
TypeScript
436 lines
15 KiB
TypeScript
"use server";
|
|
|
|
import { randomUUID } from "node:crypto";
|
|
import {
|
|
formatManagedDiscordNickname,
|
|
lookupJavaProfile,
|
|
updateGuildNickname,
|
|
} from "@minecraft-account-manager/minecraft";
|
|
import { events, groups, minecraftAccounts, userGroupMemberships, users } from "@minecraft-account-manager/database";
|
|
import { getClientIp } from "@minecraft-account-manager/network";
|
|
import { and, eq, isNull, ne, sql } from "drizzle-orm";
|
|
import { headers } from "next/headers";
|
|
import { redirect } from "next/navigation";
|
|
import { recordAdminEvent } from "@/lib/audit";
|
|
import { requireAdminSession } from "@/lib/auth/require-admin";
|
|
import { db } from "@/lib/database";
|
|
import { adminGroupReturnPath } from "@/lib/group-management";
|
|
|
|
const USERNAME_PATTERN = /^[A-Za-z0-9_]{3,16}$/;
|
|
const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
|
|
|
|
function userPath(userId: string, query?: string) {
|
|
return `/admin/users/${encodeURIComponent(userId)}${query ? `?${query}` : ""}`;
|
|
}
|
|
|
|
async function targetUser(userId: string) {
|
|
if (!UUID_PATTERN.test(userId)) return null;
|
|
const [user] = await db.select().from(users).where(eq(users.id, userId)).limit(1);
|
|
return user ?? null;
|
|
}
|
|
|
|
async function primaryUsername(userId: string) {
|
|
const [account] = await db
|
|
.select({ username: minecraftAccounts.username })
|
|
.from(minecraftAccounts)
|
|
.where(
|
|
and(
|
|
eq(minecraftAccounts.userId, userId),
|
|
eq(minecraftAccounts.isPrimary, true),
|
|
isNull(minecraftAccounts.deletedAt),
|
|
),
|
|
)
|
|
.limit(1);
|
|
return account?.username ?? null;
|
|
}
|
|
|
|
async function synchronizeNickname(input: {
|
|
discordUserId: string;
|
|
firstName: string;
|
|
minecraftUsername: string | null;
|
|
}) {
|
|
const guildId = process.env.DISCORD_GUILD_ID?.trim();
|
|
const botToken = process.env.DISCORD_BOT_TOKEN?.trim();
|
|
if (!guildId || !botToken) throw new Error("Discord nickname updates are not configured");
|
|
|
|
const nickname = formatManagedDiscordNickname(input.firstName, input.minecraftUsername);
|
|
await updateGuildNickname({
|
|
guildId,
|
|
discordUserId: input.discordUserId,
|
|
nickname,
|
|
botToken,
|
|
});
|
|
return nickname;
|
|
}
|
|
|
|
async function recordSyncFailure(
|
|
admin: Awaited<ReturnType<typeof requireAdminSession>>,
|
|
userId: string,
|
|
operation: string,
|
|
) {
|
|
await recordAdminEvent(
|
|
admin,
|
|
userId,
|
|
"games.minecraft.account-manager.discord.nickname.update-failed",
|
|
{ operation },
|
|
);
|
|
}
|
|
|
|
export async function assignUserGroupFromRegistry(formData: FormData) {
|
|
const admin = await requireAdminSession();
|
|
const userId = String(formData.get("userId") ?? "");
|
|
const groupId = String(formData.get("groupId") ?? "");
|
|
const returnTo = formData.get("returnTo");
|
|
if (!UUID_PATTERN.test(userId) || !UUID_PATTERN.test(groupId)) redirect(adminGroupReturnPath(returnTo, "error=invalid-group-assignment"));
|
|
|
|
const requestHeaders = await headers();
|
|
const ipAddress = getClientIp(requestHeaders, process.env.TRUST_PROXY === "true");
|
|
try {
|
|
await db.transaction(async (tx) => {
|
|
await tx.execute(sql`select pg_advisory_xact_lock(hashtext('minecraft-account-manager-group-membership'))`);
|
|
await tx.execute(sql`select ${groups.id} from ${groups} where ${groups.id} = ${groupId} for update`);
|
|
await tx.execute(sql`select ${users.id} from ${users} where ${users.id} = ${userId} for update`);
|
|
const [[user], [targetGroup]] = await Promise.all([
|
|
tx.select({ id: users.id }).from(users).where(eq(users.id, userId)).limit(1),
|
|
tx.select({ id: groups.id, name: groups.name, isDefault: groups.isDefault }).from(groups).where(eq(groups.id, groupId)).limit(1),
|
|
]);
|
|
if (!user || !targetGroup) throw new Error("User or destination group no longer exists");
|
|
const [membership] = await tx.select({ groupId: userGroupMemberships.groupId })
|
|
.from(userGroupMemberships).where(eq(userGroupMemberships.userId, user.id)).limit(1);
|
|
if (membership && membership.groupId !== targetGroup.id) {
|
|
await tx.execute(sql`select ${groups.id} from ${groups} where ${groups.id} = ${membership.groupId} for update`);
|
|
}
|
|
const [previous] = await tx.select({ id: groups.id, name: groups.name })
|
|
.from(userGroupMemberships)
|
|
.innerJoin(groups, eq(groups.id, userGroupMemberships.groupId))
|
|
.where(eq(userGroupMemberships.userId, user.id))
|
|
.limit(1);
|
|
if (targetGroup.isDefault) {
|
|
await tx.delete(userGroupMemberships).where(eq(userGroupMemberships.userId, user.id));
|
|
} else {
|
|
await tx.insert(userGroupMemberships).values({ userId: user.id, groupId: targetGroup.id })
|
|
.onConflictDoUpdate({
|
|
target: userGroupMemberships.userId,
|
|
set: { groupId: targetGroup.id },
|
|
});
|
|
}
|
|
await tx.insert(events).values({
|
|
id: randomUUID(),
|
|
source: "/web/admin",
|
|
type: "games.minecraft.account-manager.group.assignment-updated",
|
|
subject: `user/${user.id}`,
|
|
time: new Date(),
|
|
data: {
|
|
groupId: targetGroup.id,
|
|
groupName: targetGroup.name,
|
|
previousGroupId: previous?.id ?? null,
|
|
previousGroupName: previous?.name ?? "everyone",
|
|
adminEmail: admin.email,
|
|
adminName: admin.name,
|
|
},
|
|
ipAddress: ipAddress ?? null,
|
|
});
|
|
});
|
|
} catch {
|
|
redirect(adminGroupReturnPath(returnTo, "error=invalid-group-assignment"));
|
|
}
|
|
redirect(adminGroupReturnPath(returnTo, "saved=group"));
|
|
}
|
|
|
|
export async function updateUserName(formData: FormData) {
|
|
const admin = await requireAdminSession();
|
|
const userId = String(formData.get("userId") ?? "");
|
|
const firstName = String(formData.get("firstName") ?? "").trim();
|
|
const user = await targetUser(userId);
|
|
|
|
if (!user) redirect("/admin/users?error=unknown-user");
|
|
if (firstName.length < 1 || firstName.length > 50 || /[\u0000-\u001f\u007f]/.test(firstName)) {
|
|
redirect(userPath(user.id, "error=invalid-name"));
|
|
}
|
|
|
|
const minecraftUsername = await primaryUsername(user.id);
|
|
let nickname: string;
|
|
try {
|
|
nickname = await synchronizeNickname({
|
|
discordUserId: user.discordUserId,
|
|
firstName,
|
|
minecraftUsername,
|
|
});
|
|
} catch {
|
|
await recordSyncFailure(admin, user.id, "update-first-name");
|
|
redirect(userPath(user.id, "error=discord-update"));
|
|
}
|
|
|
|
await db.update(users).set({ firstName, updatedAt: new Date() }).where(eq(users.id, user.id));
|
|
await recordAdminEvent(
|
|
admin,
|
|
user.id,
|
|
"games.minecraft.account-manager.user.first-name.updated",
|
|
{ firstName, nickname },
|
|
);
|
|
await recordAdminEvent(
|
|
admin,
|
|
user.id,
|
|
"games.minecraft.account-manager.discord.nickname.updated",
|
|
{ nickname, operation: "update-first-name" },
|
|
);
|
|
redirect(userPath(user.id, "saved=name"));
|
|
}
|
|
|
|
export async function addUserMinecraftAccount(formData: FormData) {
|
|
const admin = await requireAdminSession();
|
|
const userId = String(formData.get("userId") ?? "");
|
|
const requestedUsername = String(formData.get("username") ?? "").trim();
|
|
const forceUnverified = formData.get("forceUnverified") === "yes";
|
|
const user = await targetUser(userId);
|
|
|
|
if (!user) redirect("/admin/users?error=unknown-user");
|
|
if (!USERNAME_PATTERN.test(requestedUsername)) {
|
|
redirect(userPath(user.id, "error=invalid-username"));
|
|
}
|
|
|
|
let profile: Awaited<ReturnType<typeof lookupJavaProfile>>;
|
|
try {
|
|
profile = await lookupJavaProfile(requestedUsername);
|
|
} catch {
|
|
redirect(userPath(user.id, "error=mojang-unavailable"));
|
|
}
|
|
if (!profile && !forceUnverified) {
|
|
redirect(userPath(user.id, `unverified=${encodeURIComponent(requestedUsername)}`));
|
|
}
|
|
|
|
const [existing] = await db
|
|
.select({ id: minecraftAccounts.id })
|
|
.from(minecraftAccounts)
|
|
.where(and(eq(minecraftAccounts.userId, user.id), isNull(minecraftAccounts.deletedAt)))
|
|
.limit(1);
|
|
|
|
let account: { id: string } | undefined;
|
|
try {
|
|
[account] = await db
|
|
.insert(minecraftAccounts)
|
|
.values({
|
|
userId: user.id,
|
|
minecraftUuid: profile?.uuid ?? null,
|
|
username: profile?.username ?? requestedUsername,
|
|
validationStatus: profile ? "verified" : "user_confirmed",
|
|
lastVerifiedAt: profile ? new Date() : null,
|
|
isPrimary: !existing,
|
|
})
|
|
.returning({ id: minecraftAccounts.id });
|
|
} catch {
|
|
redirect(userPath(user.id, "error=already-registered"));
|
|
}
|
|
|
|
const username = profile?.username ?? requestedUsername;
|
|
let nickname: string | null = null;
|
|
if (!existing && user.firstName && account) {
|
|
try {
|
|
nickname = await synchronizeNickname({
|
|
discordUserId: user.discordUserId,
|
|
firstName: user.firstName,
|
|
minecraftUsername: username,
|
|
});
|
|
} catch {
|
|
await db.delete(minecraftAccounts).where(eq(minecraftAccounts.id, account.id));
|
|
await recordSyncFailure(admin, user.id, "add-first-account");
|
|
redirect(userPath(user.id, "error=discord-update"));
|
|
}
|
|
}
|
|
|
|
await recordAdminEvent(
|
|
admin,
|
|
user.id,
|
|
"games.minecraft.account-manager.minecraft-account.added",
|
|
{
|
|
accountId: account?.id,
|
|
username,
|
|
minecraftUuid: profile?.uuid ?? null,
|
|
validationStatus: profile ? "verified" : "user_confirmed",
|
|
},
|
|
);
|
|
if (nickname) {
|
|
await recordAdminEvent(
|
|
admin,
|
|
user.id,
|
|
"games.minecraft.account-manager.discord.nickname.updated",
|
|
{ nickname, operation: "add-first-account" },
|
|
);
|
|
}
|
|
redirect(userPath(user.id, "saved=account-added"));
|
|
}
|
|
|
|
export async function setUserPrimaryAccount(formData: FormData) {
|
|
const admin = await requireAdminSession();
|
|
const userId = String(formData.get("userId") ?? "");
|
|
const accountId = String(formData.get("accountId") ?? "");
|
|
const user = await targetUser(userId);
|
|
if (!user) redirect("/admin/users?error=unknown-user");
|
|
|
|
const [account] = await db
|
|
.select({ id: minecraftAccounts.id, username: minecraftAccounts.username })
|
|
.from(minecraftAccounts)
|
|
.where(
|
|
and(
|
|
eq(minecraftAccounts.id, accountId),
|
|
eq(minecraftAccounts.userId, user.id),
|
|
isNull(minecraftAccounts.deletedAt),
|
|
),
|
|
)
|
|
.limit(1);
|
|
if (!account) redirect(userPath(user.id, "error=unknown-account"));
|
|
if (!user.firstName) redirect(userPath(user.id, "error=missing-name"));
|
|
|
|
let nickname: string;
|
|
try {
|
|
nickname = await synchronizeNickname({
|
|
discordUserId: user.discordUserId,
|
|
firstName: user.firstName,
|
|
minecraftUsername: account.username,
|
|
});
|
|
} catch {
|
|
await recordSyncFailure(admin, user.id, "set-primary-account");
|
|
redirect(userPath(user.id, "error=discord-update"));
|
|
}
|
|
|
|
await db.transaction(async (tx) => {
|
|
await tx
|
|
.update(minecraftAccounts)
|
|
.set({ isPrimary: false, updatedAt: new Date() })
|
|
.where(and(eq(minecraftAccounts.userId, user.id), isNull(minecraftAccounts.deletedAt)));
|
|
await tx
|
|
.update(minecraftAccounts)
|
|
.set({ isPrimary: true, updatedAt: new Date() })
|
|
.where(eq(minecraftAccounts.id, account.id));
|
|
});
|
|
|
|
await recordAdminEvent(
|
|
admin,
|
|
user.id,
|
|
"games.minecraft.account-manager.minecraft-account.primary-changed",
|
|
{ accountId: account.id, username: account.username, nickname },
|
|
);
|
|
await recordAdminEvent(
|
|
admin,
|
|
user.id,
|
|
"games.minecraft.account-manager.discord.nickname.updated",
|
|
{ nickname, operation: "set-primary-account" },
|
|
);
|
|
redirect(userPath(user.id, "saved=primary"));
|
|
}
|
|
|
|
export async function removeUserMinecraftAccount(formData: FormData) {
|
|
const admin = await requireAdminSession();
|
|
const userId = String(formData.get("userId") ?? "");
|
|
const accountId = String(formData.get("accountId") ?? "");
|
|
const user = await targetUser(userId);
|
|
if (!user) redirect("/admin/users?error=unknown-user");
|
|
|
|
const [account] = await db
|
|
.select({ id: minecraftAccounts.id, username: minecraftAccounts.username, isPrimary: minecraftAccounts.isPrimary })
|
|
.from(minecraftAccounts)
|
|
.where(
|
|
and(
|
|
eq(minecraftAccounts.id, accountId),
|
|
eq(minecraftAccounts.userId, user.id),
|
|
isNull(minecraftAccounts.deletedAt),
|
|
),
|
|
)
|
|
.limit(1);
|
|
if (!account) redirect(userPath(user.id, "error=unknown-account"));
|
|
if (account.isPrimary && !user.firstName) {
|
|
redirect(userPath(user.id, "error=missing-name"));
|
|
}
|
|
|
|
const [replacement] = account.isPrimary
|
|
? await db
|
|
.select({ id: minecraftAccounts.id, username: minecraftAccounts.username })
|
|
.from(minecraftAccounts)
|
|
.where(
|
|
and(
|
|
eq(minecraftAccounts.userId, user.id),
|
|
ne(minecraftAccounts.id, account.id),
|
|
isNull(minecraftAccounts.deletedAt),
|
|
),
|
|
)
|
|
.limit(1)
|
|
: [undefined];
|
|
|
|
let nickname: string | null = null;
|
|
if (account.isPrimary && user.firstName) {
|
|
try {
|
|
nickname = await synchronizeNickname({
|
|
discordUserId: user.discordUserId,
|
|
firstName: user.firstName,
|
|
minecraftUsername: replacement?.username ?? null,
|
|
});
|
|
} catch {
|
|
await recordSyncFailure(admin, user.id, "remove-primary-account");
|
|
redirect(userPath(user.id, "error=discord-update"));
|
|
}
|
|
}
|
|
|
|
await db.transaction(async (tx) => {
|
|
await tx
|
|
.update(minecraftAccounts)
|
|
.set({ deletedAt: new Date(), isPrimary: false, updatedAt: new Date() })
|
|
.where(eq(minecraftAccounts.id, account.id));
|
|
if (replacement) {
|
|
await tx
|
|
.update(minecraftAccounts)
|
|
.set({ isPrimary: true, updatedAt: new Date() })
|
|
.where(eq(minecraftAccounts.id, replacement.id));
|
|
}
|
|
});
|
|
|
|
await recordAdminEvent(
|
|
admin,
|
|
user.id,
|
|
"games.minecraft.account-manager.minecraft-account.removed",
|
|
{
|
|
accountId: account.id,
|
|
username: account.username,
|
|
replacementAccountId: replacement?.id ?? null,
|
|
nickname,
|
|
},
|
|
);
|
|
if (nickname) {
|
|
await recordAdminEvent(
|
|
admin,
|
|
user.id,
|
|
"games.minecraft.account-manager.discord.nickname.updated",
|
|
{ nickname, operation: "remove-primary-account" },
|
|
);
|
|
}
|
|
redirect(userPath(user.id, "saved=account-removed"));
|
|
}
|
|
|
|
export async function synchronizeUserNickname(formData: FormData) {
|
|
const admin = await requireAdminSession();
|
|
const userId = String(formData.get("userId") ?? "");
|
|
const user = await targetUser(userId);
|
|
if (!user) redirect("/admin/users?error=unknown-user");
|
|
if (!user.firstName) redirect(userPath(user.id, "error=missing-name"));
|
|
|
|
const minecraftUsername = await primaryUsername(user.id);
|
|
let nickname: string;
|
|
try {
|
|
nickname = await synchronizeNickname({
|
|
discordUserId: user.discordUserId,
|
|
firstName: user.firstName,
|
|
minecraftUsername,
|
|
});
|
|
} catch {
|
|
await recordSyncFailure(admin, user.id, "manual-sync");
|
|
redirect(userPath(user.id, "error=discord-update"));
|
|
}
|
|
|
|
await recordAdminEvent(
|
|
admin,
|
|
user.id,
|
|
"games.minecraft.account-manager.discord.nickname.updated",
|
|
{ nickname, operation: "manual-sync" },
|
|
);
|
|
redirect(userPath(user.id, "saved=nickname"));
|
|
}
|