From c665951b9d2388c34ab4e3466a4c9c20e12688db Mon Sep 17 00:00:00 2001 From: Erin Nova Date: Sun, 25 Jul 2021 18:03:32 -0400 Subject: [PATCH 1/4] Add ability to kick users --- src/auth.rs | 36 +++++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 9 deletions(-) diff --git a/src/auth.rs b/src/auth.rs index f29b314..a7e3f59 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -284,6 +284,27 @@ pub fn get_user(name: String) -> JsonValue { } } +// Kick a user (temporarilly log them out for a certain amount of time) +fn kick(name: &str) -> JsonValue { + if let Some(mut user) = db_read_user(&name.to_lowercase()).ok().flatten() { + user.session_token = "NULL".to_string(); + db_remove(&user); + db_add(&user); + info!("succesfully kicked user {}", &user.name); + return json!({ + "status": "ok", + "reason": "kicked user", + }); + } else { + warn!("could not kick {}, user not found", &name); + return json!({ + "status": "fail", + "reason": "user not found", + }); + } + +} + /* User Management */ #[post("/mod", format = "json", data = "")] pub fn moderation_actions(data: Json, mut cookies: Cookies) -> JsonValue { @@ -307,16 +328,13 @@ pub fn moderation_actions(data: Json, mut cookies: Cookies) -> } else if user.session_token == token.value() { // if token matches if user.role == UserType::Normal { match data.action { - ModActions::Kick => { - info!("kicked user {}", data.target) - }, - ModActions::Ban => info!("banned user {}", data.target), - _ => info!("F"), + ModActions::Kick => kick(&data.target), + ModActions::Ban => return json!({"status":"ok","reason":"banned user"}), + ModActions::Demote => return json!({"status":"ok","reason":"demoted user"}), + ModActions::Premote => return json!({"status":"ok","reason":"premoted user"}), + _ => return json!({"status":"fail","reason":"bad command"}), }; - return json!({ - "status": "ok", - "reason": "completed action", - }); + return json!({"status":"fail","reason":"idk"}); } else { warn!("user does not have sufficient permissions to perform that action!"); return json!({ From b4e537b8dfb747228badc52d7091f96a265c99b4 Mon Sep 17 00:00:00 2001 From: Erin Nova Date: Sun, 25 Jul 2021 18:21:56 -0400 Subject: [PATCH 2/4] Add functionality to user management commands --- src/auth.rs | 114 ++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 102 insertions(+), 12 deletions(-) diff --git a/src/auth.rs b/src/auth.rs index a7e3f59..6b95c51 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -283,18 +283,81 @@ pub fn get_user(name: String) -> JsonValue { }); } } +// Make a user into a moderator +fn premote(name: &str) -> JsonValue { + if let Some(mut user) = db_read_user(&name.to_lowercase()).ok().flatten() { + if user.role != UserType::Admin { // make sure mods can't demote admins ;3 + user.role = UserType::Moderator; + db_remove(&user); + db_add(&user); + info!("succesfully premoted user {}", &user.name); + return json!({ + "status": "ok", + "reason": "premoted user", + }); + } else { + warn!("user is an admin, cannot make moderator"); + return json!({ + "status": "fail", + "reason": "user is admin", + }); + } + } else { + warn!("could not premote {}, user not found", &name); + return json!({ + "status": "fail", + "reason": "user not found", + }); + } +} + +// Make a user into a normal user +fn demote(name: &str) -> JsonValue { + if let Some(mut user) = db_read_user(&name.to_lowercase()).ok().flatten() { + if user.role != UserType::Admin { // make sure mods can't demote admins ;3 + user.role = UserType::Normal; + db_remove(&user); + db_add(&user); + info!("succesfully demoted user {}", &user.name); + return json!({ + "status": "ok", + "reason": "demoted user", + }); + } else { + warn!("user is an admin, cannot demote"); + return json!({ + "status": "fail", + "reason": "user is admin", + }); + } + } else { + warn!("could not demote {}, user not found", &name); + return json!({ + "status": "fail", + "reason": "user not found", + }); + } +} // Kick a user (temporarilly log them out for a certain amount of time) fn kick(name: &str) -> JsonValue { if let Some(mut user) = db_read_user(&name.to_lowercase()).ok().flatten() { - user.session_token = "NULL".to_string(); - db_remove(&user); - db_add(&user); - info!("succesfully kicked user {}", &user.name); - return json!({ - "status": "ok", - "reason": "kicked user", - }); + if user.role != UserType::Admin { // make sure mods can't kick admins + user.session_token = "NULL".to_string(); + db_remove(&user); + db_add(&user); + info!("succesfully kicked user {}", &user.name); + return json!({ + "status": "ok", + "reason": "kicked user", + }); + } else { + warn!("user is an admin, cannot kick"); + return json!({ + "status": "fail", + "reason": "user is admin", + }); + } } else { warn!("could not kick {}, user not found", &name); return json!({ @@ -305,6 +368,33 @@ fn kick(name: &str) -> JsonValue { } +// Ban a user (remove their account) +fn ban(name: &str) -> JsonValue { + if let Some(mut user) = db_read_user(&name.to_lowercase()).ok().flatten() { + if user.role != UserType::Admin { // make sure mods can't kick admins + db_remove(&user); + info!("succesfully banned user {}", &user.name); + return json!({ + "status": "ok", + "reason": "banned user", + }); + } else { + warn!("user is an admin, cannot ban"); + return json!({ + "status": "fail", + "reason": "user is admin", + }); + } + } else { + warn!("could not ban {}, user not found", &name); + return json!({ + "status": "fail", + "reason": "user not found", + }); + } + +} + /* User Management */ #[post("/mod", format = "json", data = "")] pub fn moderation_actions(data: Json, mut cookies: Cookies) -> JsonValue { @@ -326,12 +416,12 @@ pub fn moderation_actions(data: Json, mut cookies: Cookies) -> "reason": "NULL token", }); } else if user.session_token == token.value() { // if token matches - if user.role == UserType::Normal { + if user.role == UserType::Moderator { match data.action { ModActions::Kick => kick(&data.target), - ModActions::Ban => return json!({"status":"ok","reason":"banned user"}), - ModActions::Demote => return json!({"status":"ok","reason":"demoted user"}), - ModActions::Premote => return json!({"status":"ok","reason":"premoted user"}), + ModActions::Ban => ban(&data.target), + ModActions::Demote => demote(&data.target), + ModActions::Premote => premote(&data.target), _ => return json!({"status":"fail","reason":"bad command"}), }; return json!({"status":"fail","reason":"idk"}); From ba90ca471bcfb58e44b675231f1682e85ff38182 Mon Sep 17 00:00:00 2001 From: Erin Nova Date: Sun, 25 Jul 2021 18:38:04 -0400 Subject: [PATCH 3/4] Allow creation of admin user --- src/auth.rs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/auth.rs b/src/auth.rs index 6b95c51..11426b4 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -20,7 +20,7 @@ pub fn register(data: Json) -> JsonValue { } else { let pin_hashed = sha1::Sha1::from(&data.pin).digest().to_string(); // hash the pin - let new_user: User = User { + let mut new_user: User = User { name: data.name.to_string().to_lowercase(), pin_hashed, pronouns: data.pronouns.to_string().to_lowercase(), @@ -28,6 +28,10 @@ pub fn register(data: Json) -> JsonValue { role: UserType::Normal, id: Uuid::new_v4(), }; + + if new_user.name == "admin".to_string() { // if name is admin, make them an admin + new_user.role = UserType::Admin; + } db_add(&new_user); info!( From b099448006d0485f74a121ee17927117094321a9 Mon Sep 17 00:00:00 2001 From: Erin Nova Date: Sun, 25 Jul 2021 18:41:54 -0400 Subject: [PATCH 4/4] Allow admin to perform same action as moderators --- src/auth.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/auth.rs b/src/auth.rs index 11426b4..2c81a8e 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -420,7 +420,7 @@ pub fn moderation_actions(data: Json, mut cookies: Cookies) -> "reason": "NULL token", }); } else if user.session_token == token.value() { // if token matches - if user.role == UserType::Moderator { + if user.role == UserType::Moderator || user.role == UserType::Admin { match data.action { ModActions::Kick => kick(&data.target), ModActions::Ban => ban(&data.target),