Skip to content

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

508 linesCodeBlameRaw
1import { ArrowLeft } from "lucide-react";
2import { Form, Link, data, redirect } from "react-router";
3
4import { ACCOUNT_RESTORE_DAYS, type AdminUser, WORKSPACE_RESTORE_DAYS, securityEventLabel } from "@g1t/contracts";
5
6import type { Route } from "./+types/user";
7import { Badge, Button, EmptyState, Field, Input, Notice, PageHeader, Section, When } from "~/components/ui";
8import {
9 type DeletedWithAccount,
10 accountWentSummary,
11 confirmsUsername,
12 deletedWithAccount,
13 soleOwnerNote,
14 soleWorkspaceRefusal,
15 soleWorkspacesRefusal,
16 staffDeleteProblem,
17 staffDeletionRefusal,
18} from "~/lib/deleted-accounts";
19import { confirmsPurge, daysLeft } from "~/lib/deleted-workspaces";
20import { text } from "~/lib/forms";
21import { joinedThrough } from "~/lib/invites";
22import { accountsAdmin, identity } from "~/lib/services.server";
23import { settle } from "~/lib/settle";
24import { requireStaff } from "~/lib/staff";
25
26export const meta: Route.MetaFunction = ({ params }) => [
27 { title: `${params.username} · sudo` },
28 { name: "robots", content: "noindex, nofollow" },
29];
30
31export async function loader({ params, request, context }: Route.LoaderArgs) {
32 requireStaff(context);
33 const result = await settle(accountsAdmin.user(params.username));
34 if (result.ok && !result.value) throw data("No such account.", { status: 404 });
35 const url = new URL(request.url);
36 const done = url.searchParams.get("done");
37 const slug = url.searchParams.get("slug") ?? "";
38 // The workspaces staff deleted with it, each with its deletion while it
39 // waits to be purged.
40 const user = result.ok ? result.value : null;
41 const went = user?.deleted?.went;
42 let workspaces: DeletedWithAccount[] = [];
43 let workspacesError: string | null = null;
44 if (went && (went.deletedWorkspaces ?? []).length > 0) {
45 const deleted = await settle(identity.deletedWorkspaces());
46 workspaces = deletedWithAccount(went, deleted.ok ? deleted.value : []);
47 workspacesError = deleted.ok ? null : deleted.error;
48 }
49 const messages: Record<string, string> = {
50 deleted: "Deleted the account.",
51 "deleted-with-workspaces": "Deleted the account and the workspaces it alone owned.",
52 restored: "Restored the account.",
53 "workspace-purged": `Purged ${slug}.`,
54 };
55 return {
56 user,
57 error: result.ok ? null : result.error,
58 removed: url.searchParams.get("removed"),
59 done: done ? (messages[done] ?? null) : null,
60 workspaces,
61 workspacesError,
62 now: Date.now(),
63 };
64}
65
66/**
67 * Removes an address (the reason is required, recorded and shown to the
68 * person), or deletes, restores or purges the account, or purges a
69 * workspace deleted with it. Identity checks each again: protection, the
70 * workspaces it owns alone and whether they can go, the typed username or
71 * slug, the restore window.
72 */
73export async function action({ params, request, context }: Route.ActionArgs) {
74 const staff = requireStaff(context);
75 const form = await request.formData();
76 const intent = text(form, "intent");
77 const back = (done: string) => redirect(`/users/${encodeURIComponent(params.username)}?done=${done}`);
78 if (intent === "delete-account") {
79 const reason = text(form, "reason");
80 const confirm = text(form, "confirm");
81 const withWorkspaces = text(form, "with-workspaces") === "1";
82 const problem = staffDeleteProblem({
83 username: params.username,
84 reason,
85 confirm,
86 withWorkspaces,
87 acknowledged: text(form, "acknowledge") === "on",
88 });
89 if (problem) return data({ error: problem, account: true }, { status: 422 });
90 const result = await accountsAdmin.deleteAccount(params.username, reason, confirm, staff.email, withWorkspaces);
91 if (!result.ok) return data({ error: result.error.message, account: true }, { status: 422 });
92 throw back(withWorkspaces ? "deleted-with-workspaces" : "deleted");
93 }
94 if (intent === "purge-workspace") {
95 const id = text(form, "id");
96 const slug = text(form, "slug");
97 const confirm = text(form, "confirm");
98 if (!confirmsPurge(slug, confirm)) return data({ error: `Type ${slug} to confirm.`, workspace: id }, { status: 422 });
99 const result = await identity.purgeWorkspace(id, staff.email, confirm);
100 if (!result.ok) return data({ error: result.error.message, workspace: id }, { status: 422 });
101 throw redirect(`/users/${encodeURIComponent(params.username)}?done=workspace-purged&slug=${encodeURIComponent(slug)}`);
102 }
103 if (intent === "restore-account") {
104 const result = await accountsAdmin.restoreAccount(text(form, "id"), staff.email);
105 if (!result.ok) return data({ error: result.error.message, account: true }, { status: 422 });
106 throw back("restored");
107 }
108 if (intent === "purge-account") {
109 const confirm = text(form, "confirm");
110 if (!confirmsUsername(params.username, confirm)) {
111 return data({ error: `Type ${params.username} to confirm.`, account: true }, { status: 422 });
112 }
113 const result = await accountsAdmin.purgeAccount(text(form, "id"), staff.email, confirm);
114 if (!result.ok) return data({ error: result.error.message, account: true }, { status: 422 });
115 throw redirect(`/users/deleted?done=purged&username=${encodeURIComponent(params.username)}`);
116 }
117 const email = String(form.get("email") ?? "").trim();
118 const reason = String(form.get("reason") ?? "").trim();
119 if (!reason) return data({ error: "Say why. The person sees the reason in their security log.", email }, { status: 422 });
120 const result = await accountsAdmin.removeEmail(params.username, email, reason, staff.email);
121 if (!result.ok) return data({ error: result.error.message, email }, { status: 422 });
122 throw redirect(`/users/${encodeURIComponent(params.username)}?removed=${encodeURIComponent(email)}`);
123}
124
125export default function User({ loaderData, actionData }: Route.ComponentProps) {
126 const { user, error, removed, done, workspaces, workspacesError, now } = loaderData;
127 const accountError = actionData && "account" in actionData ? actionData.error : null;
128 const workspaceError = actionData && "workspace" in actionData ? { id: actionData.workspace, error: actionData.error } : null;
129 if (!user) {
130 return (
131 <main className="mx-auto max-w-4xl px-4 py-8 sm:py-10">
132 <Notice tone="error">Could not load the account: {error}</Notice>
133 </main>
134 );
135 }
136 return (
137 <main className="mx-auto max-w-4xl px-4 py-8 sm:py-10">
138 <Link to="/workspaces" className="inline-flex items-center gap-1.5 text-sm text-muted hover:text-fg">
139 <ArrowLeft size={14} /> Workspaces
140 </Link>
141 <PageHeader
142 title={
143 <span className="flex flex-wrap items-center gap-2">
144 {user.username}
145 {user.deleted && <Badge tone="danger">Deleted</Badge>}
146 {user.deletion.protected && <Badge tone="info">Protected</Badge>}
147 </span>
148 }
149 description={
150 <>
151 Account <span className="font-mono">{user.id}</span>, made <When at={user.createdAt} />.{" "}
152 {user.joinedThrough && (
153 <>
154 {joinedThrough(user.joinedThrough.label)}.{" "}
155 </>
156 )}
157 {user.privateEmail ? "Keeps its address private on commits." : "Shows its primary address on commits."}
158 </>
159 }
160 />
161 {removed && (
162 <div className="mt-5">
163 <Notice tone="ok">Removed {removed}. The person was told, with the reason.</Notice>
164 </div>
165 )}
166 {done && (
167 <div className="mt-5">
168 <Notice tone="ok">{done}</Notice>
169 </div>
170 )}
171
172 <Section
173 id="emails"
174 title="Email addresses"
175 description="Remove an address someone else needs, or one that is compromised. Never the last confirmed one; removing the primary makes the oldest other confirmed address primary."
176 className="mt-6"
177 >
178 <ul className="divide-y divide-line rounded-md border border-line">
179 {user.emails.map((email) => (
180 <li key={email.email} className="space-y-3 px-4 py-3">
181 <div className="flex flex-wrap items-center gap-2 text-sm">
182 <span className="font-mono break-all">{email.email}</span>
183 {email.primary && <Badge tone="lavender">Primary</Badge>}
184 {email.backup && <Badge>Backup</Badge>}
185 {email.verified ? <Badge tone="mint">Confirmed</Badge> : <Badge tone="warn">Unconfirmed</Badge>}
186 <span className="text-xs text-faint">
187 added <When at={email.createdAt} />
188 </span>
189 </div>
190 <Form method="post" className="flex flex-col gap-2 sm:flex-row sm:items-end">
191 <input type="hidden" name="email" value={email.email} />
192 <div className="grow">
193 <Field label="Reason (the person sees it)">
194 <Input
195 name="reason"
196 required
197 maxLength={200}
198 placeholder="Another account needs this address"
199 />
200 </Field>
201 </div>
202 <Button variant="danger" type="submit">
203 Remove
204 </Button>
205 </Form>
206 {actionData && "email" in actionData && actionData.email === email.email && actionData.error && <Notice tone="error">{actionData.error}</Notice>}
207 </li>
208 ))}
209 </ul>
210 </Section>
211
212 <Section id="log" title="Security log" description="What happened to the account's addresses and password, newest first." className="mt-6">
213 {user.log.length === 0 ? (
214 <EmptyState title="Nothing yet" />
215 ) : (
216 <ul className="divide-y divide-line text-sm">
217 {user.log.map((event, at) => (
218 <li key={`${event.createdAt}:${at}`} className="flex flex-col gap-1 py-2 sm:flex-row sm:justify-between sm:gap-4">
219 <span className="min-w-0 break-words">
220 {securityEventLabel(event)}
221 {event.staff && (
222 <span className="text-muted">
223 {" "}
224 · by {event.staff}
225 {event.reason ? `: ${event.reason}` : ""}
226 </span>
227 )}
228 </span>
229 <span className="shrink-0 text-xs text-faint">
230 <When at={event.createdAt} time />
231 </span>
232 </li>
233 ))}
234 </ul>
235 )}
236 </Section>
237
238 <AccountSection
239 user={user}
240 error={accountError}
241 workspaces={workspaces}
242 workspacesError={workspacesError}
243 workspaceError={workspaceError}
244 now={now}
245 />
246 </main>
247 );
248}
249
250/**
251 * Deleting the account, or, once it is deleted, restoring or purging it
252 * and the workspaces deleted with it. Every form is plain HTML: sudo ships
253 * no JavaScript.
254 */
255function AccountSection({
256 user,
257 error,
258 workspaces,
259 workspacesError,
260 workspaceError,
261 now,
262}: {
263 user: AdminUser;
264 error: string | null;
265 workspaces: DeletedWithAccount[];
266 workspacesError: string | null;
267 workspaceError: { id: string; error: string } | null;
268 now: number;
269}) {
270 const deleted = user.deleted;
271 if (deleted) {
272 const left = daysLeft(deleted.purgeAfter, now);
273 return (
274 <Section
275 id="account"
276 title="Deleted account"
277 description={`Deleted ${deleted.went.staff ? `by ${deleted.went.staff}` : "by the person"}. Kept ${ACCOUNT_RESTORE_DAYS} days for a restore, then purged. Staff can purge it now.`}
278 className="mt-6"
279 >
280 <div className="space-y-3 text-sm">
281 <p className="flex flex-wrap items-center gap-2 text-muted">
282 <span>
283 Deleted <When at={deleted.deletedAt} time /> · purged <When at={deleted.purgeAfter} time />
284 </span>
285 {deleted.restorable ? (
286 <Badge tone="warn">
287 {left} day{left === 1 ? "" : "s"} left
288 </Badge>
289 ) : (
290 <Badge tone="danger">Being purged</Badge>
291 )}
292 </p>
293 {deleted.went.reason && <p className="text-muted">Reason: {deleted.went.reason}</p>}
294 <p className="text-muted">Left: {accountWentSummary(deleted.went)}</p>
295 {workspaces.length > 0 && (
296 <DeletedWorkspaces workspaces={workspaces} error={workspacesError} workspaceError={workspaceError} now={now} />
297 )}
298 {error && <Notice tone="error">{error}</Notice>}
299 <div className="flex flex-col gap-3 border-t border-line pt-4 sm:flex-row sm:items-end sm:justify-between">
300 <form method="post">
301 <input type="hidden" name="intent" value="restore-account" />
302 <input type="hidden" name="id" value={deleted.userId} />
303 <Button type="submit" variant="lavender" disabled={!deleted.restorable}>
304 Restore
305 </Button>
306 </form>
307 {user.deletion.protected ? (
308 <p className="text-muted">Protected: it can never be purged.</p>
309 ) : (
310 <form method="post" className="flex flex-col gap-2 sm:flex-row sm:items-end">
311 <input type="hidden" name="intent" value="purge-account" />
312 <input type="hidden" name="id" value={deleted.userId} />
313 <label className="grid gap-1 text-xs text-muted">
314 <span>
315 Type <span className="font-mono text-fg">{user.username}</span> to purge it now
316 </span>
317 <Input name="confirm" autoComplete="off" spellCheck={false} className="font-mono" />
318 </label>
319 <Button type="submit" variant="danger">
320 Purge now
321 </Button>
322 </form>
323 )}
324 </div>
325 </div>
326 </Section>
327 );
328 }
329 const refusal = staffDeletionRefusal(user.deletion);
330 const sole = user.deletion.sole_owner_of;
331 const blocked = soleWorkspacesRefusal(user.deletion);
332 return (
333 <Section
334 id="account"
335 title="Delete account"
336 description={`Signs it out everywhere, ends its tokens and keys, and takes it out of every workspace. Kept ${ACCOUNT_RESTORE_DAYS} days for a restore, then purged; its username is never given out again. Only when the person asks, for abuse, or for an account g1t no longer uses, with a reason.`}
337 className="mt-6"
338 >
339 {refusal ? (
340 <Notice tone="warn">{refusal}</Notice>
341 ) : sole.length === 0 ? (
342 <details className="rounded-md border border-danger/30 px-3 py-2" open={Boolean(error)}>
343 <summary className="cursor-pointer text-sm text-danger">Delete this account</summary>
344 <form method="post" className="mt-3 grid gap-3 sm:max-w-md">
345 <input type="hidden" name="intent" value="delete-account" />
346 <Field label="Reason (kept in sudo's audit log)">
347 <Input name="reason" required maxLength={200} placeholder="The person asked from their primary address" />
348 </Field>
349 <Field label={`Type ${user.username} to confirm`}>
350 <Input name="confirm" required autoComplete="off" spellCheck={false} className="font-mono" />
351 </Field>
352 {error && <Notice tone="error">{error}</Notice>}
353 <div>
354 <Button type="submit" variant="danger">
355 Delete account
356 </Button>
357 </div>
358 </form>
359 </details>
360 ) : (
361 <div className="space-y-3 text-sm">
362 <Notice tone="warn">{soleOwnerNote(user.deletion)}</Notice>
363 <ul className="divide-y divide-line rounded-md border border-line">
364 {sole.map((workspace) => {
365 const why = soleWorkspaceRefusal(workspace);
366 return (
367 <li key={workspace.slug} className="space-y-1 px-4 py-2">
368 <div className="flex flex-wrap items-center justify-between gap-2">
369 <Link to={`/workspaces/${workspace.slug}`} className="text-fg hover:underline">
370 {workspace.name} <span className="font-mono text-xs text-muted">{workspace.slug}</span>
371 </Link>
372 <span className="flex flex-wrap items-center gap-1.5 text-xs text-faint">
373 {workspace.protected && <Badge tone="info">Protected</Badge>}
374 {!workspace.protected && workspace.billing && <Badge tone="danger">Billing</Badge>}
375 {workspace.members} member{workspace.members === 1 ? "" : "s"}
376 </span>
377 </div>
378 {why && <p className="text-xs text-danger">{why}</p>}
379 </li>
380 );
381 })}
382 </ul>
383 {blocked ? (
384 <>
385 <Notice tone="error">{blocked}</Notice>
386 {error && <Notice tone="error">{error}</Notice>}
387 </>
388 ) : (
389 <details className="rounded-md border border-danger/30 px-3 py-2" open={Boolean(error)}>
390 <summary className="cursor-pointer text-sm text-danger">Delete account and the workspaces it alone owns</summary>
391 <form method="post" className="mt-3 grid gap-3 sm:max-w-md">
392 <input type="hidden" name="intent" value="delete-account" />
393 <input type="hidden" name="with-workspaces" value="1" />
394 <p className="text-muted">
395 Deletes {sole.map((workspace) => workspace.slug).join(", ")} first, each as its owner would (billing closes it, its
396 repositories go with it, kept {WORKSPACE_RESTORE_DAYS} days for a restore), then the account. If a workspace cannot go,
397 the account is not deleted.
398 </p>
399 <Field label="Reason (kept in sudo's audit log)">
400 <Input name="reason" required maxLength={200} placeholder="Retired test account" />
401 </Field>
402 <Field label={`Type ${user.username} to confirm`}>
403 <Input name="confirm" required autoComplete="off" spellCheck={false} className="font-mono" />
404 </Field>
405 <label className="flex items-start gap-2 text-sm">
406 <input type="checkbox" name="acknowledge" required className="mt-0.5 accent-[var(--g1t-accent)]" />
407 <span>
408 {sole.length === 1 ? (
409 <>
410 The workspace <span className="font-mono">{sole[0].slug}</span> is deleted too, with everything in it.
411 </>
412 ) : (
413 <>
414 The {sole.length} workspaces <span className="font-mono">{sole.map((workspace) => workspace.slug).join(", ")}</span> are
415 deleted too, with everything in them.
416 </>
417 )}
418 </span>
419 </label>
420 {error && <Notice tone="error">{error}</Notice>}
421 <div>
422 <Button type="submit" variant="danger">
423 Delete account and {sole.length === 1 ? "its workspace" : `its ${sole.length} workspaces`}
424 </Button>
425 </div>
426 </form>
427 </details>
428 )}
429 </div>
430 )}
431 </Section>
432 );
433}
434
435/**
436 * The workspaces staff deleted with the account: each waiting to be purged
437 * can be purged now (identity purges only a workspace still deleted), or
438 * restored from Deleted workspaces.
439 */
440function DeletedWorkspaces({
441 workspaces,
442 error,
443 workspaceError,
444 now,
445}: {
446 workspaces: DeletedWithAccount[];
447 error: string | null;
448 workspaceError: { id: string; error: string } | null;
449 now: number;
450}) {
451 return (
452 <div className="space-y-2 border-t border-line pt-4">
453 <p className="text-fg">Workspaces deleted with it</p>
454 <p className="text-muted">
455 Purge them before the account if they should go now: once the account is purged, this page is gone (they stay on{" "}
456 <Link to="/workspaces/deleted" className="text-fg hover:underline">
457 Deleted workspaces
458 </Link>
459 ). To undo it all, restore the account first, then each workspace, so it comes back with its owner.
460 </p>
461 {error && <Notice tone="error">Could not load deleted workspaces: {error}</Notice>}
462 <ul className="divide-y divide-line rounded-md border border-line">
463 {workspaces.map((workspace) => {
464 const waiting = workspace.deleted;
465 const left = waiting ? daysLeft(waiting.purgeAfter, now) : 0;
466 return (
467 <li key={workspace.workspaceId} className="space-y-2 px-4 py-3">
468 <div className="flex flex-wrap items-center justify-between gap-2">
469 <span className="font-mono">{workspace.slug}</span>
470 {waiting ? (
471 waiting.restorable ? (
472 <Badge tone="warn">
473 {left} day{left === 1 ? "" : "s"} left
474 </Badge>
475 ) : (
476 <Badge tone="danger">Being purged</Badge>
477 )
478 ) : (
479 <Badge>Purged or restored</Badge>
480 )}
481 </div>
482 {waiting &&
483 (waiting.went.protected ? (
484 <p className="text-xs text-muted">Protected: it can never be purged.</p>
485 ) : (
486 <form method="post" className="flex flex-col gap-2 sm:flex-row sm:items-end">
487 <input type="hidden" name="intent" value="purge-workspace" />
488 <input type="hidden" name="id" value={workspace.workspaceId} />
489 <input type="hidden" name="slug" value={workspace.slug} />
490 <label className="grid gap-1 text-xs text-muted">
491 <span>
492 Type <span className="font-mono text-fg">{workspace.slug}</span> to purge it now
493 </span>
494 <Input name="confirm" autoComplete="off" spellCheck={false} className="font-mono" />
495 </label>
496 <Button type="submit" variant="danger">
497 Purge now
498 </Button>
499 </form>
500 ))}
501 {workspaceError && workspaceError.id === workspace.workspaceId && <Notice tone="error">{workspaceError.error}</Notice>}
502 </li>
503 );
504 })}
505 </ul>
506 </div>
507 );
508}