v3: added a roles/permissions system, added user management tab on user profile

api/services/comment-like-service.ts

@@ -81,7 +81,7 @@ export function getCommentLikers(
   ).get(commentId) as { count: number } | undefined;
 
   const rawRows = db.prepare(
-    `SELECT u.id, u.username, u.password_hash, u.is_admin, u.created_at, u.updated_at,
+    `SELECT u.id, u.username, u.password_hash, u.role, u.created_at, u.updated_at,
             u.avatar_mime, u.description, u.invited_by, u.email,
             i.username as invited_by_username
      FROM users u

api/services/comment-service.ts

@@ -91,7 +91,7 @@ export function updateComment(
   commentId: string,
   body: string,
   requestingUserId: string,
-  isAdmin: boolean,
+  canModerate: boolean,
 ): { comment: Comment; dumpId: string; isPrivate: boolean } {
   const row = db.prepare(
     `SELECT c.dump_id, d.is_private FROM comments c JOIN dumps d ON c.dump_id = d.id WHERE c.id = ?;`,
@@ -107,7 +107,7 @@ export function updateComment(
       "Cannot edit a deleted comment",
     );
   }
-  if (existing.userId !== requestingUserId && !isAdmin) {
+  if (existing.userId !== requestingUserId && !canModerate) {
     throw new APIException(
       APIErrorCode.UNAUTHORIZED,
       401,
@@ -143,7 +143,7 @@ export function updateComment(
 export function deleteComment(
   commentId: string,
   requestingUserId: string,
-  isAdmin: boolean,
+  canModerate: boolean,
 ): { dumpId: string; isPrivate: boolean } {
   const row = db.prepare(
     `SELECT c.dump_id, d.is_private FROM comments c JOIN dumps d ON c.dump_id = d.id WHERE c.id = ?;`,
@@ -152,7 +152,7 @@ export function deleteComment(
     throw new APIException(APIErrorCode.NOT_FOUND, 404, "Comment not found");
   }
   const comment = fetchComment(commentId);
-  if (comment.userId !== requestingUserId && !isAdmin) {
+  if (comment.userId !== requestingUserId && !canModerate) {
     throw new APIException(
       APIErrorCode.UNAUTHORIZED,
       401,

api/services/follow-service.ts

@@ -269,7 +269,7 @@ export function getFollowedUsersByUser(
   ).get(userId) as { count: number } | undefined;
 
   const rawRows = db.prepare(
-    `SELECT u.id, u.username, u.password_hash, u.is_admin, u.created_at, u.updated_at,
+    `SELECT u.id, u.username, u.password_hash, u.role, u.created_at, u.updated_at,
             u.avatar_mime, u.description, u.invited_by, u.email,
             i.username as invited_by_username
      FROM users u

api/services/user-service.ts

@@ -12,7 +12,7 @@ import { hashPassword } from "../lib/jwt.ts";
 import { linkAttachments } from "./attachment-service.ts";
 
 const USER_SELECT =
-  `SELECT u.id, u.username, u.password_hash, u.is_admin, u.created_at, u.updated_at, u.avatar_mime, u.description, u.invited_by, u.email,
+  `SELECT u.id, u.username, u.password_hash, u.role, u.created_at, u.updated_at, u.avatar_mime, u.description, u.invited_by, u.email,
           i.username as invited_by_username
    FROM users u
    LEFT JOIN users i ON i.id = u.invited_by`;
@@ -39,13 +39,13 @@ export async function createUser(
   const passwordHash = await hashPassword(request.password);
 
   db.prepare(
-    `INSERT INTO users (id, username, password_hash, is_admin, created_at, invited_by, email)
+    `INSERT INTO users (id, username, password_hash, role, created_at, invited_by, email)
       VALUES (?, ?, ?, ?, ?, ?, ?);`,
   ).run(
     userId,
     request.username,
     passwordHash,
-    0,
+    "user",
     createdAt.toISOString(),
     inviterId,
     request.email,
@@ -55,7 +55,7 @@ export async function createUser(
     id: userId,
     username: request.username,
     passwordHash,
-    isAdmin: false,
+    role: "user",
     createdAt,
     email: request.email,
   };
@@ -155,11 +155,11 @@ export async function updateUser(
   const updatedUserRow = userApiToRow(updatedUser);
 
   const userResult = db.prepare(
-    `UPDATE users SET username = ?, password_hash = ?, is_admin = ?, description = ?, email = ?, updated_at = ? WHERE id = ?`,
+    `UPDATE users SET username = ?, password_hash = ?, role = ?, description = ?, email = ?, updated_at = ? WHERE id = ?`,
   ).run(
     updatedUserRow.username,
     updatedUserRow.password_hash,
-    updatedUserRow.is_admin,
+    updatedUserRow.role,
     updatedUserRow.description,
     updatedUserRow.email,
     now.toISOString(),

api/services/vote-service.ts

@@ -81,7 +81,7 @@ export function getDumpVoters(
   ).get(dumpId) as { count: number } | undefined;
 
   const rawRows = db.prepare(
-    `SELECT u.id, u.username, u.password_hash, u.is_admin, u.created_at, u.updated_at,
+    `SELECT u.id, u.username, u.password_hash, u.role, u.created_at, u.updated_at,
             u.avatar_mime, u.description, u.invited_by, u.email,
             i.username as invited_by_username
      FROM users u