tuwunel_api_admin/users/

create_or_modify.rs

use std::collections::BTreeSet;

use axum::extract::State;
use futures::StreamExt;
use ruma::{MilliSecondsSinceUnixEpoch, UserId, profile::ProfileFieldName, thirdparty::Medium};
use synapse_admin_api::users::create_or_modify::v2::{
	self as create_or_modify, ThirdPartyIdentifier,
};
use tuwunel_core::{
	Err, Result,
	arrayvec::ArrayVec,
	utils::{BoolExt, IterStream, ReadyExt, stream::automatic_width},
};
use tuwunel_service::{
	profile::{ProfileValue, string_field},
	threepid::canonicalize_email,
	users::PASSWORD_SENTINEL,
};

use super::user_details;
use crate::{Ruma, refuse_server_user, require_admin};

type Emails = BTreeSet<String>;

type ProfileWrites = ArrayVec<ProfileValue, 2>;

/// # `PUT /_synapse/admin/v2/users/{user_id}`
///
/// Creates a local account or modifies an existing one. `user_type`,
/// `external_ids` and `approved` are accepted and ignored (not persisted).
pub(crate) async fn admin_create_or_modify_route(
	State(services): State<crate::State>,
	body: Ruma<create_or_modify::Request>,
) -> Result<create_or_modify::Response> {
	let sender_user = body.sender_user();

	require_admin(&services, sender_user).await?;

	let user_id = &body.user_id;

	if !services.globals.user_is_local(user_id) {
		return Err!(Request(InvalidParam("Can only create or modify local users")));
	}

	if body.deactivated == Some(true) && body.locked == Some(true) {
		return Err!(Request(InvalidParam("An account cannot be deactivated and locked")));
	}

	if body.admin == Some(false) && sender_user == body.user_id {
		return Err!(Request(InvalidParam("You may not demote yourself.")));
	}

	// A malformed address is refused before any field is written.
	let emails = body
		.threepids
		.as_deref()
		.map(canonical_emails)
		.transpose()?;

	let created = !services.users.exists(user_id).await;

	// The server user's profile stays editable here; its access does not.
	if created || changes_access(&body) {
		refuse_server_user(services, user_id)?;
	}

	let profile = requested_profile(&body);
	let credentials = write_credentials(services, &body, created);

	// A refused profile value returns before the account or its credentials change.
	services
		.profile
		.set_profile_keys_after(user_id, &profile, None, credentials)
		.await?;

	match body.admin {
		| None => {},
		| Some(true) => services.admin.make_user_admin(user_id).await?,
		| Some(false) => {
			services.admin.revoke_admin(user_id).await?;
		},
	}

	match body.deactivated {
		| Some(true) =>
			services
				.deactivate
				.full_deactivate(user_id, false)
				.await?,
		| Some(false)
			if services
				.users
				.is_deactivated(user_id)
				.await
				.unwrap_or(false) =>
		{
			// Reactivation writes a sentinel so a delegated-auth user can sign in again;
			// a caller supplying a password has already reactivated the account above.
			if body.password.is_none() {
				services
					.users
					.set_password(user_id, Some(PASSWORD_SENTINEL))
					.await?;
			}
		},
		| _ => {},
	}

	match body.locked {
		| Some(true) => services.users.set_locked(user_id, sender_user),
		| Some(false) => services.users.clear_locked(user_id),
		| None => {},
	}

	if let Some(emails) = emails {
		replace_emails(services, user_id, &emails).await;
	}

	let details = user_details(services, user_id).await;

	Ok(create_or_modify::Response::new(details))
}

/// Canonicalizes the email addresses among `threepids`.
///
/// Other media are dropped, since nothing stores them.
fn canonical_emails(threepids: &[ThirdPartyIdentifier]) -> Result<Emails> {
	threepids
		.iter()
		.filter(|tpid| tpid.medium == Medium::Email)
		.map(|tpid| canonicalize_email(&tpid.address))
		.collect()
}

fn changes_access(body: &create_or_modify::Request) -> bool {
	body.password.is_some()
		|| body.deactivated.is_some()
		|| body.locked.is_some()
		|| body.admin.is_some()
		|| body.threepids.is_some()
}

// An empty value clears its field.
fn requested_profile(body: &create_or_modify::Request) -> ProfileWrites {
	[
		(ProfileFieldName::DisplayName, &body.displayname),
		(ProfileFieldName::AvatarUrl, &body.avatar_url),
	]
	.into_iter()
	.filter_map(|(name, value)| {
		value
			.as_deref()
			.map(|value| string_field(name, value.is_empty().or_some(value)))
	})
	.collect()
}

#[tracing::instrument(level = "debug", skip_all)]
async fn write_credentials(
	services: crate::State,
	body: &create_or_modify::Request,
	created: bool,
) -> Result {
	let user_id = &body.user_id;

	if created {
		return services
			.users
			.create(user_id, body.password.as_deref(), None)
			.await;
	}

	let Some(password) = body.password.as_deref() else {
		return Ok(());
	};

	services
		.users
		.set_password(user_id, Some(password))
		.await?;

	if body.logout_devices {
		services.users.remove_devices(user_id, None).await;
	}

	Ok(())
}

/// Replaces the user's email bindings with exactly the addresses in `desired`.
///
/// The addresses must already be canonical emails.
async fn replace_emails(services: crate::State, user_id: &UserId, desired: &Emails) {
	let current: Emails = services
		.threepid
		.get_bindings(user_id)
		.ready_filter(|tpid| tpid.medium == Medium::Email)
		.map(|tpid| tpid.address)
		.collect()
		.await;

	current
		.difference(desired)
		.stream()
		.for_each_concurrent(automatic_width(), |address| {
			services.threepid.del_binding(user_id, address)
		})
		.await;

	let now = MilliSecondsSinceUnixEpoch::now();

	desired
		.difference(&current)
		.stream()
		.for_each_concurrent(automatic_width(), |address| {
			services
				.threepid
				.put_binding(user_id, address, Medium::Email, now, now)
		})
		.await;
}