SHD DATA OPERATIONS
ADMIN CONSOLE
Embedded game-data control surface
DATABASEONLINE
ACCESSADMIN
ENVIRONMENTLOCAL
INTELLIGENT SYSTEM ANALYTIC COMPUTER
ISAC
SHD.build operations and intelligence control surface
SYSTEMONLINE
ACCESSAUTHORIZED
ENVIRONMENTLOCAL
RESULTS{data.users.length}Current query
ACTIVE{data.users.filter((user) => user.accessState === 'ACTIVE' && !user.inactive).length}Active within 30 days
INACTIVE{data.users.filter((user) => user.inactive).length}No activity for 30 days
RESTRICTED{data.users.filter((user) => user.accessState !== 'ACTIVE').length}Blocked or banned
+
+ {:else}
diff --git a/src/routes/admin/users/[id]/+page.server.ts b/src/routes/admin/users/[id]/+page.server.ts
new file mode 100644
index 0000000..07b5ae5
--- /dev/null
+++ b/src/routes/admin/users/[id]/+page.server.ts
@@ -0,0 +1,86 @@
+import { getPermissions, requirePermission } from '$lib/server/auth/authorization';
+import { getSessionUser } from '$lib/server/auth/session';
+import { getDatabase } from '$lib/server/database';
+import { error, fail } from '@sveltejs/kit';
+import { randomUUID } from 'node:crypto';
+import type { Actions, PageServerLoad } from './$types';
+
+export const load: PageServerLoad = async ({ cookies, params }) => {
+ const operator = await requirePermission(await getSessionUser(cookies), 'users.view');
+ const database = await getDatabase();
+ const [profile, roles, permissions, assignedRoles, directPermissions, logins, builds, comments] = await Promise.all([
+ (await database.prepare(`SELECT users.id,users.username,users.role,users.discord_id,users.created_at,user_status.*
+ FROM users LEFT JOIN user_status ON user_status.user_id=users.id WHERE users.id=?`)).get(params.id),
+ (await database.prepare('SELECT * FROM roles ORDER BY name')).all(),
+ (await database.prepare('SELECT * FROM permissions ORDER BY name')).all(),
+ (await database.prepare('SELECT role_id FROM user_roles WHERE user_id=?')).all(params.id),
+ (await database.prepare('SELECT permission_id FROM user_permissions WHERE user_id=?')).all(params.id),
+ (await database.prepare('SELECT provider,succeeded,created_at FROM login_events WHERE user_id=? ORDER BY created_at DESC LIMIT 30')).all(params.id),
+ (await database.prepare('SELECT id,title,slug,visibility,updated_at FROM builds WHERE owner_id=? ORDER BY updated_at DESC LIMIT 50')).all(params.id),
+ (await database.prepare(`SELECT comments.id,comments.body,comments.created_at,builds.title,builds.slug
+ FROM comments JOIN builds ON builds.id=comments.build_id WHERE comments.user_id=? ORDER BY comments.created_at DESC LIMIT 50`)).all(params.id)
+ ]);
+ if (!profile) error(404, 'User not found');
+ return {
+ profile,
+ roles,
+ permissions,
+ assignedRoleIds: assignedRoles.map((row) => String(row.role_id)),
+ directPermissionIds: directPermissions.map((row) => String(row.permission_id)),
+ logins, builds, comments,
+ operatorPermissions: await getPermissions(operator),
+ isSelf: operator.id === params.id
+ };
+};
+
+export const actions: Actions = {
+ setAccess: async ({ cookies, request, params }) => {
+ const operator = await requirePermission(await getSessionUser(cookies), 'users.roles');
+ const form = await request.formData();
+ const roleIds = [...new Set(form.getAll('roleIds').map(String))];
+ const permissionIds = [...new Set(form.getAll('permissionIds').map(String))];
+ const database = await getDatabase();
+ const target = await (await database.prepare('SELECT role FROM users WHERE id=?')).get(params.id);
+ if (!target) return fail(404, { accessError: 'User not found.' });
+ const operatorPermissions = await getPermissions(operator);
+ const targetAdminRole = await (await database.prepare(`SELECT 1 FROM user_roles WHERE user_id=? AND role_id='role-admin'`)).get(params.id);
+ const changesAdminRole = roleIds.includes('role-admin') !== Boolean(targetAdminRole);
+ if ((target.role === 'admin' || changesAdminRole) && !operatorPermissions.includes('*')) {
+ return fail(403, { accessError: 'Only an administrator can grant, remove, or modify administrator access.' });
+ }
+ const validRoles = roleIds.length ? Number((await (await database.prepare(`SELECT COUNT(*) AS count FROM roles WHERE id IN (${roleIds.map(() => '?').join(',')})`)).get(...roleIds))?.count) : 0;
+ const validPermissions = permissionIds.length ? Number((await (await database.prepare(`SELECT COUNT(*) AS count FROM permissions WHERE id IN (${permissionIds.map(() => '?').join(',')})`)).get(...permissionIds))?.count) : 0;
+ if (validRoles !== roleIds.length || validPermissions !== permissionIds.length) return fail(400, { accessError: 'One or more access selections are invalid.' });
+ await (await database.prepare('DELETE FROM user_roles WHERE user_id=?')).run(params.id);
+ await (await database.prepare('DELETE FROM user_permissions WHERE user_id=?')).run(params.id);
+ for (const roleId of roleIds) await (await database.prepare('INSERT INTO user_roles(user_id,role_id) VALUES(?,?)')).run(params.id, roleId);
+ for (const permissionId of permissionIds) await (await database.prepare('INSERT INTO user_permissions(user_id,permission_id) VALUES(?,?)')).run(params.id, permissionId);
+ await (await database.prepare('INSERT INTO audit_log(id,actor_id,entity_type,entity_id,action,after_json,created_at) VALUES(?,?,?,?,?,?,?)'))
+ .run(randomUUID(), operator.id, 'user', params.id, 'access.updated', JSON.stringify({ roleIds, permissionIds }), new Date().toISOString());
+ return { accessSaved: true };
+ },
+ moderate: async ({ cookies, request, params }) => {
+ const operator = await requirePermission(await getSessionUser(cookies), 'users.moderate');
+ if (operator.id === params.id) return fail(400, { moderationError: 'You cannot restrict your own account.' });
+ const form = await request.formData(), state = String(form.get('state') ?? ''), reason = String(form.get('reason') ?? '').trim();
+ if (!['active', 'blocked', 'banned'].includes(state)) return fail(400, { moderationError: 'Choose a valid access state.' });
+ if (state !== 'active' && reason.length < 3) return fail(400, { moderationError: 'Provide a moderation reason.' });
+ const untilRaw = String(form.get('bannedUntil') ?? '');
+ const bannedUntil = state === 'banned' ? new Date(untilRaw) : null;
+ if (state === 'banned' && (!untilRaw || Number.isNaN(bannedUntil?.getTime()) || bannedUntil! <= new Date())) return fail(400, { moderationError: 'Choose a future ban expiration.' });
+ const now = new Date().toISOString(), database = await getDatabase();
+ const target = await (await database.prepare('SELECT role FROM users WHERE id=?')).get(params.id);
+ if (!target) return fail(404, { moderationError: 'User not found.' });
+ const targetAdminRole = await (await database.prepare(`SELECT 1 FROM user_roles WHERE user_id=? AND role_id='role-admin'`)).get(params.id);
+ if ((target.role === 'admin' || targetAdminRole) && !(await getPermissions(operator)).includes('*')) {
+ return fail(403, { moderationError: 'Only an administrator can moderate another administrator.' });
+ }
+ await (await database.prepare(`INSERT INTO user_status(user_id,blocked_at,blocked_by,banned_until,moderation_reason,updated_at) VALUES(?,?,?,?,?,?)
+ ON CONFLICT(user_id) DO UPDATE SET blocked_at=excluded.blocked_at,blocked_by=excluded.blocked_by,banned_until=excluded.banned_until,moderation_reason=excluded.moderation_reason,updated_at=excluded.updated_at`))
+ .run(params.id, state === 'blocked' ? now : null, state === 'active' ? null : operator.id, state === 'banned' ? bannedUntil!.toISOString() : null, state === 'active' ? null : reason, now);
+ if (state !== 'active') await (await database.prepare('DELETE FROM sessions WHERE user_id=?')).run(params.id);
+ await (await database.prepare('INSERT INTO audit_log(id,actor_id,entity_type,entity_id,action,after_json,created_at) VALUES(?,?,?,?,?,?,?)'))
+ .run(randomUUID(), operator.id, 'user', params.id, `moderation.${state}`, JSON.stringify({ reason, bannedUntil: bannedUntil?.toISOString() }), now);
+ return { moderationSaved: true };
+ }
+};
diff --git a/src/routes/admin/users/[id]/+page.svelte b/src/routes/admin/users/[id]/+page.svelte
new file mode 100644
index 0000000..07d1b91
--- /dev/null
+++ b/src/routes/admin/users/[id]/+page.svelte
@@ -0,0 +1,41 @@
+
+USERACCESSLAST LOGINLAST ACTIVECONTENT
+ {#each data.users as user}{user.username}{user.discord_id ? 'DISCORD + LOCAL IDENTITY' : 'LOCAL IDENTITY'}
{user.accessState}{user.inactive && user.accessState === 'ACTIVE' ? ' · INACTIVE' : ''}{date(user.last_login_at)}{date(user.last_active_at)}{user.build_count} BUILDS · {user.comment_count} COMMENTSVIEWNO USERS FOUNDAdjust the username search and try again.
{/each}
+ACCESS STATE{accountState()}{data.profile.moderation_reason ?? 'No restrictions'}
LAST ACTIVE{date(data.profile.last_active_at)}Site activity
BUILDS{data.builds.length}Recent records loaded
COMMENTS{data.comments.length}Recent records loaded
+
+
+ {#if can('users.roles')}
+
+
+
+
+ {#if form?.accessError}
+ {:else}
+
+
+ {#if can('users.moderate')}
+ {#if data.isSelf}
+ {:else}
+
+
+ACCESS CONTROL
ROLES & PERMISSIONS
ASSIGNED ROLESPERMISSION BUNDLES
{roleIds.length} SELECTED{#each data.roles as role}{/each}
+ DIRECT PERMISSIONSUSER-SPECIFIC CAPABILITIES
{permissionIds.length} SELECTED{form.accessError}
{/if} +Your ISAC access permits viewing assignments but not changing them.
{/if} +ACCOUNT CONTROL
MODERATION
ISAC will not permit self-restriction.
{/if}{#if form?.moderationError}{form.moderationError}
{/if}Moderation permission is required to restrict this account.
{/if} +
+
diff --git a/src/routes/auth/discord/callback/+server.ts b/src/routes/auth/discord/callback/+server.ts
index e2e9e66..2566661 100644
--- a/src/routes/auth/discord/callback/+server.ts
+++ b/src/routes/auth/discord/callback/+server.ts
@@ -1,6 +1,6 @@
import { dev } from '$app/environment';
import { env } from '$env/dynamic/private';
-import { createSession, getSessionUser } from '$lib/server/auth/session';
+import { createSession, getSessionUser, recordLogin } from '$lib/server/auth/session';
import { ensureBootstrapAdmin } from '$lib/server/auth/bootstrap';
import { getDatabase } from '$lib/server/database';
import { redirect } from '@sveltejs/kit';
@@ -120,6 +120,13 @@ export const GET: RequestHandler = async ({ cookies, url, fetch }) => {
}
await ensureBootstrapAdmin(database, String(user.id));
+ const status = await (await database.prepare('SELECT blocked_at,banned_until FROM user_status WHERE user_id=?')).get(String(user.id));
+ const banned = typeof status?.banned_until === 'string' && new Date(status.banned_until) > new Date();
+ if (status?.blocked_at || banned) {
+ await recordLogin(String(user.id), 'discord', false);
+ redirect(303, '/sign-in?oauth_error=account_blocked');
+ }
await createSession(cookies, String(user.id));
+ await recordLogin(String(user.id), 'discord', true);
redirect(303, created ? '/account?choose_username=1' : '/account');
};
diff --git a/src/routes/sign-in/+page.server.ts b/src/routes/sign-in/+page.server.ts
index 766e2fb..1566fa4 100644
--- a/src/routes/sign-in/+page.server.ts
+++ b/src/routes/sign-in/+page.server.ts
@@ -1,4 +1,4 @@
-import { createSession, destroySession } from '$lib/server/auth/session';
+import { createSession, destroySession, recordLogin } from '$lib/server/auth/session';
import { verifyPassword } from '$lib/server/auth/password';
import { getDatabase } from '$lib/server/database';
import { ensureBootstrapAdmin } from '$lib/server/auth/bootstrap';
@@ -12,11 +12,21 @@ export const actions: Actions = {
const password = String(form.get('password') ?? '');
if (!username || !password) return fail(400, { loginError: 'Enter your username and password.', username });
const database = await getDatabase();
- const user = await (await database.prepare('SELECT id, password_hash FROM users WHERE username = ? COLLATE NOCASE')).get(username);
+ const user = await (await database.prepare(`SELECT users.id,users.password_hash,user_status.blocked_at,user_status.banned_until
+ FROM users LEFT JOIN user_status ON user_status.user_id=users.id WHERE username = ? COLLATE NOCASE`)).get(username);
const valid = typeof user?.password_hash === 'string' && await verifyPassword(user.password_hash, password);
- if (!valid) return fail(400, { loginError: 'Invalid username or password.', username });
+ if (!valid) {
+ if (user?.id) await recordLogin(String(user.id), 'password', false);
+ return fail(400, { loginError: 'Invalid username or password.', username });
+ }
+ const banned = typeof user.banned_until === 'string' && new Date(user.banned_until) > new Date();
+ if (user.blocked_at || banned) {
+ await recordLogin(String(user.id), 'password', false);
+ return fail(403, { loginError: 'This account is not permitted to sign in.', username });
+ }
await ensureBootstrapAdmin(database, String(user.id));
await createSession(cookies, String(user.id));
+ await recordLogin(String(user.id), 'password', true);
redirect(303, '/account');
},
logout: async ({ cookies }) => {
LOGIN HISTORY{data.logins.length} EVENTS
{#each data.logins as login}
{login.provider.toUpperCase()}{date(login.created_at)}{Number(login.succeeded) ? 'SUCCESS' : 'FAILED'}
{:else}NO LOGIN EVENTS RECORDED
{/each}BUILD & GUIDE HISTORY{data.builds.length} RECORDS
{#each data.builds as build}
{build.title}{date(build.updated_at)}{build.visibility.toUpperCase()}
{:else}NO BUILDS CREATED
{/each}COMMENT HISTORY{data.comments.length} RECORDS
NO COMMENTS POSTED
{/each}