-
+
{:else}
diff --git a/src/routes/admin/users/[id]/+page.server.ts b/src/routes/admin/users/[id]/+page.server.ts
index b0e2e63..0cf0709 100644
--- a/src/routes/admin/users/[id]/+page.server.ts
+++ b/src/routes/admin/users/[id]/+page.server.ts
@@ -8,11 +8,32 @@ import type { Actions, PageServerLoad } from './$types';
import { avatarUrl } from '$lib/avatar';
import { deleteUploadedAvatar } from '$lib/server/avatars';
import { canRemoveAuthenticationMethod, getAuthenticationMethods } from '$lib/server/auth/methods';
+import { getPagination } from '$lib/server/pagination';
-export const load: PageServerLoad = async ({ cookies, params }) => {
+export const load: PageServerLoad = async ({ cookies, params, url }) => {
const operator = await requirePermission(await getSessionUser(cookies), 'users.view');
const database = await getDatabase();
- const [profile, roles, permissions, assignedRoles, directPermissions, logins, builds, comments, authenticationMethods] = await Promise.all([
+ const loginQuery = url.searchParams.get('loginQ')?.trim() ?? '';
+ const loginStatus = ['success', 'failed'].includes(url.searchParams.get('loginStatus') ?? '') ? String(url.searchParams.get('loginStatus')) : '';
+ const buildQuery = url.searchParams.get('buildQ')?.trim() ?? '';
+ const buildVisibility = ['draft', 'private', 'public'].includes(url.searchParams.get('buildVisibility') ?? '') ? String(url.searchParams.get('buildVisibility')) : '';
+ const commentQuery = url.searchParams.get('commentQ')?.trim() ?? '';
+ const pattern = (value: string) => `%${value.replaceAll('%', '\\%').replaceAll('_', '\\_')}%`;
+ const loginWhere = `user_id=? AND provider LIKE ? ESCAPE '\\'${loginStatus ? ' AND succeeded=?' : ''}`;
+ const loginArgs: unknown[] = [params.id, pattern(loginQuery), ...(loginStatus ? [loginStatus === 'success' ? 1 : 0] : [])];
+ const buildWhere = `owner_id=? AND (title LIKE ? ESCAPE '\\' COLLATE NOCASE OR slug LIKE ? ESCAPE '\\' COLLATE NOCASE)${buildVisibility ? ' AND visibility=?' : ''}`;
+ const buildArgs: unknown[] = [params.id, pattern(buildQuery), pattern(buildQuery), ...(buildVisibility ? [buildVisibility] : [])];
+ const commentWhere = `comments.user_id=? AND (comments.body LIKE ? ESCAPE '\\' COLLATE NOCASE OR builds.title LIKE ? ESCAPE '\\' COLLATE NOCASE)`;
+ const commentArgs: unknown[] = [params.id, pattern(commentQuery), pattern(commentQuery)];
+ const [loginCount, buildCount, commentCount] = await Promise.all([
+ (await database.prepare(`SELECT COUNT(*) AS count FROM login_events WHERE ${loginWhere}`)).get(...loginArgs),
+ (await database.prepare(`SELECT COUNT(*) AS count FROM builds WHERE ${buildWhere}`)).get(...buildArgs),
+ (await database.prepare(`SELECT COUNT(*) AS count FROM comments JOIN builds ON builds.id=comments.build_id WHERE ${commentWhere}`)).get(...commentArgs)
+ ]);
+ const loginPagination = getPagination(url, Number(loginCount?.count ?? 0), 'login');
+ const buildPagination = getPagination(url, Number(buildCount?.count ?? 0), 'build');
+ const commentPagination = getPagination(url, Number(commentCount?.count ?? 0), 'comment');
+ const [profile, roles, permissions, assignedRoles, directPermissions, logins, builds, comments, authenticationMethods, emails, passkeys] = await Promise.all([
(await database.prepare(`SELECT users.id,users.login_username AS username,COALESCE(user_profiles.display_name,users.username) AS display_name,
users.role,users.discord_id,users.created_at,
CASE WHEN users.password_hash IS NOT NULL THEN 1 ELSE 0 END AS has_password,
@@ -30,11 +51,13 @@ export const load: PageServerLoad = async ({ cookies, params }) => {
(await database.prepare('SELECT * FROM permissions ORDER BY name')).all(),
(await database.prepare('SELECT role_id FROM user_roles WHERE user_id=?')).all(params.id),
(await database.prepare('SELECT permission_id FROM user_permissions WHERE user_id=?')).all(params.id),
- (await database.prepare('SELECT provider,succeeded,created_at FROM login_events WHERE user_id=? ORDER BY created_at DESC LIMIT 30')).all(params.id),
- (await database.prepare('SELECT id,title,slug,visibility,updated_at FROM builds WHERE owner_id=? ORDER BY updated_at DESC LIMIT 50')).all(params.id),
+ (await database.prepare(`SELECT provider,succeeded,created_at FROM login_events WHERE ${loginWhere} ORDER BY created_at DESC LIMIT ? OFFSET ?`)).all(...loginArgs, loginPagination.perPage, loginPagination.offset),
+ (await database.prepare(`SELECT id,title,slug,visibility,updated_at FROM builds WHERE ${buildWhere} ORDER BY updated_at DESC LIMIT ? OFFSET ?`)).all(...buildArgs, buildPagination.perPage, buildPagination.offset),
(await database.prepare(`SELECT comments.id,comments.body,comments.created_at,builds.title,builds.slug
- FROM comments JOIN builds ON builds.id=comments.build_id WHERE comments.user_id=? ORDER BY comments.created_at DESC LIMIT 50`)).all(params.id)
+ FROM comments JOIN builds ON builds.id=comments.build_id WHERE ${commentWhere} ORDER BY comments.created_at DESC LIMIT ? OFFSET ?`)).all(...commentArgs, commentPagination.perPage, commentPagination.offset)
,getAuthenticationMethods(database, params.id)
+ ,(await database.prepare('SELECT email,verified_at,updated_at FROM user_emails WHERE user_id=?')).all(params.id)
+ ,(await database.prepare('SELECT id,name,device_type,backed_up,last_used_at,created_at FROM passkeys WHERE user_id=? ORDER BY created_at DESC')).all(params.id)
]);
if (!profile) error(404, 'User not found');
return {
@@ -46,7 +69,9 @@ export const load: PageServerLoad = async ({ cookies, params }) => {
permissions,
assignedRoleIds: assignedRoles.map((row) => String(row.role_id)),
directPermissionIds: directPermissions.map((row) => String(row.permission_id)),
- logins, builds, comments,
+ logins, builds, comments, emails, passkeys,
+ historyFilters: { loginQuery, loginStatus, buildQuery, buildVisibility, commentQuery },
+ historyPagination: { login: loginPagination, build: buildPagination, comment: commentPagination },
authenticationMethods,
operatorPermissions: await getPermissions(operator),
isSelf: operator.id === params.id
@@ -159,5 +184,33 @@ export const actions: Actions = {
await (await database.prepare('INSERT INTO audit_log(id,actor_id,entity_type,entity_id,action,before_json,created_at) VALUES(?,?,?,?,?,?,?)'))
.run(randomUUID(), operator.id, 'user', params.id, 'identity.discord_unlinked', JSON.stringify({ discordId: target.discord_id }), now);
return { identityUnlinked: true };
+ },
+ removeEmail: async ({ cookies, params }) => {
+ const operator = await requirePermission(await getSessionUser(cookies), 'users.identities');
+ const database = await getDatabase();
+ const email = await (await database.prepare('SELECT email FROM user_emails WHERE user_id=?')).get(params.id);
+ if (!email) return fail(409, { identityError: 'This user does not have a verified email sign-in.' });
+ if (!canRemoveAuthenticationMethod(await getAuthenticationMethods(database, params.id), 'email')) {
+ return fail(400, { identityError: 'Email cannot be removed because it is this user’s only sign-in method.' });
+ }
+ await (await database.prepare('DELETE FROM user_emails WHERE user_id=?')).run(params.id);
+ await (await database.prepare('DELETE FROM magic_link_tokens WHERE user_id=?')).run(params.id);
+ await (await database.prepare('INSERT INTO audit_log(id,actor_id,entity_type,entity_id,action,before_json,created_at) VALUES(?,?,?,?,?,?,?)'))
+ .run(randomUUID(), operator.id, 'user', params.id, 'identity.email_removed', JSON.stringify({ email: email.email }), new Date().toISOString());
+ return { emailRemoved: true };
+ },
+ removePasskey: async ({ cookies, request, params }) => {
+ const operator = await requirePermission(await getSessionUser(cookies), 'users.identities');
+ const passkeyId = String((await request.formData()).get('passkeyId') ?? '');
+ const database = await getDatabase();
+ const passkey = await (await database.prepare('SELECT id,name FROM passkeys WHERE id=? AND user_id=?')).get(passkeyId, params.id);
+ if (!passkey) return fail(404, { identityError: 'That passkey was not found for this user.' });
+ if (!canRemoveAuthenticationMethod(await getAuthenticationMethods(database, params.id), 'passkey')) {
+ return fail(400, { identityError: 'This passkey cannot be removed because it is the user’s only sign-in method.' });
+ }
+ await (await database.prepare('DELETE FROM passkeys WHERE id=? AND user_id=?')).run(passkeyId, params.id);
+ await (await database.prepare('INSERT INTO audit_log(id,actor_id,entity_type,entity_id,action,before_json,created_at) VALUES(?,?,?,?,?,?,?)'))
+ .run(randomUUID(), operator.id, 'user', params.id, 'identity.passkey_removed', JSON.stringify({ id: passkey.id, name: passkey.name }), new Date().toISOString());
+ return { passkeyRemoved: true };
}
};
diff --git a/src/routes/admin/users/[id]/+page.svelte b/src/routes/admin/users/[id]/+page.svelte
index f5df3f0..076125a 100644
--- a/src/routes/admin/users/[id]/+page.svelte
+++ b/src/routes/admin/users/[id]/+page.svelte
@@ -1,20 +1,40 @@
USERACCESSLAST LOGINLAST ACTIVECONTENT
- {#each data.users as user}{user.display_name}LOGIN: {user.username ?? 'NOT CONFIGURED'} · {user.discord_id ? 'DISCORD LINKED' : 'ACCOUNT IDENTITY'}
{user.accessState}{user.inactive && user.accessState === 'ACTIVE' ? ' · INACTIVE' : ''}{date(user.last_login_at)}{date(user.last_active_at)}{user.build_count} BUILDS · {user.comment_count} COMMENTSVIEWUSERACCESSROLESLAST LOGINLAST ACTIVECONTENT
+ {#each data.users as user}{user.display_name}LOGIN: {user.username ?? 'NOT CONFIGURED'}
{user.accessState}{user.inactive && user.accessState === 'ACTIVE' ? ' · INACTIVE' : ''}{#each String(user.assigned_roles ?? user.role ?? 'User').split(' · ') as role}{role.toUpperCase()}{/each}
{user.last_login_provider?.toUpperCase() ?? 'NONE'}{date(user.last_login_at)}{date(user.last_active_at)}{user.build_count} BUILDS · {user.comment_count} COMMENTSVIEWNO USERS FOUNDAdjust the username search and try again.
{/each}
ACCESS STATE{accountState()}{data.profile.moderation_reason ?? 'No restrictions'}
LAST ACTIVE{date(data.profile.last_active_at)}Site activity
BUILDS{data.builds.length}Recent records loaded
COMMENTS{data.comments.length}Recent records loaded
ACCESS STATE{accountState()}{data.profile.moderation_reason ?? 'No restrictions'}
LAST ACTIVE{date(data.profile.last_active_at)}Site activity
BUILDS{data.historyPagination.build.total}Authored records
COMMENTS{data.historyPagination.comment.total}Posted records
+
+
+
+
-
+
{#if can('users.roles')}
@@ -22,42 +42,70 @@
- {#if form?.accessError}
{:else}
-
-
-
ACCESS CONTROL
ROLES & PERMISSIONS
{#each data.roles as role}{/each}
DIRECT PERMISSIONSUSER-SPECIFIC CAPABILITIES
{permissionIds.length} SELECTED{form.accessError}
{/if} + {#if form?.accessError}{form.accessError}
{/if}{#if form?.accessSaved}Roles and direct permissions updated.
{/if} + {#if accessConfirmationOpen} +
+
+ {/if}
+
+
+ CONFIRM ACCESS PROFILE
{data.profile.display_name}
Review the complete role and direct-permission assignment before applying it to this agent.
+
+
+
+ ROLE CHANGES{#each data.roles.filter((role) => roleIds.includes(String(role.id)) || data.assignedRoleIds.includes(String(role.id))) as role}{@const state = accessChange(String(role.id), roleIds, data.assignedRoleIds)}{role.name}{state.toUpperCase()}{:else}NO ROLE ASSIGNMENTS{/each}
+ DIRECT PERMISSION CHANGES{#each data.permissions.filter((permission) => permissionIds.includes(String(permission.id)) || data.directPermissionIds.includes(String(permission.id))) as permission}{@const state = accessChange(String(permission.id), permissionIds, data.directPermissionIds)}{permission.name}{state.toUpperCase()}{:else}NO DIRECT PERMISSION ASSIGNMENTS{/each}
+ Your ISAC access permits viewing assignments but not changing them.
{/if}ACCOUNT CONTROL
MODERATION
+
+
+
-
+
-
-LINKED{#if can('users.identities')}{#if data.authenticationMethods.total <= 1} {/if}{:else}
+
{#if can('users.moderate') && !data.profile.deleted_at}{#if data.isSelf}
{:else}
{#if form?.adminDeleteError} {/if}
+
-{operationsPanel === 'authentication' ? 'IDENTITY CONTROL' : 'ACCOUNT CONTROL'}
{operationsPanel === 'authentication' ? 'AUTHENTICATION' : 'MODERATION'}
AGENT AVATAR
{data.profile.avatar_source === 'upload' ? 'CUSTOM UPLOAD' : 'SHD PRESET'}{data.profile.avatar_source === 'upload' ? `${Math.ceil(Number(data.profile.avatar_byte_size) / 1024)} KB · NORMALIZED WEBP` : 'APPROVED PORTRAIT LIBRARY'}
- {data.profile.avatar_source === 'upload' ? 'REVIEW' : 'APPROVED'}
+ {#if data.profile.avatar_source === 'upload' && can('users.moderate')}{:else}{data.profile.avatar_source === 'upload' ? 'REVIEW' : 'APPROVED'}{/if}
+ {#if removalTarget === 'avatar'}REMOVE CUSTOM AVATAR?The uploaded file will be deleted and replaced by the default SHD portrait.
Removing this image deletes the uploaded file and resets the agent to the default SHD portrait.
- {#if form?.avatarModerationError}{form.avatarModerationError}
{/if} - -Removing this image deletes the uploaded file and resets the agent to the default SHD portrait.
+ {#if form?.avatarModerationError}{form.avatarModerationError}
{/if} {:else if data.profile.avatar_source === 'upload'}Moderation permission is required to remove this custom image.
{/if} {#if form?.avatarRemoved}Custom avatar removed and reset to the default SHD portrait.
{/if}-
LINKED DISCORD IDENTITY
{#if data.profile.discord_id}
{data.profile.discord_display_name ?? data.profile.discord_username ?? 'DISCORD USER'}{data.profile.discord_username ? `@${data.profile.discord_username} · ` : ''}ID {data.profile.discord_id}
Discord is this agent’s only sign-in method and cannot be removed.
{/if}{#if form?.identityError}{form.identityError}
{/if}NO DISCORD IDENTITY LINKED
{/if}
+
+
+ SIGN-IN METHODS{data.authenticationMethods.total} ACTIVE METHOD{data.authenticationMethods.total === 1 ? '' : 'S'}
+
+ {#each data.emails as email}
+
+ {#if form?.identityError}LOCAL CREDENTIALS{data.authenticationMethods.local ? `PRIVATE LOGIN · ${data.profile.username}` : 'NOT CONFIGURED'}
{data.authenticationMethods.local ? 'ACTIVE' : 'NONE'}EMAIL MAGIC LINK{email.email} · VERIFIED {date(email.verified_at)}
ACTIVE{#if can('users.identities')}{/if}{#if removalTarget === 'email'}REMOVE EMAIL SIGN-IN?The agent will no longer receive access links at this address.
EMAIL MAGIC LINKNO VERIFIED EMAIL
NONEPASSKEY · {passkey.name}{passkey.device_type.toUpperCase()} · {Number(passkey.backed_up) ? 'SYNCED' : 'DEVICE-BOUND'} · LAST USED {date(passkey.last_used_at)}
ACTIVE{#if can('users.identities')}{/if}{#if removalTarget === `passkey:${passkey.id}`}REMOVE THIS PASSKEY?{passkey.name} will no longer authenticate this agent.
PASSKEYNO PASSKEYS ENROLLED
NONEDISCORD{data.profile.discord_display_name ? ` · ${data.profile.discord_display_name}` : ''}{data.profile.discord_id ? `${data.profile.discord_username ? `@${data.profile.discord_username} · ` : ''}ID ${data.profile.discord_id}` : 'NOT LINKED'}
{data.authenticationMethods.discord ? 'ACTIVE' : 'NONE'}{#if data.authenticationMethods.discord && can('users.identities')}{/if}{#if removalTarget === 'discord'}UNLINK DISCORD?The agent will no longer be able to authenticate with this Discord identity.
{provider.toUpperCase()}PROVIDER INTEGRATION PLANNED
PLANNED{form.identityError}
{/if} + {#if form?.emailRemoved}Verified email sign-in removed.
{/if} + {#if form?.passkeyRemoved}Passkey removed.
{/if} +{#if can('users.moderate') && !data.profile.deleted_at}
ISAC will not permit self-restriction.
{/if}{#if form?.moderationError}{form.moderationError}
{/if}Moderation permission is required to restrict this account.
{/if} {#if can('users.delete') && !data.profile.deleted_at}SOFT-DELETE ACCOUNT
Authored content remains available under a deleted-agent identity. Sign-in credentials, sessions, username, and Discord identity are released.
{form.adminDeleteError}
{/if}
-
LOGIN HISTORY{data.logins.length} EVENTS
{#each data.logins as login}
{login.provider.toUpperCase()}{date(login.created_at)}{Number(login.succeeded) ? 'SUCCESS' : 'FAILED'}
{:else}NO LOGIN EVENTS RECORDED
{/each}BUILD & GUIDE HISTORY{data.builds.length} RECORDS
{#each data.builds as build}
{build.title}{date(build.updated_at)}{build.visibility.toUpperCase()}
{:else}NO BUILDS CREATED
{/each}COMMENT HISTORY{data.comments.length} RECORDS
+
LOGIN HISTORY{data.historyPagination.login.total} EVENTS
{#each data.logins as login}
{login.provider.toUpperCase()}{date(login.created_at)}{Number(login.succeeded) ? 'SUCCESS' : 'FAILED'}
{:else}NO LOGIN EVENTS MATCH THESE FILTERS
{/each}BUILD & GUIDE HISTORY{data.historyPagination.build.total} RECORDS
{#each data.builds as build}
{build.title}{date(build.updated_at)}{build.visibility.toUpperCase()}
{:else}NO BUILDS MATCH THESE FILTERS
{/each}COMMENT HISTORY{data.historyPagination.comment.total} RECORDS
{#each data.comments as comment}
{comment.title}{comment.body}{date(comment.created_at)}
{:else}NO COMMENTS MATCH THIS SEARCH
{/each}
NO COMMENTS POSTED
{/each}