jerry/buzz

mirror of https://github.com/block/buzz.git synced 2026-10-27 20:41:57 +00:00

Files

Will Pfleger f001ebbb6e feat(desktop): add Admin Console Actions tab for direct staff actions (#7904 )

Builds on #7883 (merged).

Adds an **Actions** tab to the Admin Console so relay staff can ban,
time out, or delete directly through the #7883 endpoints (`POST
/members/{pubkey}/ban`, `POST /members/{pubkey}/timeout`, `POST
/events/{id}/delete`), with no report required.

## Design

- **Frozen intent.** Review freezes the whole request (origin, relay,
signer, community, action, target, reason, duration, `requestId`).
Confirm and Retry resend it unchanged, so a manual retry reuses the same
`requestId` and stays idempotent on the relay. The intent is cleared
only on a definitive non-409 4xx (`preserveRequestIdOnError`). A 409 or
a 202 pending keeps it, except `409 request_id_conflict`, which is final
for that id and drops the intent so no futile Retry is offered. A 202
pending renders as a neutral notice, not an error.
- **Bound to signer and relay.** The intent carries `expectedPubkey` and
`expectedRelay`. Native `admin_direct_action` refuses before sending any
request if either is blank or no longer matches
(`assert_expected_signer` / `assert_expected_relay_scope`). The tab is
keyed on pubkey + origin, so an identity or relay switch remounts it and
drops any frozen intent.
- **Survives tab switches.** `ActionsTab` stays mounted while the panel
is open and is only hidden on other tabs, with the same pubkey + origin
key, so a pending, ambiguous or in-flight action (and its `requestId`)
is still there on return.
- **Nothing-sent refusals.** Every native refusal before the first
request leaves (malformed host, changed relay or signer, bad target or
duration, the key-backup guard on Reason, a missing HTTP client, the
first request build, the signing-key lookup) returns
`AdminMutationError` with `notSent: true`; the tab drops the intent and
offers no Retry. The request build for the retry after a 401 stays
ambiguous, because the first request already went out. The changed-relay
refusal says "active relay changed since the action was confirmed;
nothing was sent".
- **Disabled auth.** With `canMutate=false`, Review, Confirm and every
field are disabled.
- **Community host.** The host is prefilled from the active relay URL by
`communityHostFromRelayUrl` (URL host, lowercased, default port and
trailing dot stripped, matching the relay's `normalize_host`) and shown
read-only as "Community: <host>" with a Change link. It follows the
active community until the operator edits it; with no relay URL the
input shows directly. Review derives the host from the same
`getRelayWsUrl()` value it freezes into `expectedRelay`, so the two
can't disagree. The host is validated natively
(`validate_community_host`) and sent only as the `communityHost` query,
never in the body. The body is `{requestId, reason?, expirationSecs?}`,
built by the pure `direct_action_request`; only a timeout takes a
duration.
- **Member picker.** Ban and timeout pick the member the way
`AddMemberDialog` does: `useUserSearchQuery` name search,
`parsePubkeyInput` for a pasted npub or hex in any case, and a selected
chip. The target is always sent as lowercase hex. Name search is a
profile search on the active relay, not a member list, so it runs only
when the host is the connected community; for another host the field
takes npub or hex only, and the hint stays visible even with a key
selected. Editing the host to a different community clears the pick and
the search query, so returning to the original host doesn't bring it
back; pressing Change alone keeps it. Each named result shows a short
npub so same-name profiles can be told apart, the selected chip opens
the full key, and the confirm step shows "Name (npub1…abcd)" plus the
full npub (`PubKey variant="full"`). A search result's name is frozen
for display only; a pasted key uses `useUserProfileQuery` on the active
community, otherwise the short npub. Result buttons follow the disabled
state. Changing the member or host drops a frozen intent. Delete keeps
its hex event id (native `Hex64` route type, shared with pubkeys). A
query that starts with `nsec1` or `ncryptsec1` in any case is never
searched; the picker shows "That's a secret key. Never paste it here."
instead.
- **Errors.** `target_is_staff` and `request_id_conflict` get dedicated
copy; other codes fall back to the relay message (`adminErrorCode`). An
empty 404/405 from a relay without these routes reads "This relay
doesn't support direct actions yet."; an uncoded 404/405 with a body
keeps its own text. Success shows a toast.
- **Key-backup guard.** Every admin JSON mutation body (the three direct
routes and the existing report-resolve routes) passes
`egress_guard::assert_no_key_backup_bytes` in `helpers.rs` before
signing. The egress inventory points at that guarded boundary.
- **One signer snapshot.** `admin_direct_action` reads `signing_keys()`
once, checks `expectedPubkey` against it, and signs the request and any
401 retry with that same `Keys`.
- **Serialized Review.** Review and its inputs lock while the relay URL
resolves; a late Review cannot replace a frozen or submitting intent.
- **Reason audience.** Before confirmation the tab states that the
reason is delivered to the affected user, and for channel deletes posted
publicly in the room tombstone (same copy as the Reports tab).
Confirmation shows the frozen reason.

## Fix → test → mutation

| Fix | Test | Mutation that turns it red |
|---|---|---|
| Manual retry reuses `requestId` | `actions-retry` | mint a new id per
attempt |
| Intent preserved across retryable outcomes | `actions-retry`,
`actions-errors` | always clear the frozen intent |
| Confirmation tied to signer + relay | Rust
`direct_action_refuses_a_changed_signer_or_relay` | skip the signer
check |
| Identity/origin change drops intent | `actions-identity` | drop the
tab key |
| Disabled auth keeps Submit off | `actions-disabled-auth` | remove the
`canMutate` gate |
| Key-backup bytes never leave (`ncryptsec1…` / `NCRYPTSEC1…`, zero
requests; ordinary reason sends) | Rust
`direct_action_refuses_key_backup_reason_before_any_request` | remove
the guard call → panics (request sent) |
| Checked signer is the signing key | Rust
`direct_action_signs_only_with_the_validated_snapshot` (identity swapped
after the signer snapshot is taken, before validation) | re-read
`signing_keys()` for signing → signed with the swapped key |
| Late Review cannot replace the intent | `actions-review-race` (Review,
Review, Confirm ambiguous, Retry → one `requestId`) | drop the Review
lock |
| Pending is a neutral notice | `actions-pending-neutral` | store
pending in the error state → `pending notice must render` |
| `request_id_conflict` offers no Retry | `actions-request-id-conflict`
| keep the intent on every 409 → `request_id_conflict`, `no Retry for a
spent request id` |
| Reason audience copy + frozen reason | `actions-audience` | drop the
audience copy; drop the frozen reason |
| Host prefilled read-only, Change reveals the input |
`actions-host-prefill` | drop the prefill → `host must be prefilled from
the active relay` |
| Name result sent as hex and named on confirm | `actions-member-search`
| — |
| npub and uppercase hex sent as lowercase hex | `actions-member-keys` |
drop the direct key result → `no direct result for npub1…` |
| Another community turns name search off with a hint |
`actions-foreign-host` | — |
| A host change clears the pick, even after returning to the first host;
hint stays with a key selected | `actions-host-change-drops-member` |
hide the pick by host instead of clearing it → `returning to the first
host must not restore the old pick` |
| Same-name results differ by key; confirm shows the chosen full npub
and sends that key | `actions-same-name` | drop the full npub from
confirm → `confirm must show the full npub` |
| Results can't be selected once auth is disabled |
`actions-results-disabled` | — |
| Secret key never reaches search, warning shown | `actions-secret-key`
| remove the check → `a secret key reached search_users` |
| Pending action survives a tab round-trip, Retry reuses `requestId` |
`actions-tab-roundtrip-pending` | render the tab conditionally →
`pending notice survives` |
| Ambiguous failure survives a tab round-trip |
`actions-tab-roundtrip-ambiguous` | render conditionally → fails |
| In-flight failure on another tab shows on return |
`actions-tab-roundtrip-inflight` | render conditionally → fails |
| Pre-send refusal drops the intent, no Retry | `actions-not-sent`, Rust
`direct_action_marks_a_pre_send_refusal_not_sent` | ignore `notSent` →
`intent dropped; no Retry` |
| Key-backup refusal is nothing-sent; Review editable again | Rust
`direct_action_refuses_key_backup_reason_before_any_request`,
`actions-backup-reason-not-sent` | drop `not_sent` on the guard → panics
at the `notSent` assert; stub `notSent: false` → `no Retry after a
pre-send refusal` |
| Only an empty 404/405 reads as an old relay | `actions-old-relay` |
drop the empty-body condition → `404 admin API error: Not Found` |

---------

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

2026-09-30 18:53:13 -04:00