add bans

migrations/006_initbans.down.sql

···
+DROP TABLE IF EXISTS bans;

migrations/006_initbans.up.sql

···
+CREATE TABLE bans (
+  id SERIAL PRIMARY KEY,
+  did TEXT PRIMARY KEY,
+  reason TEXT,
+  till TIMESTAMPTZ,
+	banned_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);

server/internal/db/db.go

···
 	"rvcx/internal/types"
 	"time"
 
+	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
 
···
 	uri := fmt.Sprintf("at://%s/org.xcvr.feed.channel/%s", did, rkey)
 	row := s.pool.QueryRow(ctx, `
 		SELECT 
-			channels.uri,  
-			channels.host, 
+			channels.uri,
+			channels.host,
 			channels.title, 
 			channels.topic, 
 			channels.created_at,
···
 	_, err := s.pool.Exec(ctx, `DELETE FROM channels WHERE uri = $1`, uri)
 	return err
 }
+
+func (s *Store) GetBanned(did string, ctx context.Context) (*types.Ban, error) {
+	row := s.pool.QueryRow(ctx, `SELECT 
+		id,
+		reason,
+		till,
+		banned_at
+		FROM bans WHERE did = $1`, did)
+	var ban types.Ban
+	err := row.Scan(&ban.Id, &ban.Reason, &ban.Till, &ban.BannedAt)
+	if err != nil {
+		return nil, err
+	}
+	ban.Did = did
+	return &ban, nil
+}
+
+func (s *Store) GetBanId(id int, ctx context.Context) (*types.Ban, error) {
+	row := s.pool.QueryRow(ctx, `SELECT 
+		did,
+		reason,
+		till,
+		banned_at
+		FROM bans WHERE id = $1`, id)
+	var ban types.Ban
+	err := row.Scan(&ban.Id, &ban.Reason, &ban.Till, &ban.BannedAt)
+	if err != nil {
+		return nil, err
+	}
+	ban.Id = id
+	return &ban, nil
+}
+
+func (s *Store) AddBan(did string, reason *string, till *time.Time, ctx context.Context) error {
+	_, err := s.pool.Exec(ctx, `INSERT INTO bans (
+		did,
+		reason,
+		till
+		) VALUES (
+		$1, $2, $3
+		)
+		`, did, reason, till)
+	return err
+}
+
+func (s *Store) IsBanned(did string, ctx context.Context) (bool, error) {
+	ban, err := s.GetBanned(did, ctx)
+	if ban != nil {
+		defbanned := false
+		if ban.Till == nil {
+			defbanned = true
+		} else {
+			defbanned = time.Now().Before(*ban.Till)
+		}
+		if defbanned {
+			return true, nil
+		}
+	}
+	if err != nil && !errors.Is(err, pgx.ErrNoRows) {
+		return false, err
+	}
+	return false, nil
+}

server/internal/db/oauth.go

···
 	return nil
 }
 
+func (s Store) DeleteAllSessions(ctx context.Context, did string) error {
+	_, err := s.pool.Exec(ctx, `DELETE FROM sessions WHERE account_did = $1`)
+	return err
+}
+
 func (s Store) GetAuthRequestInfo(ctx context.Context, state string) (*oauth.AuthRequestData, error) {
 	row := s.pool.QueryRow(ctx, `
 		SELECT 

server/internal/handler/handler.go

···
 	mux.HandleFunc(oauthJWKSPath(), h.WithCORS(h.serveJWKS))
 	mux.HandleFunc("POST /oauth/login", h.oauthLogin)
 	mux.HandleFunc("POST /oauth/logout", h.oauthMiddleware(h.oauthLogout))
+	mux.HandleFunc("POST /oauth/ban", h.postBan)
+	mux.HandleFunc("GET /oauth/ban", h.getBan)
 	mux.HandleFunc("GET /oauth/whoami", h.getSession)
 	mux.HandleFunc(oauthCallbackPath(), h.WithCORS(h.oauthCallback))
 	return h

server/internal/handler/oauthHandlers.go

···
 	"fmt"
 	"net/http"
 	"os"
+	"rvcx/internal/atputils"
 	"rvcx/internal/oauth"
+	"strconv"
 	"strings"
+	"time"
 
 	atoauth "github.com/bluesky-social/indigo/atproto/auth/oauth"
 	"github.com/bluesky-social/indigo/atproto/syntax"
···
 		h.serverError(w, errors.New("my god.... :"+err.Error()))
 		return
 	}
+	isban, err := h.db.IsBanned(sessData.AccountDID.String(), r.Context())
+	if err != nil {
+		h.serverError(w, errors.New("i'm not sure if user is banned, error, "+err.Error()))
+		return
+	}
+	if isban {
+		ban, _ := h.db.GetBanned(sessData.AccountDID.String(), r.Context())
+		http.Redirect(w, r, fmt.Sprintf("%s%d", os.Getenv("BAN_ENDPOINT"), ban.Id), http.StatusSeeOther)
+		return
+	}
+
 	err = h.rm.CreateInitialProfile(sessData, r.Context())
 	if err != nil {
 		h.serverError(w, err)
···
 		f(cs, w, r)
 	}
 }
+
+func (h *Handler) postBan(w http.ResponseWriter, r *http.Request) {
+	s, _ := h.sessionStore.Get(r, "oauthsession")
+	did, bok := s.Values["did"].(string)
+	if !bok {
+		h.badRequest(w, errors.New("not authorized"))
+		return
+	}
+	handle, err := h.db.ResolveDid(did, r.Context())
+	if err != nil {
+		h.serverError(w, errors.New("failed to resolve"+err.Error()))
+		return
+	}
+	if handle != os.Getenv("ADMIN_HANDLE") {
+		h.badRequest(w, errors.New("must be admin to ban"))
+		return
+	}
+	userhandle := r.Header.Get("user")
+	userdid, err := atputils.GetDidFromHandle(r.Context(), userhandle)
+	if err != nil {
+		h.badRequest(w, errors.New("failed to resolve user handle"))
+		return
+	}
+	daysstring := r.Header.Get("days")
+	daysint, err := strconv.Atoi(daysstring)
+	var till *time.Time
+	if err == nil {
+		tillt := time.Now().Add(time.Hour * 24 * time.Duration(daysint))
+		till = &tillt
+	}
+	var reason *string
+	reasonstr := r.Header.Get("reason")
+	if reasonstr != "" {
+		reason = &reasonstr
+	}
+	err = h.db.AddBan(userdid, reason, till, r.Context())
+	if err != nil {
+		h.serverError(w, errors.New("failed to ban, "+err.Error()))
+		return
+	}
+	ban, err := h.db.GetBanned(userdid, r.Context())
+	if err != nil {
+		h.serverError(w, errors.New("succeeded to ban and then failed again"+err.Error()))
+		return
+	}
+	err = h.db.DeleteAllSessions(r.Context(), ban.Did)
+	if err != nil {
+		h.serverError(w, errors.New("failed to kick user "+ban.Did+err.Error()))
+		return
+	}
+	http.Redirect(w, r, fmt.Sprintf("%s%d", os.Getenv("BAN_ENDPOINT"), ban.Id), http.StatusFound)
+}
+
+func (h *Handler) getBan(w http.ResponseWriter, r *http.Request) {
+	banid := r.Header.Get("id")
+	id, err := strconv.Atoi(banid)
+	if err != nil {
+		h.badRequest(w, err)
+		return
+	}
+	ban, err := h.db.GetBanId(id, r.Context())
+	if err != nil {
+		h.serverError(w, err)
+		return
+	}
+	encoder := json.NewEncoder(w)
+	w.Header().Add("Content-Type", "application/json")
+	encoder.Encode(ban)
+}

server/internal/recordmanager/media.go

···
 }
 
 func (rm *RecordManager) AddImageToCache(did string, cid string, ctx context.Context) (string, error) {
+	ib, err := rm.db.IsBanned(did, ctx)
+	if err != nil {
+		return "", err
+	}
+	if ib {
+		return "", errors.New("user banned")
+	}
 	uploadDir := "./uploads"
-	_, err := os.Stat(uploadDir)
+	_, err = os.Stat(uploadDir)
 	if os.IsNotExist(err) {
 		os.Mkdir(uploadDir, 0755)
 	}

server/internal/types/oauth.go

···
 	RefreshToken string
 	Expiration   time.Time
 }
+
+type Ban struct {
+	Id       int        `json:"id"`
+	Did      string     `json:"did"`
+	Reason   *string    `json:"reason,omitempty"`
+	Till     *time.Time `json:"till,omitempty"`
+	BannedAt time.Time  `json:"bannedAt"`
+}