397 lines
13 KiB
C++
397 lines
13 KiB
C++
#include "services/AdminService.h"
|
|
|
|
#include "common/Validation.h"
|
|
#include "repositories/Sql.h"
|
|
#include "services/UserService.h"
|
|
|
|
#include <drogon/drogon.h>
|
|
|
|
#include <algorithm>
|
|
|
|
namespace visione::services
|
|
{
|
|
namespace
|
|
{
|
|
Json::Value failure(const std::string &code)
|
|
{
|
|
Json::Value body;
|
|
body["ok"] = false;
|
|
body["error"] = code;
|
|
return body;
|
|
}
|
|
|
|
Json::Value success()
|
|
{
|
|
Json::Value body;
|
|
body["ok"] = true;
|
|
return body;
|
|
}
|
|
|
|
int boundedPage(const std::optional<std::string> &value)
|
|
{
|
|
if (!value)
|
|
{
|
|
return 1;
|
|
}
|
|
try
|
|
{
|
|
return std::max(1, std::stoi(*value));
|
|
}
|
|
catch (...)
|
|
{
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
int boundedPerPage(const std::optional<std::string> &value)
|
|
{
|
|
if (!value)
|
|
{
|
|
return 50;
|
|
}
|
|
try
|
|
{
|
|
return std::clamp(std::stoi(*value), 1, 100);
|
|
}
|
|
catch (...)
|
|
{
|
|
return 50;
|
|
}
|
|
}
|
|
} // namespace
|
|
|
|
Json::Value AdminService::listCategories()
|
|
{
|
|
auto response = success();
|
|
response["categories"] = repositories::resultToJson(
|
|
drogon::app().getDbClient()->execSqlSync(
|
|
"SELECT * FROM report_categories ORDER BY name"));
|
|
return response;
|
|
}
|
|
|
|
Json::Value AdminService::createCategory(const auth::UserContext &user,
|
|
const Json::Value &body)
|
|
{
|
|
if (!auth::isAdmin(user) || !validation::hasString(body, "name"))
|
|
{
|
|
return failure("forbidden");
|
|
}
|
|
|
|
drogon::app().getDbClient()->execSqlSync(
|
|
"INSERT INTO report_categories (name, description) VALUES (?, ?)",
|
|
body["name"].asString(),
|
|
body.get("description", "").asString());
|
|
return success();
|
|
}
|
|
|
|
Json::Value AdminService::listAreas()
|
|
{
|
|
auto response = success();
|
|
response["areas"] = repositories::resultToJson(
|
|
drogon::app().getDbClient()->execSqlSync("SELECT * FROM areas ORDER BY name"));
|
|
return response;
|
|
}
|
|
|
|
Json::Value AdminService::createArea(const auth::UserContext &user,
|
|
const Json::Value &body)
|
|
{
|
|
if (!auth::isAdmin(user) || !validation::hasString(body, "name") ||
|
|
!body["boundary_geojson"].isObject())
|
|
{
|
|
return failure("invalid_area");
|
|
}
|
|
|
|
Json::StreamWriterBuilder writer;
|
|
drogon::app().getDbClient()->execSqlSync(
|
|
"INSERT INTO areas (name, description, boundary_geojson) "
|
|
"VALUES (?, ?, CAST(? AS JSON))",
|
|
body["name"].asString(),
|
|
body.get("description", "").asString(),
|
|
Json::writeString(writer, body["boundary_geojson"]));
|
|
return success();
|
|
}
|
|
|
|
Json::Value AdminService::listTeams()
|
|
{
|
|
auto response = success();
|
|
response["teams"] = repositories::resultToJson(
|
|
drogon::app().getDbClient()->execSqlSync(
|
|
"SELECT t.*, tc.name AS category_name, a.name AS area_name "
|
|
"FROM teams t JOIN team_categories tc ON tc.id = t.team_category_id "
|
|
"LEFT JOIN areas a ON a.id = t.area_id ORDER BY t.name"));
|
|
return response;
|
|
}
|
|
|
|
Json::Value AdminService::createTeam(const auth::UserContext &user,
|
|
const Json::Value &body)
|
|
{
|
|
if (!auth::isAdmin(user) || !validation::hasString(body, "name") ||
|
|
!validation::hasNumber(body, "team_category_id"))
|
|
{
|
|
return failure("invalid_team");
|
|
}
|
|
|
|
if (body["area_id"].isNumeric())
|
|
{
|
|
drogon::app().getDbClient()->execSqlSync(
|
|
"INSERT INTO teams (team_category_id, area_id, name, description) "
|
|
"VALUES (?, ?, ?, ?)",
|
|
body["team_category_id"].asInt64(),
|
|
body["area_id"].asInt64(),
|
|
body["name"].asString(),
|
|
body.get("description", "").asString());
|
|
}
|
|
else
|
|
{
|
|
drogon::app().getDbClient()->execSqlSync(
|
|
"INSERT INTO teams (team_category_id, name, description) VALUES (?, ?, ?)",
|
|
body["team_category_id"].asInt64(),
|
|
body["name"].asString(),
|
|
body.get("description", "").asString());
|
|
}
|
|
return success();
|
|
}
|
|
|
|
Json::Value AdminService::overviewStats(const auth::UserContext &user)
|
|
{
|
|
if (!auth::canManageReports(user))
|
|
{
|
|
return failure("forbidden");
|
|
}
|
|
|
|
auto db = drogon::app().getDbClient();
|
|
auto response = success();
|
|
response["reports_by_status"] = repositories::resultToJson(db->execSqlSync(
|
|
"SELECT status, COUNT(*) AS total FROM reports GROUP BY status"));
|
|
response["reports_by_area"] = repositories::resultToJson(db->execSqlSync(
|
|
"SELECT COALESCE(a.name, 'Unassigned') AS area, COUNT(*) AS total "
|
|
"FROM reports r LEFT JOIN areas a ON a.id = r.area_id "
|
|
"GROUP BY COALESCE(a.name, 'Unassigned')"));
|
|
response["avg_resolution_hours"] = repositories::resultToJson(db->execSqlSync(
|
|
"SELECT AVG(TIMESTAMPDIFF(HOUR, created_at, updated_at)) AS value "
|
|
"FROM reports WHERE status IN ('RESOLVED', 'CLOSED')"));
|
|
response["reports_by_category"] = repositories::resultToJson(db->execSqlSync(
|
|
"SELECT c.name AS category, COUNT(*) AS total "
|
|
"FROM reports r JOIN report_categories c ON c.id = r.category_id "
|
|
"GROUP BY c.name ORDER BY total DESC"));
|
|
response["reports_by_team"] = repositories::resultToJson(db->execSqlSync(
|
|
"SELECT t.name AS team, COUNT(*) AS total "
|
|
"FROM assignments ass JOIN teams t ON t.id = ass.team_id "
|
|
"GROUP BY t.name ORDER BY total DESC"));
|
|
response["monthly_reports"] = repositories::resultToJson(db->execSqlSync(
|
|
"SELECT DATE_FORMAT(created_at, '%Y-%m') AS month, COUNT(*) AS total "
|
|
"FROM reports GROUP BY DATE_FORMAT(created_at, '%Y-%m') "
|
|
"ORDER BY month DESC LIMIT 12"));
|
|
response["avg_resolution_hours_by_category"] =
|
|
repositories::resultToJson(db->execSqlSync(
|
|
"SELECT c.name AS category, "
|
|
"AVG(TIMESTAMPDIFF(HOUR, r.created_at, r.updated_at)) AS value "
|
|
"FROM reports r JOIN report_categories c ON c.id = r.category_id "
|
|
"WHERE r.status IN ('RESOLVED', 'CLOSED') "
|
|
"GROUP BY c.name ORDER BY c.name"));
|
|
response["avg_resolution_hours_by_area"] =
|
|
repositories::resultToJson(db->execSqlSync(
|
|
"SELECT COALESCE(a.name, 'Unassigned') AS area, "
|
|
"AVG(TIMESTAMPDIFF(HOUR, r.created_at, r.updated_at)) AS value "
|
|
"FROM reports r LEFT JOIN areas a ON a.id = r.area_id "
|
|
"WHERE r.status IN ('RESOLVED', 'CLOSED') "
|
|
"GROUP BY COALESCE(a.name, 'Unassigned') ORDER BY area"));
|
|
return response;
|
|
}
|
|
|
|
Json::Value AdminService::listModeration(
|
|
const auth::UserContext &user,
|
|
const std::optional<std::string> &status,
|
|
const std::optional<std::string> &page,
|
|
const std::optional<std::string> &perPage)
|
|
{
|
|
if (!auth::canManageReports(user))
|
|
{
|
|
return failure("forbidden");
|
|
}
|
|
const auto pageValue = boundedPage(page);
|
|
const auto perPageValue = boundedPerPage(perPage);
|
|
const auto offset = (pageValue - 1) * perPageValue;
|
|
const auto statusValue = status.value_or("");
|
|
|
|
auto response = success();
|
|
response["page"] = pageValue;
|
|
response["per_page"] = perPageValue;
|
|
response["flags"] = repositories::resultToJson(
|
|
drogon::app().getDbClient()->execSqlSync(
|
|
"SELECT f.*, creator.email AS created_by_email, "
|
|
"resolver.email AS resolved_by_email "
|
|
"FROM moderation_flags f "
|
|
"JOIN users creator ON creator.id = f.created_by_user_id "
|
|
"LEFT JOIN users resolver ON resolver.id = f.resolved_by_user_id "
|
|
"WHERE (? = '' OR f.status = ?) "
|
|
"ORDER BY f.created_at DESC LIMIT ? OFFSET ?",
|
|
statusValue,
|
|
statusValue,
|
|
perPageValue,
|
|
offset));
|
|
return response;
|
|
}
|
|
|
|
Json::Value AdminService::updateModeration(const auth::UserContext &user,
|
|
long long flagId,
|
|
const Json::Value &body)
|
|
{
|
|
if (!auth::canManageReports(user))
|
|
{
|
|
return failure("forbidden");
|
|
}
|
|
if (!validation::hasString(body, "status"))
|
|
{
|
|
return failure("invalid_moderation_payload");
|
|
}
|
|
const auto status = body["status"].asString();
|
|
if (status != "RESOLVED" && status != "DISMISSED")
|
|
{
|
|
return failure("invalid_moderation_status");
|
|
}
|
|
|
|
auto db = drogon::app().getDbClient();
|
|
const auto flag = db->execSqlSync(
|
|
"SELECT id, report_id FROM moderation_flags WHERE id = ?",
|
|
flagId);
|
|
if (flag.empty())
|
|
{
|
|
return failure("moderation_flag_not_found");
|
|
}
|
|
|
|
db->execSqlSync(
|
|
"UPDATE moderation_flags "
|
|
"SET status = ?, resolved_by_user_id = ?, resolution_note = ?, "
|
|
"resolved_at = NOW() WHERE id = ?",
|
|
status,
|
|
user.id,
|
|
body.get("resolution_note", "").asString(),
|
|
flagId);
|
|
|
|
if (body.get("reject_report", false).asBool())
|
|
{
|
|
const auto reportId = flag[0]["report_id"].as<long long>();
|
|
const auto current = db->execSqlSync(
|
|
"SELECT status, user_id FROM reports WHERE id = ?",
|
|
reportId);
|
|
if (!current.empty() && current[0]["status"].as<std::string>() != "REJECTED")
|
|
{
|
|
const auto oldStatus = current[0]["status"].as<std::string>();
|
|
db->execSqlSync("UPDATE reports SET status = 'REJECTED' WHERE id = ?",
|
|
reportId);
|
|
db->execSqlSync(
|
|
"INSERT INTO report_status_history "
|
|
"(report_id, old_status, new_status, changed_by_user_id, note) "
|
|
"VALUES (?, ?, 'REJECTED', ?, ?)",
|
|
reportId,
|
|
oldStatus,
|
|
user.id,
|
|
body.get("resolution_note", "Rejected after moderation").asString());
|
|
UserService::createNotification(
|
|
current[0]["user_id"].as<long long>(),
|
|
"report_rejected",
|
|
"Report rejected",
|
|
"Your report was rejected after moderation review.",
|
|
reportId);
|
|
}
|
|
}
|
|
return success();
|
|
}
|
|
|
|
Json::Value AdminService::listUsers(const auth::UserContext &user)
|
|
{
|
|
if (!auth::isAdmin(user))
|
|
{
|
|
return failure("forbidden");
|
|
}
|
|
|
|
auto response = success();
|
|
response["users"] = repositories::resultToJson(
|
|
drogon::app().getDbClient()->execSqlSync(
|
|
"SELECT u.id, u.first_name, u.last_name, u.email, u.fiscal_code, "
|
|
"u.phone, u.points, u.banned, u.must_change_password, "
|
|
"GROUP_CONCAT(r.name ORDER BY r.name SEPARATOR ',') AS roles "
|
|
"FROM users u "
|
|
"LEFT JOIN user_roles ur ON ur.user_id = u.id "
|
|
"LEFT JOIN roles r ON r.id = ur.role_id "
|
|
"GROUP BY u.id, u.first_name, u.last_name, u.email, u.fiscal_code, "
|
|
"u.phone, u.points, u.banned, u.must_change_password "
|
|
"ORDER BY u.created_at DESC LIMIT 200"));
|
|
return response;
|
|
}
|
|
|
|
Json::Value AdminService::updateUserRoles(const auth::UserContext &user,
|
|
long long targetUserId,
|
|
const Json::Value &body)
|
|
{
|
|
if (!auth::isAdmin(user) || !body["roles"].isArray())
|
|
{
|
|
return failure("invalid_roles");
|
|
}
|
|
|
|
auto db = drogon::app().getDbClient();
|
|
const auto target =
|
|
db->execSqlSync("SELECT id FROM users WHERE id = ?", targetUserId);
|
|
if (target.empty())
|
|
{
|
|
return failure("user_not_found");
|
|
}
|
|
|
|
db->execSqlSync("DELETE FROM user_roles WHERE user_id = ?", targetUserId);
|
|
for (const auto &role : body["roles"])
|
|
{
|
|
if (!role.isString())
|
|
{
|
|
return failure("invalid_roles");
|
|
}
|
|
|
|
const auto roleRows =
|
|
db->execSqlSync("SELECT id FROM roles WHERE name = ?", role.asString());
|
|
if (roleRows.empty())
|
|
{
|
|
return failure("role_not_found");
|
|
}
|
|
db->execSqlSync(
|
|
"INSERT INTO user_roles (user_id, role_id) VALUES (?, ?)",
|
|
targetUserId,
|
|
roleRows[0]["id"].as<long long>());
|
|
}
|
|
return success();
|
|
}
|
|
|
|
Json::Value AdminService::updateUserBan(const auth::UserContext &user,
|
|
long long targetUserId,
|
|
const Json::Value &body)
|
|
{
|
|
if (!auth::isAdmin(user) || !body["banned"].isBool())
|
|
{
|
|
return failure("invalid_ban_payload");
|
|
}
|
|
if (targetUserId == user.id)
|
|
{
|
|
return failure("cannot_ban_self");
|
|
}
|
|
|
|
auto db = drogon::app().getDbClient();
|
|
const auto target =
|
|
db->execSqlSync("SELECT id FROM users WHERE id = ?", targetUserId);
|
|
if (target.empty())
|
|
{
|
|
return failure("user_not_found");
|
|
}
|
|
|
|
db->execSqlSync("UPDATE users SET banned = ? WHERE id = ?",
|
|
body["banned"].asBool(),
|
|
targetUserId);
|
|
if (body["banned"].asBool())
|
|
{
|
|
db->execSqlSync(
|
|
"UPDATE api_tokens SET revoked_at = NOW() "
|
|
"WHERE user_id = ? AND revoked_at IS NULL",
|
|
targetUserId);
|
|
}
|
|
return success();
|
|
}
|
|
} // namespace visione::services
|