niko
1351 lines
71 KiB
C#
1351 lines
71 KiB
C#
using Microsoft.AspNetCore.Mvc;
|
||
using Newtonsoft.Json;
|
||
using SixLabors.ImageSharp;
|
||
using SixLabors.ImageSharp.PixelFormats;
|
||
using SixLabors.ImageSharp.Processing;
|
||
using Campus_live_rewrite.api.dbs;
|
||
using Campus_live_rewrite.api.server;
|
||
using Campus_live_rewrite.api.server.Classes.db_class;
|
||
|
||
namespace Campus_live_rewrite.Controllers
|
||
{
|
||
// Public website backend.
|
||
//
|
||
// Replaces Website/server.py (Flask). That process held a token.json with a bearer token
|
||
// + HMAC signing key and made HTTP round trips BACK to camprec.net to answer the
|
||
// site's own search calls. Running in-process removes the extra hop, the second listener,
|
||
// and the on-disk credential file entirely: searches read PlayerDB/RoomDB directly and
|
||
// images are already served by ImagesController at /img/.
|
||
//
|
||
// Paths and response shapes are kept byte-compatible with what app.js already fetches
|
||
// ({ ok, results } / { ok, error }), so the front-end change is limited to enabling the
|
||
// calls rather than rewriting them.
|
||
//
|
||
// AUTH MODEL - deliberately separate from the game and admin surfaces:
|
||
// - cookie name is `campus_site`, NOT `Authorization`. AuthHelper.ValidateToken falls
|
||
// back to an `Authorization` cookie for the admin panel; reusing that name would hand
|
||
// every website visitor the panel's cookie fallback on game endpoints.
|
||
// - the cookie is HttpOnly, so page script cannot read the token.
|
||
// - 12h lifetime, matching the game client's access-token window.
|
||
[ApiController]
|
||
public class SiteController : ControllerBase
|
||
{
|
||
private const string SiteCookie = "campus_site";
|
||
private static readonly TimeSpan SiteSessionTtl = TimeSpan.FromHours(12);
|
||
|
||
// ---- session helpers --------------------------------------------------------------
|
||
|
||
private void IssueSiteCookie(ulong accountId)
|
||
{
|
||
string jwt = ClientSecurity.RefreshToken_Web(accountId, SiteSessionTtl, "website");
|
||
Response.Cookies.Append(SiteCookie, jwt, new CookieOptions
|
||
{
|
||
// Expire the cookie with the token rather than outliving it, so the browser
|
||
// stops sending a credential the server will only reject.
|
||
Expires = DateTimeOffset.UtcNow.Add(SiteSessionTtl),
|
||
HttpOnly = true,
|
||
Secure = true,
|
||
SameSite = SameSiteMode.Lax,
|
||
Path = "/"
|
||
});
|
||
}
|
||
|
||
private void ClearSiteCookie()
|
||
{
|
||
Response.Cookies.Append(SiteCookie, "", new CookieOptions
|
||
{
|
||
Expires = DateTimeOffset.UnixEpoch,
|
||
HttpOnly = true,
|
||
Secure = true,
|
||
SameSite = SameSiteMode.Lax,
|
||
Path = "/"
|
||
});
|
||
}
|
||
|
||
// Returns the signed-in account, or null. DecodeToken re-reads the account from the DB
|
||
// on every call, so a ban or a rename applies immediately instead of at token refresh.
|
||
private player_info? CurrentUser()
|
||
{
|
||
string token = Request.Cookies[SiteCookie] ?? "";
|
||
if (string.IsNullOrEmpty(token)) return null;
|
||
|
||
// ONLY website-minted tokens are valid website sessions. A game or admin token (or a
|
||
// legacy no-surface one) is refused here, so in-game / admin auth can't act as a
|
||
// website session - the auth surfaces are kept separate.
|
||
string playerData = ClientSecurity.DecodeToken(token, requireSurface: "website");
|
||
if (string.IsNullOrEmpty(playerData) || playerData.StartsWith("error_")) return null;
|
||
|
||
try { return JsonConvert.DeserializeObject<player_info>(playerData); }
|
||
catch { return null; }
|
||
}
|
||
|
||
private object PublicUser(player_data full) => new
|
||
{
|
||
id = full.playerid,
|
||
username = full.player?.Username,
|
||
display_name = full.player?.DisplayName,
|
||
profile_image = full.player?.profileImage,
|
||
banner_image = full.player?.bannerImage,
|
||
bio = full.player_Extra?.Bio,
|
||
level = full.player?.Level ?? 0,
|
||
xp = full.player?.XP ?? 0,
|
||
// RecCenterTokens (currency type 2) - the same "Tokens" the game shows. Only on the
|
||
// authed /me response, never the public profile, so a balance isn't exposed publicly.
|
||
tokens = PlayerDB.GetBalance(full.playerid, 2),
|
||
banned = PlayerDB.HasActiveModerationBlock(full.playerid),
|
||
// The site-wide ban banner reads this: null when not banned, else the time left
|
||
// (remaining_seconds null = permanent) and the reason. SiteBanGateMiddleware refuses
|
||
// every change a banned session tries to make.
|
||
ban = SiteBanDto(full.playerid),
|
||
};
|
||
|
||
private static object? SiteBanDto(ulong playerid)
|
||
{
|
||
var b = PlayerDB.GetSiteBan(playerid);
|
||
if (b == null) return null;
|
||
return new
|
||
{
|
||
permanent = b.RemainingSeconds == null,
|
||
remaining_seconds = b.RemainingSeconds,
|
||
until = b.Until,
|
||
reason = b.Reason
|
||
};
|
||
}
|
||
|
||
// ---- accounts ---------------------------------------------------------------------
|
||
|
||
// POST /api/site/login {username, password}
|
||
[HttpPost("/api/site/login")]
|
||
public IActionResult Login([FromBody] SiteCreds? body)
|
||
{
|
||
if (body == null || string.IsNullOrWhiteSpace(body.username) || string.IsNullOrWhiteSpace(body.password))
|
||
return BadRequest(new { ok = false, error = "Enter a username and password." });
|
||
|
||
// Same helper the launcher and admin panel use, so password upgrades (legacy SHA256
|
||
// rows -> PBKDF2) and lockout behaviour stay in ONE place.
|
||
var result = PlayerDB.GetAccountPassword(body.username.Trim(), body.password, isAdminPanel: false);
|
||
if (!result.success)
|
||
return Unauthorized(new { ok = false, error = result.error ?? "Incorrect username or password." });
|
||
|
||
// Correct password. If this account turned 2FA on (Settings -> Security), that's only half the login - hold
|
||
// off on the site cookie and send back a ticket naming the account instead. The page then asks for a code and
|
||
// posts it to /api/site/login/2fa, which is the only place the cookie actually gets issued for a 2FA account.
|
||
if (TwoFactorDB.IsEnabled(result.accid))
|
||
return Ok(new { ok = false, need2fa = true, pending = PendingTwoFactorLogin.Issue(result.accid, "website") });
|
||
|
||
// A banned account CAN sign in - every page then shows the ban banner (time left +
|
||
// reason) - but it can't change anything: SiteBanGateMiddleware refuses its writes.
|
||
IssueSiteCookie(result.accid);
|
||
|
||
var full = PlayerDB.GetFullAccount(result.accid);
|
||
return Ok(new { ok = true, user = full == null ? null : PublicUser(full) });
|
||
}
|
||
|
||
/// <summary>Step 2 of a 2FA account's website login: the ticket from Login, plus a code from their authenticator
|
||
/// app (or a recovery code). Covered by the same /api/site/login flood ceiling as the password step
|
||
/// (TrafficGuardMiddleware.IsAuthPath matches by prefix).</summary>
|
||
public class SiteLogin2FA { public string? pending { get; set; } public string? code { get; set; } }
|
||
|
||
[HttpPost("/api/site/login/2fa")]
|
||
public IActionResult Login2FA([FromBody] SiteLogin2FA? body)
|
||
{
|
||
ulong accountId = PendingTwoFactorLogin.Validate(body?.pending, "website");
|
||
if (accountId == 0)
|
||
return Unauthorized(new { ok = false, error = "That login attempt expired - log in again." });
|
||
|
||
if (!TwoFactorDB.VerifyLogin(accountId, body?.code))
|
||
return Unauthorized(new { ok = false, need2fa = true, pending = body!.pending, error = "Wrong code." });
|
||
|
||
IssueSiteCookie(accountId);
|
||
var full = PlayerDB.GetFullAccount(accountId);
|
||
return Ok(new { ok = true, user = full == null ? null : PublicUser(full) });
|
||
}
|
||
|
||
// ---- 2FA enrollment (the signed-in player managing THEIR OWN account) -------------------------------------
|
||
|
||
[HttpGet("/api/site/2fa/status")]
|
||
public IActionResult TwoFactorStatusSite()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
return Ok(new { ok = true, enabled = TwoFactorDB.IsEnabled(account.Id) });
|
||
}
|
||
|
||
[HttpPost("/api/site/2fa/setup")]
|
||
public IActionResult TwoFactorSetupSite()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
string secret = TwoFactorDB.BeginEnroll(account.Id);
|
||
return Ok(new { ok = true, secret, otpauth = Totp.OtpAuthUri(secret, account.Username ?? ("player" + account.Id), "Campus") });
|
||
}
|
||
|
||
public class SiteTwoFactorCode { public string? code { get; set; } }
|
||
|
||
[HttpPost("/api/site/2fa/confirm")]
|
||
public IActionResult TwoFactorConfirmSite([FromBody] SiteTwoFactorCode? body)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
var codes = TwoFactorDB.ConfirmEnroll(account.Id, body?.code ?? "");
|
||
if (codes == null) return BadRequest(new { ok = false, error = "Wrong code - try the current 6 digits from your app." });
|
||
return Ok(new { ok = true, recoveryCodes = codes });
|
||
}
|
||
|
||
[HttpPost("/api/site/2fa/disable")]
|
||
public IActionResult TwoFactorDisableSite()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
TwoFactorDB.Disable(account.Id);
|
||
return Ok(new { ok = true });
|
||
}
|
||
|
||
// POST /api/site/register
|
||
//
|
||
// Campus accounts are now MADE here, on the website (like a normal web account), and the
|
||
// game only logs in to them. The account carries no Steam binding at creation; the Steam
|
||
// id is stamped on the first in-game login (AccountLock), which is where the one-account-
|
||
// per-Steam / per-device rule is enforced. Protections against mass creation:
|
||
// - layered signup caps: per IP per day/week, per /24 per day, and a GLOBAL per-hour cap
|
||
// (ConfigCampus.SignupsPer*; see PlayerDB.CheckSignupLimit),
|
||
// - username must be unique (case-insensitive) and match a strict charset,
|
||
// - reserved names blocked, a hidden honeypot field traps naive bots,
|
||
// - password confirmation checked server-side.
|
||
[HttpPost("/api/site/register")]
|
||
public IActionResult Register([FromBody] SiteRegister? body)
|
||
{
|
||
if (body == null)
|
||
return BadRequest(new { ok = false, error = "Missing sign-up details." });
|
||
|
||
// Honeypot: a real form leaves `website` empty (it is hidden). A bot that fills every
|
||
// field trips it. Generic message so it learns nothing.
|
||
if (!string.IsNullOrWhiteSpace(body.website))
|
||
{
|
||
Console.WriteLine("[web-signup] honeypot tripped - refused");
|
||
return BadRequest(new { ok = false, error = "Could not create account." });
|
||
}
|
||
|
||
string username = (body.username ?? "").Trim();
|
||
string pass = body.password ?? "";
|
||
string confirm = body.confirm_password ?? "";
|
||
string email = (body.email ?? "").Trim();
|
||
|
||
// ---- date of birth (required) ----
|
||
// One username field only now, so the @name IS the display name. But first: age gates
|
||
// everything. Under 13 -> we IGNORE the chosen name, hand out a random one (privacy), and
|
||
// flag the account junior (chat/social restricted client-side).
|
||
if (string.IsNullOrWhiteSpace(body.birthday) ||
|
||
!DateTime.TryParse(body.birthday, System.Globalization.CultureInfo.InvariantCulture,
|
||
System.Globalization.DateTimeStyles.AssumeUniversal | System.Globalization.DateTimeStyles.AdjustToUniversal,
|
||
out var dob))
|
||
return BadRequest(new { ok = false, error = "Enter your date of birth." });
|
||
|
||
var today = DateTime.UtcNow.Date;
|
||
if (dob.Date > today)
|
||
return BadRequest(new { ok = false, error = "Enter a valid date of birth." });
|
||
int age = today.Year - dob.Year;
|
||
if (dob.Date > today.AddYears(-age)) age--; // not had this year's birthday yet
|
||
if (age > 120)
|
||
return BadRequest(new { ok = false, error = "Enter a valid date of birth." });
|
||
bool isJunior = age < 13;
|
||
string birthdayIso = dob.ToString("yyyy-MM-ddT00:00:00.000Z");
|
||
|
||
// ---- username ----
|
||
// Juniors never choose an identifying name: we generate one (e.g. FunkyHippo1293) and
|
||
// skip the user's input entirely. Everyone else's single username is validated and used
|
||
// as BOTH the @name and the display name.
|
||
string display;
|
||
if (isJunior)
|
||
{
|
||
username = PlayerDB.GenerateJuniorUsername();
|
||
display = username;
|
||
}
|
||
else
|
||
{
|
||
if (username.Length < 3 || username.Length > 20)
|
||
return BadRequest(new { ok = false, error = "Username must be 3-20 characters." });
|
||
if (!System.Text.RegularExpressions.Regex.IsMatch(username, "^[A-Za-z0-9_]+$"))
|
||
return BadRequest(new { ok = false, error = "Username can only use letters, numbers and underscores." });
|
||
if (IsReservedName(username))
|
||
return BadRequest(new { ok = false, error = "That username isn't available." });
|
||
display = username; // one field: the @name is the display name
|
||
}
|
||
|
||
// ---- password ----
|
||
if (pass.Length < 6 || pass.Length > 64)
|
||
return BadRequest(new { ok = false, error = "Password must be 6-64 characters." });
|
||
if (pass != confirm)
|
||
return BadRequest(new { ok = false, error = "The passwords don't match." });
|
||
|
||
// ---- email (optional) ----
|
||
if (email.Length > 0)
|
||
{
|
||
if (email.Length > 254 ||
|
||
!System.Text.RegularExpressions.Regex.IsMatch(email, @"^[^@\s]+@[^@\s]+\.[^@\s]+$"))
|
||
return BadRequest(new { ok = false, error = "Enter a valid email, or leave it blank." });
|
||
}
|
||
|
||
// ---- IP rate limit ----
|
||
// The owner's own accounts (Coach/Kyle), when signed in on the site, may make test
|
||
// accounts without waiting out the week.
|
||
string? ip = ClientIp();
|
||
var signedIn = CurrentUser();
|
||
bool ownerBypass = signedIn != null &&
|
||
Campus_live_rewrite.api.server.AccountLock.IsExempt(signedIn.Id);
|
||
if (!ownerBypass)
|
||
{
|
||
var limit = PlayerDB.CheckSignupLimit(ip, out DateTime nextAllowed);
|
||
if (limit != PlayerDB.SignupLimit.None)
|
||
{
|
||
var wait = nextAllowed - DateTime.UtcNow;
|
||
string when = wait.TotalHours < 1 ? "in a few minutes"
|
||
: wait.TotalHours < 36 ? "in about " + Math.Max(1, (int)Math.Ceiling(wait.TotalHours)) + " hours"
|
||
: "in about " + (int)Math.Ceiling(wait.TotalDays) + " days";
|
||
Console.WriteLine("[web-signup] refused (" + limit + ") IP " + ip + " - next allowed " + nextAllowed.ToString("u"));
|
||
string msg = limit == PlayerDB.SignupLimit.Global
|
||
? "Lots of accounts are being created right now. Please try again " + when + "."
|
||
: "Too many accounts have been created from your network recently. Please try again " + when + ".";
|
||
return StatusCode(429, new { ok = false, error = msg });
|
||
}
|
||
}
|
||
|
||
// ---- uniqueness (re-checked inside CreateWebAccount too, this gives a clean 409) ----
|
||
if (PlayerDB.IsUsernameTaken(username))
|
||
return Conflict(new { ok = false, error = "That username is already taken." });
|
||
|
||
try
|
||
{
|
||
if (!PlayerDB.CreateWebAccount(username, display, pass,
|
||
email.Length == 0 ? null : email, out var acc, out string createErr,
|
||
isJunior: isJunior, birthday: birthdayIso))
|
||
{
|
||
return BadRequest(new { ok = false, error = string.IsNullOrEmpty(createErr) ? "Could not create account." : createErr });
|
||
}
|
||
|
||
PlayerDB.RecordSignup(ip, acc.accountId);
|
||
Console.WriteLine($"[web-signup] account {acc.accountId} created from IP {ip}");
|
||
IssueSiteCookie(acc.accountId);
|
||
|
||
var full = PlayerDB.GetFullAccount(acc.accountId);
|
||
return Ok(new { ok = true, user = full == null ? null : PublicUser(full) });
|
||
}
|
||
catch (Exception ex)
|
||
{
|
||
Console.WriteLine($"[web-signup] failed: {ex}");
|
||
return StatusCode(500, new { ok = false, error = "Could not create account. Please try again." });
|
||
}
|
||
}
|
||
|
||
// Names nobody may register (impersonation / reserved). The owner's own accounts already
|
||
// exist, so IsUsernameTaken blocks re-registering them without needing them listed here.
|
||
private static readonly HashSet<string> _reserved = new(StringComparer.OrdinalIgnoreCase)
|
||
{
|
||
"admin", "administrator", "moderator", "mod", "campus", "system", "root",
|
||
"staff", "support", "null", "undefined", "everyone", "here", "recroom", "official"
|
||
};
|
||
private static bool IsReservedName(string name) => _reserved.Contains(name.Trim());
|
||
|
||
// The real browser IP, for the signup rate limit. The app sits behind Caddy
|
||
// (`reverse_proxy localhost:8080`), so HttpContext.Connection.RemoteIpAddress is always
|
||
// 127.0.0.1 (Caddy) - which the rate limit treats as the exempt localhost, so every
|
||
// signup slipped through. Caddy APPENDS the true connecting IP as the LAST
|
||
// X-Forwarded-For entry; that entry is authoritative and cannot be spoofed by a client
|
||
// sending its own X-Forwarded-For / CF-Connecting-IP (Caddy passes those through but
|
||
// always adds the real peer after them), so we take the LAST entry. CF-Connecting-IP is
|
||
// deliberately NOT trusted here: there is no Cloudflare in front, so it would be a free
|
||
// spoof to rotate past the limit.
|
||
private string? ClientIp()
|
||
{
|
||
string xff = Request.Headers["X-Forwarded-For"].ToString();
|
||
if (!string.IsNullOrWhiteSpace(xff))
|
||
{
|
||
var parts = xff.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
|
||
if (parts.Length > 0) return parts[parts.Length - 1];
|
||
}
|
||
return HttpContext.Connection.RemoteIpAddress?.ToString();
|
||
}
|
||
|
||
// POST /api/site/logout
|
||
// Clears this browser's session. The JWT itself stays valid until it expires - there is
|
||
// no server-side session store yet, so this cannot revoke a token already copied out.
|
||
[HttpPost("/api/site/logout")]
|
||
public IActionResult Logout()
|
||
{
|
||
ClearSiteCookie();
|
||
return Ok(new { ok = true });
|
||
}
|
||
|
||
// ---- Support tickets --------------------------------------------------------------
|
||
// A signed-in player opens a ticket (the Support page's form); STAFF (dev / mod / owner /
|
||
// support flag) see every ticket and can reply, write internal notes, claim, close and
|
||
// reopen. Topics, read markers, screenshots, limits and auto-close live in SupportDB.
|
||
|
||
private static bool IsStaffFlag(DevFlag f) => (f & (DevFlag.dev | DevFlag.mod | DevFlag.owner | DevFlag.support)) != 0;
|
||
private bool IsStaff(ulong id) => IsStaffFlag(PlayerDB.GetFullAccount(id)?.dev_Flag ?? DevFlag.none);
|
||
|
||
public class SupportCreateReq
|
||
{
|
||
public string? subject { get; set; }
|
||
public string? message { get; set; }
|
||
public string? category { get; set; }
|
||
public List<string>? attachments { get; set; }
|
||
}
|
||
public class SupportReplyReq
|
||
{
|
||
public string? message { get; set; }
|
||
public bool @internal { get; set; }
|
||
public List<string>? attachments { get; set; }
|
||
}
|
||
public class SupportAssignReq { public bool assign { get; set; } = true; }
|
||
|
||
private static readonly Dictionary<string, string> SupportCategories = new()
|
||
{
|
||
["account"] = "Account / login issue",
|
||
["join"] = "Joining & invites",
|
||
["econ"] = "Currency, rewards & gift boxes",
|
||
["report_player"] = "Report a player",
|
||
["report_room"] = "Report a room",
|
||
["bug"] = "Bug report",
|
||
["appeal"] = "Ban appeal",
|
||
["other"] = "Something else",
|
||
};
|
||
|
||
// A ticket's topic key: stored since this change; older tickets carry it as the
|
||
// "Issue type: <label>" line of their opening message.
|
||
private static string CategoryOf(SupportDB.Ticket t)
|
||
{
|
||
if (!string.IsNullOrEmpty(t.Category)) return t.Category!;
|
||
string first = t.Messages?.FirstOrDefault()?.Body ?? "";
|
||
var m = System.Text.RegularExpressions.Regex.Match(first, @"^Issue type:\s*(.+)$", System.Text.RegularExpressions.RegexOptions.Multiline);
|
||
if (m.Success)
|
||
{
|
||
string label = m.Groups[1].Value.Trim();
|
||
foreach (var kv in SupportCategories) if (string.Equals(kv.Value, label, StringComparison.OrdinalIgnoreCase)) return kv.Key;
|
||
}
|
||
return "other";
|
||
}
|
||
|
||
private static string AttachmentUrl(string name) => "/api/site/support/attachment/" + name;
|
||
|
||
private object TicketSummary(SupportDB.Ticket t, bool forStaff)
|
||
{
|
||
var last = (t.Messages ?? new()).LastOrDefault(m => forStaff || !m.Internal);
|
||
return new
|
||
{
|
||
id = t.Id,
|
||
subject = t.Subject,
|
||
status = t.Status,
|
||
category = CategoryOf(t),
|
||
categoryLabel = SupportCategories.TryGetValue(CategoryOf(t), out var cl) ? cl : "Something else",
|
||
username = t.Username,
|
||
accountId = t.AccountId,
|
||
createdAt = t.CreatedAt,
|
||
updatedAt = t.UpdatedAt,
|
||
messageCount = (t.Messages ?? new()).Count(m => !m.System && (forStaff || !m.Internal)),
|
||
lastMessage = last == null ? "" : (last.Internal ? "[note] " : "") + (last.Body.Length > 0 ? last.Body : "(screenshot)"),
|
||
awaiting = SupportDB.AwaitingOf(t),
|
||
unread = forStaff ? SupportDB.UnreadForStaff(t) : SupportDB.UnreadForPlayer(t),
|
||
assignedTo = t.AssignedTo,
|
||
assignedName = t.AssignedName,
|
||
};
|
||
}
|
||
|
||
// Resolve an account's profile picture to a website URL (/img/<name>), or null.
|
||
// Pass through values that are already a URL or an absolute path (legacy accounts).
|
||
private static string? AvatarUrl(string? imageName) =>
|
||
string.IsNullOrEmpty(imageName) ? null
|
||
: (imageName.StartsWith("http", StringComparison.OrdinalIgnoreCase) || imageName.StartsWith("/")) ? imageName
|
||
: "/img/" + imageName;
|
||
|
||
private object TicketDetail(SupportDB.Ticket t, ulong viewerId, bool forStaff)
|
||
{
|
||
// Cache lookups so a person who sent several messages is only fetched once.
|
||
var cache = new Dictionary<ulong, string?>();
|
||
string? avatarFor(ulong id)
|
||
{
|
||
if (id == 0) return null;
|
||
if (!cache.TryGetValue(id, out var url))
|
||
{
|
||
url = AvatarUrl(PlayerDB.GetFullAccount(id)?.player?.profileImage);
|
||
cache[id] = url;
|
||
}
|
||
return url;
|
||
}
|
||
return new
|
||
{
|
||
id = t.Id,
|
||
subject = t.Subject,
|
||
status = t.Status,
|
||
category = CategoryOf(t),
|
||
categoryLabel = SupportCategories.TryGetValue(CategoryOf(t), out var cl) ? cl : "Something else",
|
||
username = t.Username,
|
||
accountId = t.AccountId,
|
||
avatar = avatarFor(t.AccountId),
|
||
createdAt = t.CreatedAt,
|
||
updatedAt = t.UpdatedAt,
|
||
awaiting = SupportDB.AwaitingOf(t),
|
||
assignedTo = t.AssignedTo,
|
||
assignedName = t.AssignedName,
|
||
messages = (t.Messages ?? new()).Where(m => forStaff || !m.Internal).Select(m => new
|
||
{
|
||
fromName = m.FromName,
|
||
staff = m.Staff,
|
||
body = m.Body,
|
||
at = m.At,
|
||
mine = m.FromAccountId == viewerId && !m.System,
|
||
@internal = m.Internal,
|
||
system = m.System,
|
||
avatar = m.System ? null : avatarFor(m.FromAccountId),
|
||
attachments = (m.Attachments ?? new()).Select(AttachmentUrl).ToList()
|
||
}),
|
||
// Staff see who they're helping: account age, bans, their other tickets.
|
||
player = forStaff ? SupportPlayerContext(t) : null
|
||
};
|
||
}
|
||
|
||
private static object? SupportPlayerContext(SupportDB.Ticket t)
|
||
{
|
||
var full = PlayerDB.GetFullAccount(t.AccountId);
|
||
if (full?.player == null) return null;
|
||
var ban = PlayerDB.GetSiteBan(t.AccountId);
|
||
var mic = PlayerDB.GetActiveMicBan(t.AccountId);
|
||
var others = SupportDB.ForAccount(t.AccountId).Where(x => x.Id != t.Id).ToList();
|
||
return new
|
||
{
|
||
id = t.AccountId,
|
||
username = full.player.Username,
|
||
displayName = full.player.DisplayName,
|
||
createdAt = full.player.created_at,
|
||
level = full.player.Level,
|
||
junior = full.player.IsJunior,
|
||
banned = ban != null,
|
||
banPermanent = ban != null && ban.RemainingSeconds == null,
|
||
banRemainingSeconds = ban?.RemainingSeconds,
|
||
banReason = ban?.Reason,
|
||
micBanned = mic != null,
|
||
micBanPermanent = mic != null && mic.Duration == int.MaxValue,
|
||
micBanRemainingSeconds = mic == null || mic.Duration == int.MaxValue ? (int?)null : mic.Duration,
|
||
otherTickets = others.Count,
|
||
otherOpen = others.Count(x => x.Status == "open"),
|
||
};
|
||
}
|
||
|
||
// Does the caller get the staff panel? Also tells the page whether to show ticket UI at all.
|
||
[HttpGet("/api/site/support/role")]
|
||
public IActionResult SupportRole()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Ok(new { signedIn = false, staff = false });
|
||
bool staff = IsStaff(account.Id);
|
||
var mine = SupportDB.ForAccount(account.Id);
|
||
return Ok(new
|
||
{
|
||
signedIn = true,
|
||
staff,
|
||
username = account.Username,
|
||
openCount = staff ? SupportDB.OpenCount() : 0,
|
||
awaitingStaff = staff ? SupportDB.AwaitingStaffCount() : 0,
|
||
unreadMine = mine.Count(SupportDB.UnreadForPlayer),
|
||
openMine = mine.Count(x => x.Status == "open"),
|
||
maxOpen = SupportDB.MaxOpenTicketsPerPlayer,
|
||
// The assistant's "I'm banned" answers read this.
|
||
ban = PlayerDB.GetSiteBan(account.Id) is { } b ? new { permanent = b.RemainingSeconds == null, remainingSeconds = b.RemainingSeconds, reason = b.Reason } : null,
|
||
micBan = PlayerDB.GetActiveMicBan(account.Id) is { } mb ? new { permanent = mb.Duration == int.MaxValue, remainingSeconds = mb.Duration == int.MaxValue ? (int?)null : mb.Duration } : null,
|
||
});
|
||
}
|
||
|
||
[HttpPost("/api/site/support/create")]
|
||
public IActionResult SupportCreate([FromBody] SupportCreateReq? body)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "Log in to open a ticket." });
|
||
|
||
string msg = (body?.message ?? "").Trim();
|
||
if (msg.Length < 3) return BadRequest(new { ok = false, error = "Please describe your issue." });
|
||
if (msg.Length > 4000) msg = msg.Substring(0, 4000);
|
||
string subject = (body?.subject ?? "").Trim();
|
||
if (subject.Length > 120) subject = subject.Substring(0, 120);
|
||
string category = body?.category is { } c && SupportCategories.ContainsKey(c) ? c : "other";
|
||
|
||
// Anti-spam: a few open tickets at a time, and a short gap between new ones.
|
||
if (!IsStaff(account.Id))
|
||
{
|
||
if (SupportDB.OpenCountFor(account.Id) >= SupportDB.MaxOpenTicketsPerPlayer)
|
||
return StatusCode(429, new { ok = false, error = $"You already have {SupportDB.MaxOpenTicketsPerPlayer} open tickets. Add to one of them in My tickets, or close one you don't need." });
|
||
var lastAt = SupportDB.LastCreatedBy(account.Id);
|
||
if (lastAt != null && DateTime.UtcNow - lastAt.Value < SupportDB.NewTicketCooldown)
|
||
return StatusCode(429, new { ok = false, error = "You just opened a ticket - please wait a minute before opening another." });
|
||
}
|
||
|
||
var files = SupportDB.OwnUnclaimed(account.Id, body?.attachments);
|
||
var t = SupportDB.Create(account.Id, account.Username ?? $"Player{account.Id}", subject, msg, category, files);
|
||
|
||
try
|
||
{
|
||
Webhook.Send(account.Id, "mod", $"🎫 New support ticket #{t.Id} ({SupportCategories[category]})",
|
||
$"From @{t.Username} (id {account.Id})\nSubject: {t.Subject}\n\n{msg}{(files.Count > 0 ? $"\n\n[{files.Count} screenshot(s)]" : "")}", 15844367);
|
||
}
|
||
catch (Exception ex) { Console.WriteLine($"[support] webhook failed: {ex.Message}"); }
|
||
|
||
Console.WriteLine($"[support] ticket #{t.Id} ({category}) opened by @{t.Username} ({account.Id})");
|
||
NotifyStaff();
|
||
return Ok(new { ok = true, id = t.Id });
|
||
}
|
||
|
||
[HttpGet("/api/site/support/mine")]
|
||
public IActionResult SupportMine()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
return Ok(new { ok = true, tickets = SupportDB.ForAccount(account.Id).Select(t => TicketSummary(t, false)) });
|
||
}
|
||
|
||
// Staff list. status: open | closed | all ; category: a topic key ; q: #id, @username or
|
||
// words in the subject ; mine: only tickets claimed by the caller ; unclaimed: only unclaimed ;
|
||
// waiting: only tickets waiting on staff.
|
||
[HttpGet("/api/site/support/all")]
|
||
public IActionResult SupportAll([FromQuery] string? status = null, [FromQuery] string? category = null, [FromQuery] string? q = null,
|
||
[FromQuery] bool mine = false, [FromQuery] bool unclaimed = false, [FromQuery] bool waiting = false)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
if (!IsStaff(account.Id)) return StatusCode(403, new { ok = false, error = "staff only" });
|
||
IEnumerable<SupportDB.Ticket> rows = SupportDB.All(status);
|
||
if (!string.IsNullOrWhiteSpace(category) && category != "all") rows = rows.Where(t => CategoryOf(t) == category);
|
||
if (mine) rows = rows.Where(t => t.AssignedTo == account.Id);
|
||
if (unclaimed) rows = rows.Where(t => t.AssignedTo == 0);
|
||
if (waiting) rows = rows.Where(t => SupportDB.AwaitingOf(t) == "staff");
|
||
string term = (q ?? "").Trim();
|
||
if (term.Length > 0)
|
||
{
|
||
string lower = term.ToLowerInvariant().TrimStart('@');
|
||
bool isNum = int.TryParse(term.TrimStart('#'), out int num);
|
||
rows = rows.Where(t => (isNum && (t.Id == num || t.AccountId == (ulong)num))
|
||
|| t.Username.ToLowerInvariant().Contains(lower)
|
||
|| t.Subject.ToLowerInvariant().Contains(lower));
|
||
}
|
||
// Waiting on staff first, then newest activity.
|
||
var list = rows.OrderBy(t => SupportDB.AwaitingOf(t) == "staff" ? 0 : 1).ThenByDescending(t => t.UpdatedAt).ToList();
|
||
return Ok(new { ok = true, tickets = list.Select(t => TicketSummary(t, true)) });
|
||
}
|
||
|
||
[HttpGet("/api/site/support/ticket/{id:int}")]
|
||
public IActionResult SupportTicket(int id)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
var t = SupportDB.Get(id);
|
||
if (t == null) return NotFound(new { ok = false, error = "no such ticket" });
|
||
bool staff = IsStaff(account.Id);
|
||
bool owner = t.AccountId == account.Id;
|
||
if (!owner && !staff) return StatusCode(403, new { ok = false, error = "not your ticket" });
|
||
// Opening it is reading it (the owner's view counts as the player's even for staff).
|
||
bool asStaffView = staff && !owner;
|
||
if (asStaffView ? SupportDB.UnreadForStaff(t) : SupportDB.UnreadForPlayer(t))
|
||
{
|
||
SupportDB.MarkRead(id, asStaffView);
|
||
t = SupportDB.Get(id)!;
|
||
if (asStaffView) NotifyStaff(); else SiteNotifications.Notify(account.Id);
|
||
}
|
||
return Ok(new { ok = true, ticket = TicketDetail(t, account.Id, staff), staff });
|
||
}
|
||
|
||
[HttpPost("/api/site/support/ticket/{id:int}/reply")]
|
||
public IActionResult SupportReply(int id, [FromBody] SupportReplyReq? body)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
var t = SupportDB.Get(id);
|
||
if (t == null) return NotFound(new { ok = false, error = "no such ticket" });
|
||
bool staff = IsStaff(account.Id);
|
||
if (t.AccountId != account.Id && !staff) return StatusCode(403, new { ok = false, error = "not your ticket" });
|
||
|
||
string msg = (body?.message ?? "").Trim();
|
||
var files = SupportDB.OwnUnclaimed(account.Id, body?.attachments);
|
||
if (msg.Length < 1 && files.Count == 0) return BadRequest(new { ok = false, error = "empty reply" });
|
||
if (msg.Length > 4000) msg = msg.Substring(0, 4000);
|
||
bool isInternal = staff && body?.@internal == true;
|
||
if (!staff)
|
||
{
|
||
if (!RateLimit.TryConsumeQuota($"supreply:{account.Id}", maxInWindow: 15, windowSeconds: 600, out int retry))
|
||
{
|
||
Response.Headers["Retry-After"] = retry.ToString();
|
||
return StatusCode(429, new { ok = false, error = $"You're sending replies too fast. Try again in {(retry + 59) / 60} minute(s)." });
|
||
}
|
||
if (files.Count > 0 && SupportDB.PlayerAttachmentCount(t, account.Id) + files.Count > SupportDB.MaxPlayerAttachmentsPerTicket)
|
||
return StatusCode(429, new { ok = false, error = $"This ticket already has the most screenshots allowed ({SupportDB.MaxPlayerAttachmentsPerTicket}). Send your reply without them." });
|
||
}
|
||
|
||
var updated = SupportDB.AddMessage(id, account.Id, account.Username ?? $"Player{account.Id}", staff, msg, isInternal, files)!;
|
||
if (!isInternal)
|
||
{
|
||
if (staff && account.Id != t.AccountId)
|
||
{
|
||
// The player's bell lights up: "Staff replied to your ticket #N".
|
||
SiteNotifications.Notify(t.AccountId);
|
||
}
|
||
else
|
||
{
|
||
try
|
||
{
|
||
Webhook.Send(account.Id, "mod", $"💬 Reply on ticket #{id}",
|
||
$"@{t.Username}: {(msg.Length > 600 ? msg.Substring(0, 600) + "…" : msg)}{(files.Count > 0 ? $"\n[{files.Count} screenshot(s)]" : "")}", 3447003);
|
||
}
|
||
catch { }
|
||
NotifyStaff();
|
||
}
|
||
}
|
||
return Ok(new { ok = true, ticket = TicketDetail(updated, account.Id, staff), staff });
|
||
}
|
||
|
||
[HttpPost("/api/site/support/ticket/{id:int}/close")]
|
||
public IActionResult SupportClose(int id) => SupportSetStatus(id, "closed");
|
||
|
||
[HttpPost("/api/site/support/ticket/{id:int}/reopen")]
|
||
public IActionResult SupportReopen(int id) => SupportSetStatus(id, "open");
|
||
|
||
private IActionResult SupportSetStatus(int id, string status)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
var t = SupportDB.Get(id);
|
||
if (t == null) return NotFound(new { ok = false, error = "no such ticket" });
|
||
bool staff = IsStaff(account.Id);
|
||
if (t.AccountId != account.Id && !staff) return StatusCode(403, new { ok = false, error = "not your ticket" });
|
||
SupportDB.SetStatus(id, status, account.Id, account.Username ?? $"Player{account.Id}", staff);
|
||
Console.WriteLine($"[support] ticket #{id} {(status == "closed" ? "closed" : "reopened")} by @{account.Username} ({account.Id})");
|
||
if (staff && account.Id != t.AccountId) SiteNotifications.Notify(t.AccountId); else NotifyStaff();
|
||
return Ok(new { ok = true });
|
||
}
|
||
|
||
// Claim (assign to yourself) or release a ticket. Staff only.
|
||
[HttpPost("/api/site/support/ticket/{id:int}/assign")]
|
||
public IActionResult SupportAssign(int id, [FromBody] SupportAssignReq? body)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
if (!IsStaff(account.Id)) return StatusCode(403, new { ok = false, error = "staff only" });
|
||
string name = account.Username ?? $"Player{account.Id}";
|
||
var t = SupportDB.Assign(id, body?.assign == false ? 0 : account.Id, name, account.Id, name);
|
||
if (t == null) return NotFound(new { ok = false, error = "no such ticket" });
|
||
return Ok(new { ok = true, ticket = TicketDetail(t, account.Id, true), staff = true });
|
||
}
|
||
|
||
// Screenshot upload (multipart field "file"): returns a name to send with the ticket or
|
||
// reply. Images only (decoded and re-encoded server-side), up to SupportDB.MaxAttachmentBytes.
|
||
//
|
||
// Anti-spam, cheapest check first and all BEFORE the body is read or decoded:
|
||
// * burst quota per account (10 per 10 min) and per IP (20 per 10 min, so a pile of
|
||
// accounts on one connection can't multiply it) - in memory;
|
||
// * persisted caps in SupportDB.UploadRefusal: 8 unsent uploads, 30 uploads / 40 MB a
|
||
// day per player, and a hard cap on the whole folder;
|
||
// and unsent uploads are deleted after 2 hours, so uploading without ever sending the
|
||
// ticket can't pile files up either. Staff are exempt from the quotas (not the caps).
|
||
[HttpPost("/api/site/support/upload")]
|
||
[RequestSizeLimit(8 * 1024 * 1024)]
|
||
public async Task<IActionResult> SupportUpload()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
if (!IsStaff(account.Id))
|
||
{
|
||
string? ip = ClientIp();
|
||
int retry;
|
||
if (!RateLimit.TryConsumeQuota($"supup:{account.Id}", maxInWindow: 10, windowSeconds: 600, out retry)
|
||
|| (!string.IsNullOrEmpty(ip) && !RateLimit.TryConsumeQuota($"supupip:{ip}", maxInWindow: 20, windowSeconds: 600, out retry)))
|
||
{
|
||
Response.Headers["Retry-After"] = retry.ToString();
|
||
return StatusCode(429, new { ok = false, error = $"You're adding screenshots too fast. Try again in {(retry + 59) / 60} minute(s)." });
|
||
}
|
||
}
|
||
string? refusal = SupportDB.UploadRefusal(account.Id);
|
||
if (refusal != null) return StatusCode(429, new { ok = false, error = refusal });
|
||
if (!Request.HasFormContentType || Request.Form.Files.Count == 0) return BadRequest(new { ok = false, error = "No file." });
|
||
var file = Request.Form.Files[0];
|
||
if (file.Length > SupportDB.MaxAttachmentBytes)
|
||
return BadRequest(new { ok = false, error = $"That image is too big (max {SupportDB.MaxAttachmentBytes / 1024 / 1024} MB)." });
|
||
using var ms = new MemoryStream();
|
||
await file.CopyToAsync(ms);
|
||
string? name = SupportDB.SaveAttachment(account.Id, ms.ToArray());
|
||
if (name == null) return BadRequest(new { ok = false, error = "That isn't a PNG, JPG, GIF or WebP image we can read (or it's too large)." });
|
||
return Ok(new { ok = true, name, url = AttachmentUrl(name) });
|
||
}
|
||
|
||
// The × on an unsent screenshot: frees it (and its slot in the unsent-upload cap) right away.
|
||
[HttpDelete("/api/site/support/upload/{name}")]
|
||
public IActionResult SupportUploadDelete(string name)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
return Ok(new { ok = SupportDB.DeleteUnsent(account.Id, name ?? "") });
|
||
}
|
||
|
||
// A screenshot: its uploader, the ticket's owner, or staff.
|
||
[HttpGet("/api/site/support/attachment/{name}")]
|
||
public IActionResult SupportAttachment(string name)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized();
|
||
if (!System.Text.RegularExpressions.Regex.IsMatch(name, @"^[0-9a-f]{32}\.(png|jpg|gif|webp)$")) return NotFound();
|
||
var a = SupportDB.GetAttachment(name);
|
||
if (a == null) return NotFound();
|
||
bool allowed = a.UploaderId == account.Id || IsStaff(account.Id)
|
||
|| (a.TicketId != 0 && SupportDB.Get(a.TicketId)?.AccountId == account.Id);
|
||
if (!allowed) return StatusCode(403);
|
||
string path = Path.Combine(SupportDB.UploadDir, name);
|
||
if (!System.IO.File.Exists(path)) return NotFound();
|
||
Response.Headers["Cache-Control"] = "private, max-age=86400";
|
||
return PhysicalFile(path, a.ContentType);
|
||
}
|
||
|
||
// Every staff member's open site tabs re-read their bell ("N tickets waiting for staff").
|
||
private static List<ulong>? _staffIds;
|
||
private static DateTime _staffIdsAt;
|
||
private static void NotifyStaff()
|
||
{
|
||
try
|
||
{
|
||
if (_staffIds == null || (DateTime.UtcNow - _staffIdsAt).TotalMinutes > 5)
|
||
{
|
||
_staffIds = PlayerDB.PlayerDBFile.GetCollection<player_data>("players").FindAll()
|
||
.Where(p => IsStaffFlag(p.dev_Flag)).Select(p => p.playerid).ToList();
|
||
_staffIdsAt = DateTime.UtcNow;
|
||
}
|
||
foreach (var id in _staffIds) SiteNotifications.Notify(id);
|
||
}
|
||
catch { }
|
||
}
|
||
|
||
public static bool IsSupportStaff(ulong id) => IsStaffFlag(PlayerDB.GetFullAccount(id)?.dev_Flag ?? DevFlag.none);
|
||
|
||
// GET /api/site/me
|
||
// 200 with the account when signed in, 401 when not. Every page calls this on load to
|
||
// decide whether to render the profile chip or the "Log in" button.
|
||
[HttpGet("/api/site/me")]
|
||
public IActionResult Me()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
|
||
var full = PlayerDB.GetFullAccount(account.Id);
|
||
if (full == null) return NotFound(new { ok = false, error = "account not found" });
|
||
|
||
// The owner sees their own email (it is never in PublicUser, which other people get).
|
||
// `admin`: a dev account on an IP that can reach the admin panel - shows the quick-admin
|
||
// button on profiles and rooms (SiteAdminController).
|
||
return Ok(new { ok = true, user = PublicUser(full), email = full.player?.Email ?? "",
|
||
admin = SiteAdminController.ShowsAdmin(HttpContext, account.Id) });
|
||
}
|
||
|
||
public class EmailBody { public string? email { get; set; } }
|
||
|
||
// Set or clear the account's email from the website's Email settings. Stored on the same
|
||
// field the signup form and the in-game acc/account/me/email write, so the game's own
|
||
// account screen shows it too (SelfAccountUpdate carries it live). Blank clears it. One
|
||
// address per account: a different account already using it is refused, so an email can
|
||
// later serve as a recovery / login identifier without ambiguity.
|
||
[HttpPost("/api/site/email")]
|
||
public IActionResult SetEmail([FromBody] EmailBody? body)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
string email = (body?.email ?? "").Trim();
|
||
if (email.Length > 0)
|
||
{
|
||
if (email.Length > 254 ||
|
||
!System.Text.RegularExpressions.Regex.IsMatch(email, @"^[^@\s]+@[^@\s]+\.[^@\s]+$"))
|
||
return BadRequest(new { ok = false, error = "Enter a valid email address." });
|
||
ulong other = PlayerDB.GetAccountIdByEmail(email);
|
||
if (other != 0 && other != account.Id)
|
||
return Conflict(new { ok = false, error = "That email is already used by another account." });
|
||
}
|
||
if (!PlayerDB.SetPlayerEmail(email.Length == 0 ? null : email, account.Id))
|
||
return StatusCode(500, new { ok = false, error = "Could not save your email." });
|
||
Console.WriteLine($"[site] {account.Id} {(email.Length == 0 ? "cleared their email" : "set their email")}");
|
||
Campus_live_rewrite.api.server.Notifications.FireAndForget(
|
||
Campus_live_rewrite.api.server.Notifications.PushAccountUpdate(account.Id), $"email-update {account.Id}");
|
||
return Ok(new { ok = true, email });
|
||
}
|
||
|
||
public class PasswordBody
|
||
{
|
||
public string? current_password { get; set; }
|
||
public string? new_password { get; set; }
|
||
public string? confirm_password { get; set; }
|
||
}
|
||
|
||
// POST /api/site/password {current_password, new_password, confirm_password} - Settings > Password.
|
||
// This used to be a button that only said "saved". The current password is checked with the same helper
|
||
// the login uses (so wrong guesses count towards the same lockout), then the new one is hashed into the
|
||
// players db by PlayerDB.SetPlayerPassword - the SAME field the game logs in with, so it changes there
|
||
// too. Same 6-64 length rule as signup.
|
||
[HttpPost("/api/site/password")]
|
||
public IActionResult ChangeMyPassword([FromBody] PasswordBody? body)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
|
||
string cur = body?.current_password ?? "";
|
||
string pw = body?.new_password ?? "";
|
||
string confirm = body?.confirm_password ?? "";
|
||
if (cur.Length == 0) return BadRequest(new { ok = false, error = "Enter your current password." });
|
||
if (pw.Length < 6 || pw.Length > 64) return BadRequest(new { ok = false, error = "Password must be 6-64 characters." });
|
||
if (pw != confirm) return BadRequest(new { ok = false, error = "The passwords don't match." });
|
||
if (pw == cur) return BadRequest(new { ok = false, error = "Your new password is the same as the current one." });
|
||
|
||
string? username = PlayerDB.GetFullAccount(account.Id)?.player?.Username;
|
||
if (string.IsNullOrEmpty(username)) return StatusCode(500, new { ok = false, error = "Could not find your account." });
|
||
|
||
var check = PlayerDB.GetAccountPassword(username, cur, isAdminPanel: false);
|
||
if (!check.success || check.accid != account.Id)
|
||
return BadRequest(new { ok = false, error = "Your current password is wrong." });
|
||
|
||
PlayerDB.SetPlayerPassword(pw, account.Id, log: true);
|
||
return Ok(new { ok = true });
|
||
}
|
||
|
||
// ---- Discord account linking (Settings > Discord tab) ------------------------------
|
||
// A dedicated, ISOLATED flow: this hands the signed-in player a short code; they run
|
||
// `/link <code>` with the Campus Discord bot, which binds their Discord id via
|
||
// PlayerDB.SetDiscordLink. It shares NOTHING with the admin session gate (AdminGate) - a
|
||
// Discord link records only an association and can never grant admin/dev access. See
|
||
// DiscordLinkCodes + BotCommands./link.
|
||
|
||
// GET /api/site/discord/status -> current link state for the signed-in account.
|
||
[HttpGet("/api/site/discord/status")]
|
||
public IActionResult DiscordStatus()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
|
||
var full = PlayerDB.GetFullAccount(account.Id);
|
||
ulong did = full?.player_Extra?.DiscordId ?? 0;
|
||
return Ok(new
|
||
{
|
||
ok = true,
|
||
linked = did != 0,
|
||
discordId = did == 0 ? "" : did.ToString(),
|
||
discordUsername = full?.player_Extra?.DiscordUsername ?? ""
|
||
});
|
||
}
|
||
|
||
// POST /api/site/discord/link/start -> a fresh 10-minute code to type into the bot's /link.
|
||
[HttpPost("/api/site/discord/link/start")]
|
||
public IActionResult DiscordLinkStart()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
|
||
var (code, ttl) = Campus_live_rewrite.api.server.DiscordLinkCodes.Generate(account.Id);
|
||
Console.WriteLine($"[discord-link] account {account.Id} started a link (code issued, {ttl}s)");
|
||
return Ok(new { ok = true, code, ttlSeconds = ttl });
|
||
}
|
||
|
||
// GET /api/site/discord/oauth/start -> the "Link Discord" button. Sends the signed-in user
|
||
// to Discord's authorize page; the callback (DiscordController, state="link:") links their
|
||
// Discord to THIS account and returns them to /settings. Reuses the same Discord app +
|
||
// registered redirect URI as the admin login, but the "link:" state routes it to the
|
||
// link branch, so it never mints an admin session.
|
||
[HttpGet("/api/site/discord/oauth/start")]
|
||
public IActionResult DiscordOAuthStart()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Redirect("/login");
|
||
|
||
var (code, _) = Campus_live_rewrite.api.server.DiscordLinkCodes.Generate(account.Id);
|
||
string state = "link:" + code;
|
||
string url = "https://discord.com/api/oauth2/authorize"
|
||
+ "?client_id=" + DiscordController.ClientId
|
||
+ "&redirect_uri=" + Uri.EscapeDataString(DiscordController.RedirectUri)
|
||
+ "&response_type=code"
|
||
+ "&scope=" + Uri.EscapeDataString("identify")
|
||
+ "&state=" + Uri.EscapeDataString(state);
|
||
return Redirect(url);
|
||
}
|
||
|
||
// POST /api/site/discord/unlink -> remove the Discord link from the signed-in account.
|
||
[HttpPost("/api/site/discord/unlink")]
|
||
public IActionResult DiscordUnlink()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
|
||
PlayerDB.SetDiscordLink(account.Id, 0, null);
|
||
return Ok(new { ok = true });
|
||
}
|
||
|
||
// ---- Spotify linking (Settings > Services > Spotify) --------------------------------
|
||
// OAuth against the Spotify app in Data/spotify_app.json (see SpotifyLink). The link
|
||
// records a refresh token + the player's "show my Spotify to" choice; the profile page and
|
||
// friends list show what they are listening to, to whoever that choice allows.
|
||
|
||
// ---- linked socials (Settings > Services) ----------------------------------------
|
||
// GET /api/site/social/status every provider's state for the signed-in account
|
||
// GET /api/site/social/{provider}/start sign in with the service (redirect)
|
||
// GET /api/site/social/{provider}/callback the service sends the player back here
|
||
// POST /api/site/social/{provider}/unlink
|
||
// POST /api/site/social/{provider}/show {show:bool} the "show on my profile" switch
|
||
[HttpGet("/api/site/social/status")]
|
||
public IActionResult SocialStatus()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
var full = PlayerDB.GetFullAccount(account.Id);
|
||
return Ok(new { ok = true, providers = SocialLinks.Status(account.Id, full?.player_Extra), preview = SocialLinks.ProfileRows(account.Id, full?.player_Extra) });
|
||
}
|
||
|
||
[HttpGet("/api/site/social/{provider}/start")]
|
||
public IActionResult SocialStart(string provider)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Redirect("/login");
|
||
provider = (provider ?? "").ToLowerInvariant();
|
||
var p = SocialLinks.Find(provider);
|
||
if (p == null) return NotFound();
|
||
if (provider == "discord") return Redirect("/api/site/discord/oauth/start");
|
||
if (provider == "spotify") return Redirect("/api/site/spotify/oauth/start");
|
||
string? url = SocialLinks.StartUrl(account.Id, provider);
|
||
if (url == null) return Redirect("/settings?social=" + provider + ":unconfigured");
|
||
return Redirect(url);
|
||
}
|
||
|
||
[HttpGet("/api/site/social/{provider}/callback")]
|
||
public async Task<IActionResult> SocialCallback(string provider)
|
||
{
|
||
provider = (provider ?? "").ToLowerInvariant();
|
||
if (SocialLinks.Find(provider) == null) return NotFound();
|
||
string outcome = await SocialLinks.Complete(provider, Request.Query, CurrentUser()?.Id ?? 0);
|
||
return Redirect(ConfigCampus.SiteUrl + "/settings?social=" + provider + ":" + outcome);
|
||
}
|
||
|
||
[HttpPost("/api/site/social/{provider}/unlink")]
|
||
public IActionResult SocialUnlink(string provider)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
provider = (provider ?? "").ToLowerInvariant();
|
||
if (SocialLinks.Find(provider) == null || provider == "discord" || provider == "spotify") return BadRequest(new { ok = false, error = "unknown provider" });
|
||
SocialLinks.Unlink(account.Id, provider);
|
||
SiteNotifications.ProfileChanged(account.Id);
|
||
return Ok(new { ok = true });
|
||
}
|
||
|
||
public class SocialShowBody { public bool? show { get; set; } }
|
||
|
||
[HttpPost("/api/site/social/{provider}/show")]
|
||
public IActionResult SocialShow(string provider, [FromBody] SocialShowBody? body)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
provider = (provider ?? "").ToLowerInvariant();
|
||
if (SocialLinks.Find(provider) == null) return BadRequest(new { ok = false, error = "unknown provider" });
|
||
SocialLinks.SetShow(account.Id, provider, body?.show ?? true);
|
||
SiteNotifications.ProfileChanged(account.Id);
|
||
return Ok(new { ok = true, show = body?.show ?? true });
|
||
}
|
||
|
||
[HttpGet("/api/site/spotify/status")]
|
||
public async Task<IActionResult> SpotifyStatus()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
var link = SpotifyLink.Get(account.Id);
|
||
object? now = link == null ? null : await SpotifyLink.PayloadFor(account.Id, account.Id);
|
||
return Ok(new
|
||
{
|
||
ok = true,
|
||
configured = SpotifyLink.Configured,
|
||
linked = link != null,
|
||
broken = link?.Broken ?? false,
|
||
notAllowed = link?.NotAllowed ?? false,
|
||
displayName = link?.DisplayName ?? "",
|
||
profileUrl = link?.ProfileUrl ?? "",
|
||
visibility = link?.Visibility ?? SpotifyLink.VisFriends,
|
||
now_playing = now
|
||
});
|
||
}
|
||
|
||
[HttpGet("/api/site/spotify/oauth/start")]
|
||
public IActionResult SpotifyOAuthStart()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Redirect("/login");
|
||
string? url = SpotifyLink.StartUrl(account.Id);
|
||
if (url == null) return Redirect("/settings?spotify=unconfigured");
|
||
return Redirect(url);
|
||
}
|
||
|
||
[HttpGet("/api/site/spotify/callback")]
|
||
public async Task<IActionResult> SpotifyCallback([FromQuery] string? code, [FromQuery] string? state, [FromQuery] string? error)
|
||
{
|
||
string outcome = await SpotifyLink.Complete(code, state, error);
|
||
return Redirect(ConfigCampus.SiteUrl + "/settings?spotify=" + outcome);
|
||
}
|
||
|
||
[HttpPost("/api/site/spotify/unlink")]
|
||
public IActionResult SpotifyUnlink()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
SpotifyLink.Unlink(account.Id);
|
||
return Ok(new { ok = true });
|
||
}
|
||
|
||
// POST /api/site/spotify/visibility {visibility: 0 everyone | 1 friends | 2 favourites | 3 no one}
|
||
[HttpPost("/api/site/spotify/visibility")]
|
||
public async Task<IActionResult> SpotifyVisibility()
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
int vis = -1;
|
||
try
|
||
{
|
||
var f = RoomModeration.Fields(Request); // form, query or JSON body
|
||
string raw = RoomModeration.Str(f, "visibility", "value") ?? "";
|
||
if (!int.TryParse(raw, out vis))
|
||
vis = raw.ToLowerInvariant() switch { "everyone" => 0, "friends" => 1, "favourites" or "favorites" => 2, "none" or "noone" or "nobody" => 3, _ => -1 };
|
||
}
|
||
catch { }
|
||
await Task.CompletedTask;
|
||
if (vis < 0 || vis > 3) return BadRequest(new { ok = false, error = "visibility must be 0-3" });
|
||
SpotifyLink.SetVisibility(account.Id, vis);
|
||
return Ok(new { ok = true, visibility = vis });
|
||
}
|
||
|
||
// GET /api/site/spotify/nowplaying/{handle} - what that player is listening to, if their
|
||
// setting lets the signed-in viewer see it. {ok, now_playing: null|{...}}. Polled by the
|
||
// profile page; Spotify itself is asked at most every 10 s per player.
|
||
[HttpGet("/api/site/spotify/nowplaying/{handle}")]
|
||
public async Task<IActionResult> SpotifyNowPlaying(string handle)
|
||
{
|
||
var viewer = CurrentUser();
|
||
if (viewer == null) return Ok(new { ok = true, now_playing = (object?)null });
|
||
ulong owner = ulong.TryParse(handle, out var n) ? n : PlayerDB.GetAccountIdByUsernameCI(handle.TrimStart('@'));
|
||
if (owner == 0) return NotFound(new { ok = false, error = "no such player" });
|
||
return Ok(new { ok = true, now_playing = await SpotifyLink.PayloadFor(owner, viewer.Id) });
|
||
}
|
||
|
||
// ---- search (ported from server.py) -----------------------------------------------
|
||
|
||
// GET /api/search/rooms?query=
|
||
// Flask fetched https://camprec.net/rooms/search with a stored bearer token. We
|
||
// are that server, so read RoomDB directly.
|
||
//
|
||
// Visibility goes through RoomDB.CanPlayerSeeRoom with the site visitor's account id
|
||
// (0 when signed out) rather than a hand-rolled filter, so the website can never show
|
||
// a room the game would hide. Dorms are dropped on top of that: they pass the check
|
||
// for their owner, and a personal dorm has no business in a public site search.
|
||
[HttpGet("/api/search/rooms")]
|
||
public IActionResult SearchRooms(string? query)
|
||
{
|
||
query = (query ?? "").Trim();
|
||
if (query.Length == 0) return Ok(new { ok = true, results = Array.Empty<object>() });
|
||
|
||
try
|
||
{
|
||
ulong viewerId = CurrentUser()?.Id ?? 0UL;
|
||
|
||
var rooms = RoomDB.Search(query) ?? new List<RoomDBClasses.RoomRoot>();
|
||
var visible = rooms
|
||
.Where(r => r != null && !r.IsDorm && RoomDB.CanPlayerSeeRoom(r, viewerId))
|
||
.Take(30)
|
||
.Select(r => new
|
||
{
|
||
RoomId = r.RoomId,
|
||
Name = r.Name,
|
||
ImageName = r.ImageName,
|
||
Description = r.Description,
|
||
Stats = new { VisitCount = r.Stats?.VisitCount ?? 0 }
|
||
})
|
||
.ToList();
|
||
|
||
return Ok(new { ok = true, results = visible });
|
||
}
|
||
catch (Exception ex)
|
||
{
|
||
Console.WriteLine($"[site] room search failed: {ex.Message}");
|
||
return StatusCode(500, new { ok = false, error = "search failed" });
|
||
}
|
||
}
|
||
|
||
// GET /api/search/players?name=
|
||
[HttpGet("/api/search/players")]
|
||
public IActionResult SearchPlayers(string? name)
|
||
{
|
||
name = (name ?? "").Trim();
|
||
if (name.Length == 0) return Ok(new { ok = true, results = Array.Empty<object>() });
|
||
|
||
try
|
||
{
|
||
var matches = PlayerDB.Search(name) ?? new List<account_data>();
|
||
var results = matches
|
||
.Take(30)
|
||
.Select(a => new
|
||
{
|
||
accountId = a.accountId,
|
||
username = a.username,
|
||
displayName = a.displayName,
|
||
profileImage = a.profileImage
|
||
})
|
||
.ToList();
|
||
|
||
return Ok(new { ok = true, results });
|
||
}
|
||
catch (Exception ex)
|
||
{
|
||
Console.WriteLine($"[site] player search failed: {ex.Message}");
|
||
return StatusCode(500, new { ok = false, error = "search failed" });
|
||
}
|
||
}
|
||
|
||
// ---- profile image ----------------------------------------------------------------
|
||
|
||
// POST /api/profile-image (multipart field "image")
|
||
//
|
||
// Flask re-encoded the upload and pushed it to an EXTERNAL image host, signing the
|
||
// request with an HMAC key it kept in token.json on disk. That whole path is gone:
|
||
// Campus already stores and serves player images itself out of Data/Images, so the
|
||
// file is written locally and the account row is pointed at it.
|
||
//
|
||
// Requires a signed-in site session - without it anyone could rewrite any avatar.
|
||
[HttpPost("/api/profile-image")]
|
||
[RequestSizeLimit(8 * 1024 * 1024)]
|
||
public async Task<IActionResult> UploadProfileImage(IFormFile? image)
|
||
{
|
||
var account = CurrentUser();
|
||
if (account == null) return Unauthorized(new { ok = false, error = "not signed in" });
|
||
if (PlayerDB.IsProfileLocked(account.Id, PlayerDB.ProfileLock.Picture))
|
||
return BadRequest(new { ok = false, error = PlayerDB.ProfileLockMessage(PlayerDB.ProfileLock.Picture) });
|
||
|
||
if (image == null || image.Length == 0)
|
||
return BadRequest(new { ok = false, error = "no image uploaded" });
|
||
if (image.Length > 8 * 1024 * 1024)
|
||
return BadRequest(new { ok = false, error = "image is larger than 8MB" });
|
||
|
||
// Rate limit BEFORE decoding: a 8MB image decode is the expensive part, so a
|
||
// rejected caller must never reach it. Two limits, because either alone is weak -
|
||
// the cooldown stops bursts, the quota stops a patient script uploading every
|
||
// 11 seconds forever. Keyed on account id, not IP: the endpoint already requires
|
||
// a session, and an IP key would punish everyone behind one NAT.
|
||
string rlKey = $"pfp:{account.Id}";
|
||
if (!RateLimit.TryConsume(rlKey, cooldownSeconds: 10, out int retryAfter))
|
||
{
|
||
Response.Headers["Retry-After"] = retryAfter.ToString();
|
||
return StatusCode(429, new { ok = false, error = $"Slow down - try again in {retryAfter}s." });
|
||
}
|
||
if (!RateLimit.TryConsumeQuota(rlKey, maxInWindow: 10, windowSeconds: 3600, out int quotaRetry))
|
||
{
|
||
Response.Headers["Retry-After"] = quotaRetry.ToString();
|
||
return StatusCode(429, new
|
||
{
|
||
ok = false,
|
||
error = $"Too many profile picture changes. Try again in {quotaRetry / 60 + 1} minutes."
|
||
});
|
||
}
|
||
|
||
try
|
||
{
|
||
// Decode + re-encode rather than trusting the upload. This is the check that
|
||
// matters: a file is only written if ImageSharp could actually parse it as an
|
||
// image, so a renamed .exe or a polyglot never lands in the images folder. It
|
||
// also strips EXIF (location data) as a side effect.
|
||
using var src = await Image.LoadAsync<Rgba32>(image.OpenReadStream());
|
||
|
||
// Cap the stored size so one upload can't fill the disk with a 10000x10000 PNG,
|
||
// but keep it large enough to look crisp on the profile page (1024, up from 512 -
|
||
// 512 was the visible "compression" on website-uploaded pictures). Re-encoding is
|
||
// to PNG, which is lossless; this Max resize is the only quality-affecting step,
|
||
// and it only ever DOWNscales (never upscales a small in-game capture).
|
||
if (src.Width > 1024 || src.Height > 1024)
|
||
{
|
||
src.Mutate(x => x.Resize(new ResizeOptions
|
||
{
|
||
Mode = ResizeMode.Max,
|
||
Size = new Size(1024, 1024)
|
||
}));
|
||
}
|
||
|
||
// Name is server-generated - never derived from the uploaded filename, which
|
||
// is attacker-controlled and would otherwise be a path-traversal write.
|
||
string imageName = $"pfp_{account.Id}_{Guid.NewGuid():N}.png";
|
||
string dir = Path.Combine(Environment.CurrentDirectory, "Data", "Images", "player_images");
|
||
Directory.CreateDirectory(dir);
|
||
|
||
await src.SaveAsPngAsync(Path.Combine(dir, imageName));
|
||
|
||
// Note what is NOT happening here: no row is written to ImageMetadataDB. A
|
||
// profile picture is not a photo, so it must not appear in the photo feeds.
|
||
// (The feeds also filter to ShareCamera, so this is belt and braces.)
|
||
string? previous = PlayerDB.GetFullAccount(account.Id)?.player?.profileImage;
|
||
PlayerDB.SetPlayerImageName(imageName, account.Id);
|
||
|
||
// Live push: redraw the player's profile in-game (and for anyone viewing it) with
|
||
// the new picture - no relog. AccountUpdate is the redraw notification; immediate is
|
||
// safe here because the GAME client didn't make this request, so there's no in-flight
|
||
// image load to double-complete (the self-service double-load dorm-drop [385120]).
|
||
Campus_live_rewrite.api.server.Notifications.FireAndForget(
|
||
Campus_live_rewrite.api.server.Notifications.PushAccountUpdate(account.Id), "site pfp refresh");
|
||
|
||
// Delete the picture this one replaces, so changing your avatar does not leave
|
||
// a copy behind every time. Strictly scoped to files this endpoint generated
|
||
// for THIS account (the "pfp_<id>_" prefix): a profile picture set in-game
|
||
// points at a shared saved-image that other records may still reference, and
|
||
// deleting one of those would blank it elsewhere.
|
||
if (!string.IsNullOrWhiteSpace(previous)
|
||
&& previous != imageName
|
||
&& previous.StartsWith($"pfp_{account.Id}_", StringComparison.Ordinal)
|
||
&& !previous.Contains('/') && !previous.Contains('\\'))
|
||
{
|
||
try
|
||
{
|
||
string old = Path.Combine(dir, previous);
|
||
if (System.IO.File.Exists(old)) System.IO.File.Delete(old);
|
||
}
|
||
catch (Exception ex)
|
||
{
|
||
// Never fail the upload over cleanup - the new picture is already live.
|
||
Console.WriteLine($"[site] could not remove old pfp '{previous}': {ex.Message}");
|
||
}
|
||
}
|
||
|
||
// ImagesController serves Data/Images/player_images at /img/<name>.
|
||
return Ok(new { ok = true, imageName, url = "/img/" + imageName });
|
||
}
|
||
catch (UnknownImageFormatException)
|
||
{
|
||
return BadRequest(new { ok = false, error = "that file is not a supported image" });
|
||
}
|
||
catch (Exception ex)
|
||
{
|
||
Console.WriteLine($"[site] profile image upload failed: {ex.Message}");
|
||
return StatusCode(500, new { ok = false, error = "could not save the image" });
|
||
}
|
||
}
|
||
|
||
// GET /api/health - kept so anything that probed the Flask health route still works.
|
||
[HttpGet("/api/health")]
|
||
public IActionResult Health() => Ok(new { ok = true });
|
||
|
||
public class SiteCreds
|
||
{
|
||
public string? username { get; set; }
|
||
public string? password { get; set; }
|
||
}
|
||
|
||
public class SiteRegister
|
||
{
|
||
public string? username { get; set; }
|
||
public string? display_name { get; set; }
|
||
public string? password { get; set; }
|
||
public string? confirm_password { get; set; }
|
||
public string? email { get; set; }
|
||
// Date of birth (YYYY-MM-DD from the form's <input type=date>). Required: under-13 gets a
|
||
// random @name + a junior account.
|
||
public string? birthday { get; set; }
|
||
// Hidden honeypot field - must stay empty. Bots that autofill everything trip it.
|
||
public string? website { get; set; }
|
||
}
|
||
}
|
||
}
|