From ca61491a31181661c2f02b1ffe1fd8bb02263fef Mon Sep 17 00:00:00 2001
From: Kosztyk <36381705+Kosztyk@users.noreply.github.com>
Date: Wed, 14 Jan 2026 15:52:54 +0200
Subject: [PATCH] Add files via upload

---
 src/pages/user.tsx | 229 ++++++++++++++++++++++-----------------------
 1 file changed, 114 insertions(+), 115 deletions(-)

diff --git a/src/pages/user.tsx b/src/pages/user.tsx
index 0650afc..1e5e59d 100644
--- a/src/pages/user.tsx
+++ b/src/pages/user.tsx
@@ -329,9 +329,7 @@ export const user = new Elysia()
   .post(
     "/login",
     async function handler({ body, set, redirect, jwt, cookie: { auth } }) {
-      const existingUser = db.query("SELECT * FROM users WHERE email = ?").as(User).get(
-        body.email,
-      );
+      const existingUser = db.query("SELECT * FROM users WHERE email = ?").as(User).get(body.email);
 
       if (!existingUser) {
         set.status = 403;
@@ -507,11 +505,7 @@ export const user = new Elysia()
                         </label>
                         <label class="flex flex-col gap-1">
                           Role
-                          <select
-                            name="newUserRole"
-                            class="rounded-sm bg-neutral-800 p-3"
-                            required
-                          >
+                          <select name="newUserRole" class="rounded-sm bg-neutral-800 p-3" required>
                             <option value="user">Normal user</option>
                             <option value="admin">Admin</option>
                           </select>
@@ -552,75 +546,74 @@ export const user = new Elysia()
                               <tr>
                                 <td>{u.email}</td>
                                 <td class="capitalize">{u.role}</td>
-                                
-<td>
-  <div class="flex items-center gap-6">
-    {/* Edit / details icon */}
-    <form method="get" action={`${WEBROOT}/account/edit-user`}>
-      <input type="hidden" name="userId" value={String(u.id)} />
-      <button
-        type="submit"
-        class={`
-          inline-flex items-center justify-center text-accent-400
-          hover:text-accent-500
-        `}
-        title="Edit user"
-      >
-        <svg
-          xmlns="http://www.w3.org/2000/svg"
-          viewBox="0 0 24 24"
-          class="h-6 w-6"
-          fill="none"
-          stroke="currentColor"
-          stroke-width="1.8"
-          stroke-linecap="round"
-          stroke-linejoin="round"
-        >
-          <path d="M2.458 12C3.732 7.943 7.523 5 12 5s8.268 2.943 9.542 7c-1.274 4.057-5.065 7-9.542 7s-8.268-2.943-9.542-7z" />
-          <circle cx="12" cy="12" r="3" />
-        </svg>
-      </button>
-    </form>
+                                <td>
+                                  <div class="flex items-center gap-6">
+                                    {/* Edit / details icon */}
+                                    <form method="get" action={`${WEBROOT}/account/edit-user`}>
+                                      <input type="hidden" name="userId" value={String(u.id)} />
+                                      <button
+                                        type="submit"
+                                        class={`
+                                          inline-flex items-center justify-center text-accent-400
+                                          hover:text-accent-500
+                                        `}
+                                        title="Edit user"
+                                      >
+                                        <svg
+                                          xmlns="http://www.w3.org/2000/svg"
+                                          viewBox="0 0 24 24"
+                                          class="h-6 w-6"
+                                          fill="none"
+                                          stroke="currentColor"
+                                          stroke-width="1.8"
+                                          stroke-linecap="round"
+                                          stroke-linejoin="round"
+                                        >
+                                          <path d="M2.458 12C3.732 7.943 7.523 5 12 5s8.268 2.943 9.542 7c-1.274 4.057-5.065 7-9.542 7s-8.268-2.943-9.542-7z" />
+                                          <circle cx="12" cy="12" r="3" />
+                                        </svg>
+                                      </button>
+                                    </form>
 
-    {/* Delete icon */}
-    <form
-      method="post"
-      action={`${WEBROOT}/account/delete-user`}
-      onsubmit="return confirm('Are you sure you want to delete this user?');"
-    >
-      <input
-        type="hidden"
-        name="deleteUserId"
-        value={String(u.id)}
-      />
-      <button
-        type="submit"
-        class={`
-          inline-flex items-center justify-center text-accent-400
-          hover:text-accent-500
-        `}
-        title="Delete user"
-      >
-        <svg
-          xmlns="http://www.w3.org/2000/svg"
-          viewBox="0 0 24 24"
-          class="h-6 w-6"
-          fill="none"
-          stroke="currentColor"
-          stroke-width="1.8"
-          stroke-linecap="round"
-          stroke-linejoin="round"
-        >
-          <path d="M4 7h16" />
-          <path d="M10 11v6" />
-          <path d="M14 11v6" />
-          <path d="M6 7l1 12a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2l1-12" />
-          <path d="M9 4h6a1 1 0 0 1 1 1v2H8V5a1 1 0 0 1 1-1z" />
-        </svg>
-      </button>
-    </form>
-  </div>
-</td>
+                                    {/* Delete icon */}
+                                    <form
+                                      method="post"
+                                      action={`${WEBROOT}/account/delete-user`}
+                                      onsubmit="return confirm('Are you sure you want to delete this user?');"
+                                    >
+                                      <input
+                                        type="hidden"
+                                        name="deleteUserId"
+                                        value={String(u.id)}
+                                      />
+                                      <button
+                                        type="submit"
+                                        class={`
+                                          inline-flex items-center justify-center text-accent-400
+                                          hover:text-accent-500
+                                        `}
+                                        title="Delete user"
+                                      >
+                                        <svg
+                                          xmlns="http://www.w3.org/2000/svg"
+                                          viewBox="0 0 24 24"
+                                          class="h-6 w-6"
+                                          fill="none"
+                                          stroke="currentColor"
+                                          stroke-width="1.8"
+                                          stroke-linecap="round"
+                                          stroke-linejoin="round"
+                                        >
+                                          <path d="M4 7h16" />
+                                          <path d="M10 11v6" />
+                                          <path d="M14 11v6" />
+                                          <path d="M6 7l1 12a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2l1-12" />
+                                          <path d="M9 4h6a1 1 0 0 1 1 1v2H8V5a1 1 0 0 1 1-1z" />
+                                        </svg>
+                                      </button>
+                                    </form>
+                                  </div>
+                                </td>
                               </tr>
                             ))}
                           </tbody>
@@ -650,9 +643,7 @@ export const user = new Elysia()
       if (!tokenUser) {
         return redirect(`${WEBROOT}/login`, 302);
       }
-      const existingUser = db.query("SELECT * FROM users WHERE id = ?").as(User).get(
-        tokenUser.id,
-      );
+      const existingUser = db.query("SELECT * FROM users WHERE id = ?").as(User).get(tokenUser.id);
 
       if (!existingUser) {
         if (auth?.value) {
@@ -843,11 +834,7 @@ export const user = new Elysia()
                     </label>
                     <label class="flex flex-col gap-1">
                       Role
-                      <select
-                        name="role"
-                        class="rounded-sm bg-neutral-800 p-3 capitalize"
-                        required
-                      >
+                      <select name="role" class="rounded-sm bg-neutral-800 p-3 capitalize" required>
                         <option value="user" selected={targetUser.role === "user"}>
                           Normal user
                         </option>
@@ -868,10 +855,7 @@ export const user = new Elysia()
                     </label>
                   </fieldset>
                   <div class="flex flex-row gap-4">
-                    <a
-                      href={`${WEBROOT}/account`}
-                      class="w-full btn-secondary text-center"
-                    >
+                    <a href={`${WEBROOT}/account`} class="w-full btn-secondary text-center">
                       Cancel
                     </a>
                     <button type="submit" class="w-full btn-primary">
@@ -926,35 +910,51 @@ export const user = new Elysia()
         return redirect(`${WEBROOT}/account`, 302);
       }
 
-      // Prevent demoting the last admin
-      if (targetUser.role === "admin" && role !== "admin") {
-        const adminCountRow = db
-          .query("SELECT COUNT(*) AS cnt FROM users WHERE role = 'admin'")
-          .get() as { cnt: number };
-        if (adminCountRow.cnt <= 1) {
-          set.status = 400;
-          return { message: "You cannot demote the last remaining admin." };
-        }
-      }
-
-      const fields: string[] = [];
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const values: any[] = [];
-
-      if (role === "admin" || role === "user") {
-        fields.push("role");
-        values.push(role);
-      }
-
+      // IMPORTANT: do not hold a SQLite write transaction open across an `await`.
+      // Hash any password outside the transaction to avoid lock contention.
+      let hashedPassword: string | null = null;
       if (newPassword && newPassword.trim().length > 0) {
-        fields.push("password");
-        values.push(await Bun.password.hash(newPassword));
+        hashedPassword = await Bun.password.hash(newPassword);
       }
 
-      if (fields.length > 0) {
-        db.query(
-          `UPDATE users SET ${fields.map((f) => `${f}=?`).join(", ")} WHERE id=?`,
-        ).run(...values, targetId);
+      // Atomic last-admin protection: concurrent demotions must not be able to leave zero admins.
+      // Serialize writers and make demotion conditional in a single statement.
+      db.exec("BEGIN IMMEDIATE");
+      try {
+        // Role change
+        if (role === "admin") {
+          db.query("UPDATE users SET role = 'admin' WHERE id = ?").run(targetId);
+        } else if (role === "user") {
+          const demoteRes = db
+            .query(
+              `UPDATE users
+         SET role = 'user'
+         WHERE id = ?
+           AND role = 'admin'
+           AND (SELECT COUNT(*) FROM users WHERE role = 'admin') > 1`,
+            )
+            .run(targetId);
+
+          if (targetUser.role === "admin" && demoteRes.changes === 0) {
+            db.exec("ROLLBACK");
+            set.status = 400;
+            return { message: "You cannot demote the last remaining admin." };
+          }
+        }
+
+        // Password change (optional)
+        if (hashedPassword) {
+          db.query("UPDATE users SET password = ? WHERE id = ?").run(hashedPassword, targetId);
+        }
+
+        db.exec("COMMIT");
+      } catch (e) {
+        try {
+          db.exec("ROLLBACK");
+        } catch (rollbackErr) {
+          console.warn("[user/edit-user] ROLLBACK failed:", rollbackErr);
+        }
+        throw e;
       }
 
       return redirect(`${WEBROOT}/account`, 302);
@@ -1046,4 +1046,3 @@ export const user = new Elysia()
       cookie: "session",
     },
   );
-