Elijah/convertor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add files via upload

Browse source
This commit is contained in:
Kosztyk 2026-01-14 15:52:54 +02:00 • committed by GitHub
parent a30ab9973c
commit ca61491a31
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 114 additions and 115 deletions
Download patch file Download diff file Expand all files Collapse all files

229
src/pages/user.tsx
View file

@ -329,9 +329,7 @@ export const user = new Elysia()
.post( .post(
"/login", "/login",
async function handler({ body, set, redirect, jwt, cookie: { auth } }) { async function handler({ body, set, redirect, jwt, cookie: { auth } }) {
const existingUser = db.query("SELECT * FROM users WHERE email = ?").as(User).get( const existingUser = db.query("SELECT * FROM users WHERE email = ?").as(User).get(body.email);
body.email,
);
if (!existingUser) { if (!existingUser) {
set.status = 403; set.status = 403;
@ -507,11 +505,7 @@ export const user = new Elysia()
</label> </label>
<label class="flex flex-col gap-1"> <label class="flex flex-col gap-1">
Role Role
<select <select name="newUserRole" class="rounded-sm bg-neutral-800 p-3" required>
name="newUserRole"
class="rounded-sm bg-neutral-800 p-3"
required
>
<option value="user">Normal user</option> <option value="user">Normal user</option>
<option value="admin">Admin</option> <option value="admin">Admin</option>
</select> </select>
@ -552,75 +546,74 @@ export const user = new Elysia()
<tr> <tr>
<td>{u.email}</td> <td>{u.email}</td>
<td class="capitalize">{u.role}</td> <td class="capitalize">{u.role}</td>
<td>
<td> <div class="flex items-center gap-6">
<div class="flex items-center gap-6"> {/* Edit / details icon */}
{/* Edit / details icon */} <form method="get" action={`${WEBROOT}/account/edit-user`}>
<form method="get" action={`${WEBROOT}/account/edit-user`}> <input type="hidden" name="userId" value={String(u.id)} />
<input type="hidden" name="userId" value={String(u.id)} /> <button
<button type="submit"
type="submit" class={`
class={` inline-flex items-center justify-center text-accent-400
inline-flex items-center justify-center text-accent-400 hover:text-accent-500
hover:text-accent-500 `}
`} title="Edit user"
title="Edit user" >
> <svg
<svg xmlns="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"
viewBox="0 0 24 24" class="h-6 w-6"
class="h-6 w-6" fill="none"
fill="none" stroke="currentColor"
stroke="currentColor" stroke-width="1.8"
stroke-width="1.8" stroke-linecap="round"
stroke-linecap="round" stroke-linejoin="round"
stroke-linejoin="round" >
> <path d="M2.458 12C3.732 7.943 7.523 5 12 5s8.268 2.943 9.542 7c-1.274 4.057-5.065 7-9.542 7s-8.268-2.943-9.542-7z" />
<path d="M2.458 12C3.732 7.943 7.523 5 12 5s8.268 2.943 9.542 7c-1.274 4.057-5.065 7-9.542 7s-8.268-2.943-9.542-7z" /> <circle cx="12" cy="12" r="3" />
<circle cx="12" cy="12" r="3" /> </svg>
</svg> </button>
</button> </form>
</form>
{/* Delete icon */} {/* Delete icon */}
<form <form
method="post" method="post"
action={`${WEBROOT}/account/delete-user`} action={`${WEBROOT}/account/delete-user`}
onsubmit="return confirm('Are you sure you want to delete this user?');" onsubmit="return confirm('Are you sure you want to delete this user?');"
> >
<input <input
type="hidden" type="hidden"
name="deleteUserId" name="deleteUserId"
value={String(u.id)} value={String(u.id)}
/> />
<button <button
type="submit" type="submit"
class={` class={`
inline-flex items-center justify-center text-accent-400 inline-flex items-center justify-center text-accent-400
hover:text-accent-500 hover:text-accent-500
`} `}
title="Delete user" title="Delete user"
> >
<svg <svg
xmlns="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg"
viewBox="0 0 24 24" viewBox="0 0 24 24"
class="h-6 w-6" class="h-6 w-6"
fill="none" fill="none"
stroke="currentColor" stroke="currentColor"
stroke-width="1.8" stroke-width="1.8"
stroke-linecap="round" stroke-linecap="round"
stroke-linejoin="round" stroke-linejoin="round"
> >
<path d="M4 7h16" /> <path d="M4 7h16" />
<path d="M10 11v6" /> <path d="M10 11v6" />
<path d="M14 11v6" /> <path d="M14 11v6" />
<path d="M6 7l1 12a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2l1-12" /> <path d="M6 7l1 12a2 2 0 0 0 2 2h6a2 2 0 0 0 2-2l1-12" />
<path d="M9 4h6a1 1 0 0 1 1 1v2H8V5a1 1 0 0 1 1-1z" /> <path d="M9 4h6a1 1 0 0 1 1 1v2H8V5a1 1 0 0 1 1-1z" />
</svg> </svg>
</button> </button>
</form> </form>
</div> </div>
</td> </td>
</tr> </tr>
))} ))}
</tbody> </tbody>
@ -650,9 +643,7 @@ export const user = new Elysia()
if (!tokenUser) { if (!tokenUser) {
return redirect(`${WEBROOT}/login`, 302); return redirect(`${WEBROOT}/login`, 302);
} }
const existingUser = db.query("SELECT * FROM users WHERE id = ?").as(User).get( const existingUser = db.query("SELECT * FROM users WHERE id = ?").as(User).get(tokenUser.id);
tokenUser.id,
);
if (!existingUser) { if (!existingUser) {
if (auth?.value) { if (auth?.value) {
@ -843,11 +834,7 @@ export const user = new Elysia()
</label> </label>
<label class="flex flex-col gap-1"> <label class="flex flex-col gap-1">
Role Role
<select <select name="role" class="rounded-sm bg-neutral-800 p-3 capitalize" required>
name="role"
class="rounded-sm bg-neutral-800 p-3 capitalize"
required
>
<option value="user" selected={targetUser.role === "user"}> <option value="user" selected={targetUser.role === "user"}>
Normal user Normal user
</option> </option>
@ -868,10 +855,7 @@ export const user = new Elysia()
</label> </label>
</fieldset> </fieldset>
<div class="flex flex-row gap-4"> <div class="flex flex-row gap-4">
<a <a href={`${WEBROOT}/account`} class="w-full btn-secondary text-center">
href={`${WEBROOT}/account`}
class="w-full btn-secondary text-center"
>
Cancel Cancel
</a> </a>
<button type="submit" class="w-full btn-primary"> <button type="submit" class="w-full btn-primary">
@ -926,35 +910,51 @@ export const user = new Elysia()
return redirect(`${WEBROOT}/account`, 302); return redirect(`${WEBROOT}/account`, 302);
} }
// Prevent demoting the last admin // IMPORTANT: do not hold a SQLite write transaction open across an `await`.
if (targetUser.role === "admin" && role !== "admin") { // Hash any password outside the transaction to avoid lock contention.
const adminCountRow = db let hashedPassword: string | null = null;
.query("SELECT COUNT(*) AS cnt FROM users WHERE role = 'admin'")
.get() as { cnt: number };
if (adminCountRow.cnt <= 1) {
set.status = 400;
return { message: "You cannot demote the last remaining admin." };
}
}
const fields: string[] = [];
// eslint-disable-next-line @typescript-eslint/no-explicit-any
const values: any[] = [];
if (role === "admin" || role === "user") {
fields.push("role");
values.push(role);
}
if (newPassword && newPassword.trim().length > 0) { if (newPassword && newPassword.trim().length > 0) {
fields.push("password"); hashedPassword = await Bun.password.hash(newPassword);
values.push(await Bun.password.hash(newPassword));
} }
if (fields.length > 0) { // Atomic last-admin protection: concurrent demotions must not be able to leave zero admins.
db.query( // Serialize writers and make demotion conditional in a single statement.
`UPDATE users SET ${fields.map((f) => `${f}=?`).join(", ")} WHERE id=?`, db.exec("BEGIN IMMEDIATE");
).run(...values, targetId); try {
// Role change
if (role === "admin") {
db.query("UPDATE users SET role = 'admin' WHERE id = ?").run(targetId);
} else if (role === "user") {
const demoteRes = db
.query(
`UPDATE users
SET role = 'user'
WHERE id = ?
AND role = 'admin'
AND (SELECT COUNT(*) FROM users WHERE role = 'admin') > 1`,
)
.run(targetId);
if (targetUser.role === "admin" && demoteRes.changes === 0) {
db.exec("ROLLBACK");
set.status = 400;
return { message: "You cannot demote the last remaining admin." };
}
}
// Password change (optional)
if (hashedPassword) {
db.query("UPDATE users SET password = ? WHERE id = ?").run(hashedPassword, targetId);
}
db.exec("COMMIT");
} catch (e) {
try {
db.exec("ROLLBACK");
} catch (rollbackErr) {
console.warn("[user/edit-user] ROLLBACK failed:", rollbackErr);
}
throw e;
} }
return redirect(`${WEBROOT}/account`, 302); return redirect(`${WEBROOT}/account`, 302);
@ -1046,4 +1046,3 @@ export const user = new Elysia()
cookie: "session", cookie: "session",
}, },
); );