Add account restrictions, appeals, and admin moderation tools

lib/account-api.ts

@@ -1,7 +1,14 @@
 import "server-only";
 import { createClient } from "@supabase/supabase-js";
 import { NextRequest, NextResponse } from "next/server";
-import { admin, authClient, required, user } from "./supabase";
+import {
+  admin,
+  authClient,
+  required,
+  user,
+  rawUser,
+  accountState,
+} from "./supabase";
 import { accountProfile } from "./profile";
 import {
   authActionSchema,
@@ -26,12 +33,31 @@ export async function accountApi(
   path: string[],
   context: Context,
 ) {
+  if (
+    path[0] === "auth" &&
+    path[1] === "logout" &&
+    path.length === 2 &&
+    request.method === "POST"
+  ) {
+    const client = await authClient();
+    const { error } = await client.auth.signOut({ scope: "local" });
+    if (error) throw new Error("Could not sign out. Please try again.");
+    const response = json({ ok: true });
+    for (const name of ["mg_guest", "mg_multiplayer"])
+      response.cookies.set(name, "", {
+        path: "/",
+        maxAge: 0,
+        httpOnly: true,
+        sameSite: "lax",
+      });
+    return response;
+  }
   if (
     path[0] === "auth" &&
     path[1] === "initial-password" &&
     path.length === 2
   ) {
-    const account = await user();
+    const account = await rawUser();
     if (!account?.email || !account.email_confirmed_at)
       return json({ error: "Log in to manage your account" }, 401);
     if (request.method === "GET") {
@@ -126,7 +152,7 @@ export async function accountApi(
           : next,
     );
     if (body.action === "login") {
-      const { error } = await client.auth.signInWithPassword({
+      const { data, error } = await client.auth.signInWithPassword({
         email: body.email,
         password: body.password,
       });
@@ -140,7 +166,12 @@ export async function accountApi(
           },
           401,
         );
-      return json({ next });
+      return json({
+        next:
+          data.user && (await accountState(data.user.id)) !== "active"
+            ? "/ban/appeal"
+            : next,
+      });
     }
     if (body.action === "signup") {
       const { data, error } = await client.auth.signUp({
@@ -175,7 +206,7 @@ export async function accountApi(
     });
   }
   if (path[1] !== "password") return json({ error: "Not found" }, 404);
-  const account = await user();
+  const account = await rawUser();
   if (!account?.email)
     return json({ error: "Log in before changing your password" }, 401);
   const body = passwordUpdateSchema.parse(await context.jsonBody(request));