Add account restrictions, appeals, and admin moderation tools

tests/account-controls.test.ts

@@ -0,0 +1,100 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  accountActionInput,
+  accountAppealInput,
+  accountAppealReviewInput,
+  restrictionPageAllowed,
+} from "../shared/account-controls";
+
+test("account controls reject forged identity, role, status and unknown actions", () => {
+  const reason = "A detailed reason for restricting this account.";
+  for (const action of ["deactivate", "ban", "restore", "delete"])
+    assert.equal(
+      accountActionInput.safeParse({ action, reason }).success,
+      true,
+    );
+  for (const extra of [
+    { owner_id: "someone" },
+    { role: "admin" },
+    { status: "active" },
+  ])
+    assert.equal(
+      accountActionInput.safeParse({ action: "ban", reason, ...extra }).success,
+      false,
+    );
+  for (const action of ["promote", "prepare_delete", "approve"])
+    assert.equal(
+      accountActionInput.safeParse({ action, reason }).success,
+      false,
+    );
+  for (const reason of ["short", " ".repeat(20), "x".repeat(2001)])
+    assert.equal(
+      accountActionInput.safeParse({ action: "ban", reason }).success,
+      false,
+    );
+  assert.equal(
+    accountActionInput.safeParse({
+      action: "delete",
+      reason,
+      confirmation: "wrong-id",
+    }).success,
+    false,
+  );
+});
+
+test("appeals cannot choose their owner, ban version, reviewer or outcome", () => {
+  const reason = "Please review the circumstances of this ban.";
+  assert.equal(
+    accountAppealInput.parse({ reason: "  " + reason + "  " }).reason,
+    reason,
+  );
+  for (const extra of [
+    { owner_id: "other" },
+    { status_version: 99 },
+    { state: "approved" },
+  ])
+    assert.equal(
+      accountAppealInput.safeParse({ reason, ...extra }).success,
+      false,
+    );
+  assert.equal(
+    accountAppealReviewInput.safeParse({ reason, decision: "approve" }).success,
+    true,
+  );
+  assert.equal(
+    accountAppealReviewInput.safeParse({ reason, decision: "reject" }).success,
+    true,
+  );
+  assert.equal(
+    accountAppealReviewInput.safeParse({
+      reason,
+      decision: "restore",
+      reviewer_id: "admin",
+    }).success,
+    false,
+  );
+});
+
+test("restricted page allowlist cannot admit game, dashboard or staff pages via prefixes", () => {
+  for (const path of [
+    "/ban/appeal",
+    "/docs",
+    "/log-in",
+    "/auth/callback",
+    "/auth/reset-password",
+  ])
+    assert.equal(restrictionPageAllowed(path), true, path);
+  for (const path of [
+    "/",
+    "/moderation",
+    "/dashboard",
+    "/servers",
+    "/dev/api",
+    "/ban/appeal/other",
+    "/docs/../moderation",
+    "/auth/admin",
+    "/auth/callback/other",
+  ])
+    assert.equal(restrictionPageAllowed(path), false, path);
+});