+
">
<%= image_tag fresh_user_avatar_path(@user), alt: "Profile avatar", class: "avatar" %>
@@ -30,7 +30,7 @@
<% end %>
<% else %>
- <% if @user.active? %>
+ <% unless @user.deactivated? %>
<%= @user.name %>
<% if Current.user.can_administer? %>
@@ -39,16 +39,24 @@
<%= @user.bio %>
-
- <%= button_to rooms_directs_path(user_ids: [ @user.id ]), class: "btn btn--reversed full-width txt-large" do %>
- <%= image_tag "messages.svg", aria: { hidden: "true", label: "Ping #{@user.name}" } %>
+ <% if @user.active? %>
+
+ <%= button_to rooms_directs_path(user_ids: [ @user.id ]), class: "btn btn--reversed full-width txt-large" do %>
+ <%= image_tag "messages.svg", aria: { hidden: "true", label: "Ping #{@user.name}" } %>
+ <% end %>
+
+
+ <% if Current.user.can_administer? %>
+
+
+ <%= render "users/profiles/transfer", user: @user %>
<% end %>
-
+ <% end %>
- <% if Current.user.can_administer? %>
-
-
- <%= render "users/profiles/transfer", user: @user %>
+ <% if Current.user.can_administer? && Current.user != @user %>
+
+ <%= render "users/ban_button", user: @user %>
+
<% end %>
<% else %>
diff --git a/config/routes.rb b/config/routes.rb
index d02845d..e55fd7e 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -37,6 +37,7 @@ Rails.application.routes.draw do
resources :users, only: :show do
scope module: "users" do
resource :avatar, only: %i[ show destroy ]
+ resource :ban, only: %i[ create destroy ]
scope defaults: { user_id: "me" } do
resource :sidebar, only: :show
diff --git a/db/migrate/20251126092013_create_bans.rb b/db/migrate/20251126092013_create_bans.rb
new file mode 100644
index 0000000..7b86019
--- /dev/null
+++ b/db/migrate/20251126092013_create_bans.rb
@@ -0,0 +1,11 @@
+class CreateBans < ActiveRecord::Migration[8.1]
+ def change
+ create_table :bans do |t|
+ t.references :user, null: false, foreign_key: true
+ t.string :ip_address, null: false
+ t.timestamps
+ end
+
+ add_index :bans, :ip_address
+ end
+end
diff --git a/db/migrate/20251126115722_change_active_to_status_on_users.rb b/db/migrate/20251126115722_change_active_to_status_on_users.rb
new file mode 100644
index 0000000..7e61456
--- /dev/null
+++ b/db/migrate/20251126115722_change_active_to_status_on_users.rb
@@ -0,0 +1,13 @@
+class ChangeActiveToStatusOnUsers < ActiveRecord::Migration[8.1]
+ def change
+ add_column :users, :status, :integer, default: 0, null: false
+
+ reversible do |dir|
+ dir.up do
+ execute "UPDATE users SET status = 1 WHERE active = 0"
+ end
+ end
+
+ remove_column :users, :active, :boolean
+ end
+end
diff --git a/db/structure.sql b/db/structure.sql
index 78b96a9..04b58a8 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -64,12 +64,20 @@ FOREIGN KEY ("user_id")
REFERENCES "users" ("id")
);
CREATE INDEX "index_webhooks_on_user_id" ON "webhooks" ("user_id");
-CREATE TABLE IF NOT EXISTS "users" ("id" integer PRIMARY KEY AUTOINCREMENT NOT NULL, "name" varchar NOT NULL, "created_at" datetime(6) NOT NULL, "updated_at" datetime(6) NOT NULL, "role" integer DEFAULT 0 NOT NULL, "email_address" varchar DEFAULT NULL, "password_digest" varchar DEFAULT NULL, "active" boolean DEFAULT 1, "bio" text DEFAULT NULL, "bot_token" varchar DEFAULT NULL);
-CREATE UNIQUE INDEX "index_users_on_email_address" ON "users" ("email_address");
-CREATE UNIQUE INDEX "index_users_on_bot_token" ON "users" ("bot_token");
CREATE TABLE IF NOT EXISTS "active_storage_blobs" ("id" integer PRIMARY KEY AUTOINCREMENT NOT NULL, "key" varchar NOT NULL, "filename" varchar NOT NULL, "content_type" varchar, "metadata" text, "service_name" varchar NOT NULL, "byte_size" bigint NOT NULL, "checksum" varchar, "created_at" datetime(6) NOT NULL);
CREATE UNIQUE INDEX "index_active_storage_blobs_on_key" ON "active_storage_blobs" ("key") /*application='Campfire'*/;
+CREATE TABLE IF NOT EXISTS "bans" ("id" integer PRIMARY KEY AUTOINCREMENT NOT NULL, "user_id" integer NOT NULL, "ip_address" varchar NOT NULL, "created_at" datetime(6) NOT NULL, "updated_at" datetime(6) NOT NULL, CONSTRAINT "fk_rails_070022cd76"
+FOREIGN KEY ("user_id")
+ REFERENCES "users" ("id")
+);
+CREATE INDEX "index_bans_on_user_id" ON "bans" ("user_id") /*application='Campfire'*/;
+CREATE INDEX "index_bans_on_ip_address" ON "bans" ("ip_address") /*application='Campfire'*/;
+CREATE TABLE IF NOT EXISTS "users" ("id" integer PRIMARY KEY AUTOINCREMENT NOT NULL, "name" varchar NOT NULL, "created_at" datetime(6) NOT NULL, "updated_at" datetime(6) NOT NULL, "role" integer DEFAULT 0 NOT NULL, "email_address" varchar, "password_digest" varchar, "bio" text, "bot_token" varchar, "status" integer DEFAULT 0 NOT NULL);
+CREATE UNIQUE INDEX "index_users_on_email_address" ON "users" ("email_address") /*application='Campfire'*/;
+CREATE UNIQUE INDEX "index_users_on_bot_token" ON "users" ("bot_token") /*application='Campfire'*/;
INSERT INTO "schema_migrations" (version) VALUES
+('20251126115722'),
+('20251126092013'),
('20250825100959'),
('20250825100958'),
('20250825100957'),
diff --git a/test/controllers/concerns/block_banned_requests_test.rb b/test/controllers/concerns/block_banned_requests_test.rb
new file mode 100644
index 0000000..4018c6c
--- /dev/null
+++ b/test/controllers/concerns/block_banned_requests_test.rb
@@ -0,0 +1,32 @@
+require "test_helper"
+
+class BlockBannedRequestsTest < ActionDispatch::IntegrationTest
+ setup do
+ sign_in :david
+ @room = rooms(:watercooler)
+
+ Ban.create!(user: users(:kevin), ip_address: "203.0.113.1")
+ end
+
+ test "POST requests from banned IPs are blocked with 429" do
+ post room_messages_url(@room),
+ params: { message: { body: "Test", client_message_id: "test-123" } },
+ headers: { "REMOTE_ADDR" => "203.0.113.1" }
+
+ assert_response :too_many_requests
+ end
+
+ test "POST requests from non-banned IPs are allowed" do
+ post room_messages_url(@room, format: :turbo_stream),
+ params: { message: { body: "Test", client_message_id: "test-123" } },
+ headers: { "REMOTE_ADDR" => "203.0.113.99" }
+
+ assert_response :success
+ end
+
+ test "GET requests from banned IPs are allowed" do
+ get room_messages_url(@room), headers: { "REMOTE_ADDR" => "203.0.113.1" }
+
+ assert_response :success
+ end
+end
diff --git a/test/controllers/users/bans_controller_test.rb b/test/controllers/users/bans_controller_test.rb
new file mode 100644
index 0000000..e598320
--- /dev/null
+++ b/test/controllers/users/bans_controller_test.rb
@@ -0,0 +1,85 @@
+require "test_helper"
+
+class Users::BansControllerTest < ActionDispatch::IntegrationTest
+ setup do
+ sign_in :david
+ end
+
+ test "create bans user and creates ban records from sessions" do
+ user = users(:kevin)
+ user.sessions.create!(ip_address: "203.0.113.1", user_agent: "Test")
+ user.sessions.create!(ip_address: "203.0.113.2", user_agent: "Test")
+
+ assert_difference -> { Ban.count }, 2 do
+ post user_ban_url(user)
+ end
+
+ assert_redirected_to user_url(user)
+ assert Ban.exists?(ip_address: "203.0.113.1", user: user)
+ assert Ban.exists?(ip_address: "203.0.113.2", user: user)
+ end
+
+ test "create destroys user sessions" do
+ user = users(:kevin)
+ user.sessions.create!(ip_address: "203.0.113.1", user_agent: "Test")
+
+ assert_difference -> { user.sessions.count }, -1 do
+ post user_ban_url(user)
+ end
+ end
+
+ test "create enqueues RemoveBannedContentJob" do
+ user = users(:kevin)
+
+ assert_enqueued_with(job: RemoveBannedContentJob, args: [ user ]) do
+ post user_ban_url(user)
+ end
+ end
+
+ test "RemoveBannedContentJob deletes messages" do
+ user = users(:kevin)
+ user.sessions.create!(ip_address: "203.0.113.1", user_agent: "Test")
+ user.messages.create!(room: rooms(:hq), body: "Test message", client_message_id: "test-123")
+
+ perform_enqueued_jobs do
+ post user_ban_url(user)
+ end
+
+ assert_empty user.reload.messages
+ end
+
+ test "non-admins cannot ban users" do
+ sign_in :kevin
+
+ post user_ban_url(users(:jz))
+
+ assert_response :forbidden
+ end
+
+ test "destroy removes ban records and sets user to active" do
+ user = users(:kevin)
+ user.sessions.create!(ip_address: "203.0.113.1", user_agent: "Test")
+ user.ban
+
+ assert user.reload.banned?
+ assert_equal 1, user.bans.count
+
+ assert_difference -> { Ban.count }, -1 do
+ delete user_ban_url(user)
+ end
+
+ assert_redirected_to user_url(user)
+ assert user.reload.active?
+ end
+
+ test "non-admins cannot unban users" do
+ sign_in :kevin
+
+ user = users(:jz)
+ user.banned!
+
+ delete user_ban_url(user)
+
+ assert_response :forbidden
+ end
+end