Expand moderation case workflows

src/lib/server/moderation/actions.ts

@@ -4,7 +4,12 @@ import { AuthError } from '../auth/index.js';
 import { moderatorMaximumRestrictionMs, type AuthUser } from '../../auth.js';
 import {
     canRevokeModerationRestriction,
+    isModerationCaseOpen,
+    moderationCaseOutcomes,
+    moderationCaseStatusLabels,
     moderationGuid,
+    type ModerationCaseStatus,
+    type ModerationCasePriority,
     type ModerationGame,
     type ModerationScope
 } from '../../moderation.js';
@@ -34,8 +39,18 @@ type SanctionRow = {
     expires_at: string | null;
     revision: number;
     revoked_at: string | null;
+    case_id: string | null;
+};
+type CaseRow = {
+    id: string;
+    game: ModerationGame;
+    guid: string;
+    revision: number;
+    status: ModerationCaseStatus;
+    title: string;
+    priority: ModerationCasePriority;
+    assignee_id: string | null;
 };
-type CaseRow = { id: string; game: ModerationGame; guid: string; revision: number; status: string };
 
 function serverTarget(name: unknown, game?: ModerationGame) {
     const server = textField(name, 'Server', 255);
@@ -61,6 +76,15 @@ function serverTarget(name: unknown, game?: ModerationGame) {
 
 function createSanction(actor: AuthUser, input: Record<string, unknown>, now: string) {
     const target = subject(input);
+    const linkedCase =
+        input.caseId === undefined || input.caseId === null ? null : caseRow(input.caseId);
+    if (linkedCase) {
+        checkCaseRevision(linkedCase, input.caseRevision);
+        if (!isModerationCaseOpen(linkedCase.status))
+            throw new AuthError('Reopen this case before applying a restriction.', 409);
+        if (linkedCase.game !== target.game || linkedCase.guid !== target.guid)
+            throw new AuthError('A case restriction must target the case’s game and player.');
+    }
     if (input.kind !== 'ban' && input.kind !== 'mute') throw new AuthError('Choose ban or mute.');
     if (typeof input.scope !== 'string' || !['server', 'game', 'fleet'].includes(input.scope))
         throw new AuthError('Choose a restriction scope.');
@@ -117,8 +141,8 @@ function createSanction(actor: AuthUser, input: Record<string, unknown>, now: st
     ensureSubject(target.game, target.guid);
     db()
         .prepare(
-            `INSERT INTO moderation_sanctions(id,game,guid,kind,scope,server,server_created_at,reason,note,actor_id,actor,created_at,expires_at)
-        VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?)`
+            `INSERT INTO moderation_sanctions(id,game,guid,kind,scope,server,server_created_at,reason,note,actor_id,actor,created_at,expires_at,case_id)
+        VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?)`
         )
         .run(
             id,
@@ -133,7 +157,8 @@ function createSanction(actor: AuthUser, input: Record<string, unknown>, now: st
             actor.id,
             actor.username,
             now,
-            expires
+            expires,
+            linkedCase?.id ?? null
         );
     advancePolicy();
     moderationEvent(
@@ -147,10 +172,22 @@ function createSanction(actor: AuthUser, input: Record<string, unknown>, now: st
             server: server?.name ?? null,
             reason,
             expiresAt: expires,
-            note
+            note,
+            caseId: linkedCase?.id ?? null
         }),
         now
     );
+    if (linkedCase) {
+        touchCase(linkedCase.id, now);
+        moderationEvent(
+            actor,
+            'case.restriction',
+            linkedCase,
+            linkedCase.id,
+            JSON.stringify({ restrictionId: id, kind: input.kind, scope: input.scope, reason }),
+            now
+        );
+    }
     return { id };
 }
 function revokeSanction(actor: AuthUser, input: Record<string, unknown>, now: string) {
@@ -183,6 +220,7 @@ function revokeSanction(actor: AuthUser, input: Record<string, unknown>, now: st
         .run(now, id);
     advancePolicy();
     moderationEvent(actor, 'restriction.revoked', row, id, reason, now);
+    if (row.case_id) touchCase(row.case_id, now);
     return { id };
 }
 function liveAction(actor: AuthUser, input: Record<string, unknown>, now: string) {
@@ -267,15 +305,43 @@ function caseRow(value: unknown): CaseRow {
     if (!row) throw new AuthError('Case not found.', 404);
     return row;
 }
+function checkCaseRevision(row: CaseRow, revision: unknown) {
+    if (row.revision !== revision)
+        throw new AuthError('This case changed. Refresh before trying again.', 409);
+}
+function touchCase(id: string, now: string) {
+    db()
+        .prepare('UPDATE moderation_cases SET updated_at=?,revision=revision+1 WHERE id=?')
+        .run(now, id);
+}
+function casePriority(value: unknown): ModerationCasePriority {
+    if (value !== 'low' && value !== 'normal' && value !== 'high' && value !== 'urgent')
+        throw new AuthError('Choose low, normal, high, or urgent priority.');
+    return value;
+}
+function caseAssignee(value: unknown): { id: string | null; username: string | null } {
+    if (value === null) return { id: null, username: null };
+    const id = textField(value, 'Assignee', 128);
+    const user = db()
+        .prepare(
+            `SELECT id,username FROM auth_users
+        WHERE id=? AND role IN ('admin','moderator') AND disabled=0 AND must_change_password=0`
+        )
+        .get(id) as { id: string; username: string } | undefined;
+    if (!user) throw new AuthError('Choose an active administrator or moderator to own this case.');
+    return user;
+}
 function evidence(
     actor: AuthUser,
     id: string,
     text: string,
     source: string,
     snapshot: string | null,
-    now: string
+    now: string,
+    decision = false
 ) {
     if (
+        !decision &&
         (
             db()
                 .prepare('SELECT COUNT(*) AS count FROM moderation_evidence WHERE case_id=?')
@@ -291,93 +357,206 @@ function createCase(actor: AuthUser, input: Record<string, unknown>, now: string
     const target = subject(input);
     const title = textField(input.title, 'Case title', 160);
     const note = textField(input.note, 'Case note', 4000, true);
+    const priority = input.priority === undefined ? 'normal' : casePriority(input.priority);
+    const assignee =
+        input.assigneeId === undefined
+            ? { id: null, username: null }
+            : caseAssignee(input.assigneeId);
     const id = randomUUID();
     ensureSubject(target.game, target.guid);
     db()
         .prepare(
-            `INSERT INTO moderation_cases(id,game,guid,title,status,actor_id,actor,created_at,updated_at) VALUES(?,?,?,?,'open',?,?,?,?)`
+            `INSERT INTO moderation_cases(id,game,guid,title,status,actor_id,actor,created_at,updated_at,priority,assignee_id) VALUES(?,?,?,?,'open',?,?,?,?,?,?)`
         )
-        .run(id, target.game, target.guid, title, actor.id, actor.username, now, now);
+        .run(
+            id,
+            target.game,
+            target.guid,
+            title,
+            actor.id,
+            actor.username,
+            now,
+            now,
+            priority,
+            assignee.id
+        );
     if (note) evidence(actor, id, note, 'Staff note', null, now);
-    if (input.evidence !== undefined) {
-        const requested = input.evidence as { matchId: unknown; message: unknown };
-        if (!requested || !Number.isSafeInteger(requested.matchId))
-            throw new AuthError('Choose a recorded chat message.');
-        const message = textField(requested.message, 'Chat message', 4096);
-        const match = db()
-            .prepare('SELECT game,server,started_at FROM leaderboard_matches WHERE id=?')
-            .get(requested.matchId) as
-            { game: string; server: string; started_at: string } | undefined;
-        if (!match || match.game !== target.game)
-            throw new AuthError('The source match is unavailable.', 404);
-        const entries = db()
-            .prepare('SELECT entry FROM match_chat WHERE match_id=?')
-            .all(requested.matchId) as { entry: string }[];
-        const found = entries
-            .filter((row) => {
-                const entry = JSON.parse(row.entry);
-                return (
-                    entry.type === 'message' &&
-                    moderationGuid(target.game, entry.message.guid) === target.guid &&
-                    entry.message.message === message
-                );
-            })
-            .slice(0, 10);
-        if (!found.length)
-            throw new AuthError(
-                'The original chat message could not be verified in the archive.',
-                409
-            );
-        for (const row of found)
-            evidence(
-                actor,
-                id,
-                message,
-                `Archived chat · ${match.server} · match ${requested.matchId}`,
-                JSON.stringify({ matchId: requested.matchId, match, entry: JSON.parse(row.entry) }),
-                now
-            );
-    }
+    if (input.evidence !== undefined) archivedEvidence(actor, id, target, input.evidence, now);
     moderationEvent(actor, 'case.opened', target, id, title, now);
+    if (priority !== 'normal' || assignee.id)
+        moderationEvent(
+            actor,
+            'case.updated',
+            target,
+            id,
+            JSON.stringify({
+                priority: { from: 'normal', to: priority },
+                assignee: { from: null, to: assignee.username }
+            }),
+            now
+        );
     return { id };
 }
+function archivedEvidence(
+    actor: AuthUser,
+    id: string,
+    target: { game: ModerationGame; guid: string },
+    value: unknown,
+    now: string
+): number {
+    const requested = value as { matchId: unknown; message: unknown };
+    if (!requested || !Number.isSafeInteger(requested.matchId))
+        throw new AuthError('Choose a recorded chat message.');
+    textField(requested.message, 'Chat message', 4096);
+    // Evidence must match the archived bytes, including intentional whitespace.
+    const message = requested.message as string;
+    const match = db()
+        .prepare('SELECT game,server,started_at FROM leaderboard_matches WHERE id=?')
+        .get(requested.matchId) as { game: string; server: string; started_at: string } | undefined;
+    if (!match || match.game !== target.game)
+        throw new AuthError('The source match is unavailable.', 404);
+    const entries = db()
+        .prepare('SELECT entry FROM match_chat WHERE match_id=?')
+        .all(requested.matchId) as { entry: string }[];
+    const found = entries
+        .filter((row) => {
+            const entry = JSON.parse(row.entry);
+            return (
+                entry.type === 'message' &&
+                moderationGuid(target.game, entry.message.guid) === target.guid &&
+                entry.message.message === message
+            );
+        })
+        .slice(0, 10);
+    if (!found.length)
+        throw new AuthError('The original chat message could not be verified in the archive.', 409);
+    for (const row of found)
+        evidence(
+            actor,
+            id,
+            message,
+            `Archived chat · ${match.server} · match ${requested.matchId}`,
+            JSON.stringify({ matchId: requested.matchId, match, entry: JSON.parse(row.entry) }),
+            now
+        );
+    return found.length;
+}
+function updateCase(actor: AuthUser, input: Record<string, unknown>, now: string) {
+    const row = caseRow(input.id);
+    checkCaseRevision(row, input.revision);
+    const title = input.title === undefined ? row.title : textField(input.title, 'Case title', 160);
+    const priority = input.priority === undefined ? row.priority : casePriority(input.priority);
+    const assignee =
+        input.assigneeId === undefined || input.assigneeId === row.assignee_id
+            ? null
+            : caseAssignee(input.assigneeId);
+    const assigneeId = assignee ? assignee.id : row.assignee_id;
+    const status = input.status === undefined ? row.status : input.status;
+    if (
+        input.status !== undefined &&
+        status !== 'open' &&
+        status !== 'in_review' &&
+        status !== 'escalated'
+    )
+        throw new AuthError('Choose an active case status, or close the case with an outcome.');
+    if (input.status !== undefined && !isModerationCaseOpen(row.status))
+        throw new AuthError('Use reopen to reactivate a closed case.', 409);
+    const reason = textField(input.reason, 'Status change reason', 4000, status === row.status);
+    const changes: Record<string, unknown> = {};
+    if (title !== row.title) changes.title = { from: row.title, to: title };
+    if (priority !== row.priority) changes.priority = { from: row.priority, to: priority };
+    if (status !== row.status) changes.status = { from: row.status, to: status };
+    if (assigneeId !== row.assignee_id) {
+        const previous = row.assignee_id
+            ? (db().prepare('SELECT username FROM auth_users WHERE id=?').get(row.assignee_id) as
+                  { username: string } | undefined)
+            : null;
+        changes.assignee = { from: previous?.username ?? null, to: assignee?.username ?? null };
+        changes.assigneeId = { from: row.assignee_id, to: assigneeId };
+    }
+    if (!Object.keys(changes).length) throw new AuthError('Change the case details before saving.');
+    db()
+        .prepare(
+            `UPDATE moderation_cases SET title=?,priority=?,assignee_id=?,status=?,updated_at=?,revision=revision+1 WHERE id=?`
+        )
+        .run(title, priority, assigneeId, status, now, row.id);
+    moderationEvent(
+        actor,
+        'case.updated',
+        row,
+        row.id,
+        JSON.stringify({ ...changes, ...(reason ? { reason } : {}) }),
+        now
+    );
+    return { id: row.id };
+}
 export function mutateModeration(actorId: string, input: Record<string, unknown>) {
     return moderationMutation(actorId, input, (actor, now) => {
         if (input.op === 'create-sanction') return createSanction(actor, input, now);
         if (input.op === 'revoke-sanction') return revokeSanction(actor, input, now);
         if (input.op === 'action') return liveAction(actor, input, now);
         if (input.op === 'create-case') return createCase(actor, input, now);
+        if (input.op === 'update-case') return updateCase(actor, input, now);
         if (input.op === 'case-note') {
             const row = caseRow(input.id);
+            if (input.revision !== undefined) checkCaseRevision(row, input.revision);
             const text = textField(input.text, 'Note', 4000);
             evidence(actor, row.id, text, 'Staff note', null, now);
-            db()
-                .prepare('UPDATE moderation_cases SET updated_at=?,revision=revision+1 WHERE id=?')
-                .run(now, row.id);
+            touchCase(row.id, now);
             moderationEvent(actor, 'case.note', row, row.id, text, now);
             return { id: row.id };
         }
         if (input.op === 'resolve-case') {
             const row = caseRow(input.id);
-            if (row.revision !== input.revision || row.status !== 'open')
+            if (row.revision !== input.revision || !isModerationCaseOpen(row.status))
                 throw new AuthError('This case changed. Refresh before resolving it.', 409);
-            if (input.status !== 'resolved' && input.status !== 'dismissed')
-                throw new AuthError('Choose resolved or dismissed.');
+            const outcome = moderationCaseOutcomes.find((status) => status === input.status);
+            if (!outcome) throw new AuthError('Choose a case outcome.');
             const reason = textField(input.reason, 'Decision reason', 4000);
-            evidence(
-                actor,
-                row.id,
-                reason,
-                input.status === 'resolved' ? 'Resolution' : 'Dismissal',
-                null,
-                now
-            );
+            evidence(actor, row.id, reason, moderationCaseStatusLabels[outcome], null, now, true);
             db()
                 .prepare(
                     'UPDATE moderation_cases SET status=?,updated_at=?,revision=revision+1 WHERE id=?'
                 )
-                .run(input.status, now, row.id);
-            moderationEvent(actor, `case.${input.status}`, row, row.id, reason, now);
+                .run(outcome, now, row.id);
+            moderationEvent(actor, `case.${outcome}`, row, row.id, reason, now);
+            return { id: row.id };
+        }
+        if (input.op === 'reopen-case') {
+            const row = caseRow(input.id);
+            checkCaseRevision(row, input.revision);
+            if (isModerationCaseOpen(row.status))
+                throw new AuthError('This case is already active.', 409);
+            const reason = textField(input.reason, 'Reopening reason', 4000);
+            evidence(actor, row.id, reason, 'Reopened', null, now, true);
+            db()
+                .prepare(
+                    "UPDATE moderation_cases SET status='open',updated_at=?,revision=revision+1 WHERE id=?"
+                )
+                .run(now, row.id);
+            moderationEvent(
+                actor,
+                'case.reopened',
+                row,
+                row.id,
+                JSON.stringify({ from: row.status, reason }),
+                now
+            );
+            return { id: row.id };
+        }
+        if (input.op === 'attach-evidence') {
+            const row = caseRow(input.id);
+            checkCaseRevision(row, input.revision);
+            const count = archivedEvidence(actor, row.id, row, input.evidence, now);
+            touchCase(row.id, now);
+            moderationEvent(
+                actor,
+                'case.evidence_attached',
+                row,
+                row.id,
+                JSON.stringify({ count, matchId: (input.evidence as { matchId: number }).matchId }),
+                now
+            );
             return { id: row.id };
         }
         if (input.op === 'note') {