@amxts/perms 0.0.0-stage → 0.1.1

package/src/db-store.ts

@@ -0,0 +1,174 @@
+/**
+ * The permissions in MySQL, for servers that share one set: the tables are
+ * made on the first start, every change is written as it happens and bumps
+ * `perms_revision`, and each server reads everything again when the
+ * revision it polls has moved.
+ */
+import { Database } from "@amxts/core";
+import type { Change, Grant, Group, Membership, User } from "./model";
+import { allGroups, allUsers, groupNamed, replaceAll, userWith } from "./model";
+
+interface GroupRow {
+	name: string;
+	weight: number;
+	inherits: string;
+}
+
+interface GrantRow {
+	owner: string;
+	node: string;
+	value: number;
+	until: number;
+	server: string;
+}
+
+interface UserRow {
+	id: string;
+	name: string;
+	password: string;
+}
+
+interface MemberRow {
+	user: string;
+	grp: string;
+	until: number;
+	server: string;
+}
+
+interface RevisionRow {
+	revision: number;
+}
+
+const TABLES = [
+	"CREATE TABLE IF NOT EXISTS perms_groups (name VARCHAR(64) PRIMARY KEY, weight INT NOT NULL DEFAULT 0, inherits TEXT NOT NULL)",
+	"CREATE TABLE IF NOT EXISTS perms_grants (owner VARCHAR(96) NOT NULL, node VARCHAR(128) NOT NULL, value BOOLEAN NOT NULL, until BIGINT NOT NULL DEFAULT 0, server VARCHAR(64) NOT NULL DEFAULT '', PRIMARY KEY (owner, node, server))",
+	"CREATE TABLE IF NOT EXISTS perms_users (id VARCHAR(96) PRIMARY KEY, name VARCHAR(64) NOT NULL DEFAULT '', password VARCHAR(80) NOT NULL DEFAULT '')",
+	"CREATE TABLE IF NOT EXISTS perms_members (user VARCHAR(96) NOT NULL, grp VARCHAR(64) NOT NULL, until BIGINT NOT NULL DEFAULT 0, server VARCHAR(64) NOT NULL DEFAULT '', PRIMARY KEY (user, grp, server))",
+	"CREATE TABLE IF NOT EXISTS perms_revision (id INT PRIMARY KEY, revision INT NOT NULL)",
+	"INSERT IGNORE INTO perms_revision (id, revision) VALUES (1, 0)",
+];
+
+let db: Database | null = null;
+let revision = -1;
+
+export function useDatabase(url: string) {
+	db = new Database(url);
+}
+
+export function usesDatabase() {
+	return db != null;
+}
+
+export async function createTables() {
+	for (const sql of TABLES) await db!.execute(sql, []);
+}
+
+function grantFrom(row: GrantRow): Grant {
+	return { node: row.node, value: row.value != 0, until: row.until, server: row.server };
+}
+
+/** Reads every table into the model. */
+export async function readDatabase() {
+	const found = await db!.query<RevisionRow>("SELECT revision FROM perms_revision WHERE id = 1", []);
+	const groupRows = await db!.query<GroupRow>("SELECT name, weight, inherits FROM perms_groups", []);
+	const grantRows = await db!.query<GrantRow>("SELECT owner, node, value, until, server FROM perms_grants", []);
+	const userRows = await db!.query<UserRow>("SELECT id, name, password FROM perms_users", []);
+	const memberRows = await db!.query<MemberRow>("SELECT user, grp, until, server FROM perms_members", []);
+
+	const groups = groupRows.map<Group>(row => ({
+		name: row.name,
+		weight: row.weight,
+		inherits: row.inherits.split(",").filter(name => name != ""),
+		grants: grantRows.filter(grant => grant.owner == `group:${row.name}`).map<Grant>(grantFrom),
+	}));
+	const users = userRows.map<User>(row => ({
+		id: row.id,
+		name: row.name,
+		password: row.password,
+		groups: memberRows.filter(member => member.user == row.id).map<Membership>(member => ({ group: member.grp, until: member.until, server: member.server })),
+		grants: grantRows.filter(grant => grant.owner == `user:${row.id}`).map<Grant>(grantFrom),
+	}));
+	replaceAll(groups, users);
+	revision = found.length > 0 ? found[0].revision : 0;
+}
+
+/** Whether another server changed the set since it was read. */
+export async function changedElsewhere() {
+	const found = await db!.query<RevisionRow>("SELECT revision FROM perms_revision WHERE id = 1", []);
+	return found.length > 0 && found[0].revision != revision;
+}
+
+async function saveGroup(name: string) {
+	const group = groupNamed(name);
+	if (group == null) return;
+	await db!.execute("INSERT INTO perms_groups (name, weight, inherits) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE weight = VALUES(weight), inherits = VALUES(inherits)", [group.name, group.weight, group.inherits.join(",")]);
+}
+
+async function saveUser(id: string) {
+	const user = userWith(id);
+	if (user == null) return;
+	await db!.execute("INSERT INTO perms_users (id, name, password) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE name = VALUES(name), password = VALUES(password)", [user.id, user.name, user.password]);
+}
+
+async function saveGrant(owner: string, grant: Grant) {
+	await db!.execute("INSERT INTO perms_grants (owner, node, value, until, server) VALUES (?, ?, ?, ?, ?) ON DUPLICATE KEY UPDATE value = VALUES(value), until = VALUES(until)", [owner, grant.node, grant.value, grant.until, grant.server]);
+}
+
+/** Writes one change that the model applied. */
+async function writeChange(change: Change) {
+	const owner = change.user != "" ? `user:${userWith(change.user)!.id}` : `group:${change.group}`;
+	const op = change.op;
+
+	if (op == "grant") {
+		if (change.user != "") await saveUser(change.user);
+		await saveGrant(owner, { node: change.node, value: change.value, until: change.until, server: change.server });
+		return;
+	}
+	if (op == "revoke") {
+		await db!.execute("DELETE FROM perms_grants WHERE owner = ? AND node = ? AND server = ?", [owner, change.node, change.server]);
+		return;
+	}
+	if (op == "memberAdd") {
+		await saveUser(change.user);
+		await db!.execute("INSERT INTO perms_members (user, grp, until, server) VALUES (?, ?, ?, ?) ON DUPLICATE KEY UPDATE until = VALUES(until)", [userWith(change.user)!.id, change.group, change.until, change.server]);
+		return;
+	}
+	if (op == "memberRemove") {
+		await db!.execute("DELETE FROM perms_members WHERE user = ? AND grp = ? AND server = ?", [userWith(change.user)!.id, change.group, change.server]);
+		return;
+	}
+	if (op == "userCreate") {
+		await saveUser(change.user);
+		return;
+	}
+	if (op == "groupDelete") {
+		await db!.execute("DELETE FROM perms_groups WHERE name = ?", [change.group]);
+		await db!.execute("DELETE FROM perms_grants WHERE owner = ?", [owner]);
+		await db!.execute("DELETE FROM perms_members WHERE grp = ?", [change.group]);
+		for (const group of allGroups()) await saveGroup(group.name);
+		return;
+	}
+	await saveGroup(change.group);
+}
+
+/** Writes the changes the model applied and moves the revision, so the other servers read them. */
+export async function writeChanges(changes: Change[]) {
+	for (const change of changes) await writeChange(change);
+	await db!.execute("UPDATE perms_revision SET revision = revision + 1 WHERE id = 1", []);
+	const found = await db!.query<RevisionRow>("SELECT revision FROM perms_revision WHERE id = 1", []);
+	if (found.length > 0) revision = found[0].revision;
+}
+
+/** Writes the whole model, for `perms import` into an empty database. */
+export async function writeAll() {
+	for (const group of allGroups()) {
+		await saveGroup(group.name);
+		for (const grant of group.grants) await saveGrant(`group:${group.name}`, grant);
+	}
+	for (const user of allUsers()) {
+		await saveUser(user.id);
+		for (const grant of user.grants) await saveGrant(`user:${user.id}`, grant);
+		for (const membership of user.groups) await db!.execute("INSERT INTO perms_members (user, grp, until, server) VALUES (?, ?, ?, ?) ON DUPLICATE KEY UPDATE until = VALUES(until)", [user.id, membership.group, membership.until, membership.server]);
+	}
+	await db!.execute("UPDATE perms_revision SET revision = revision + 1 WHERE id = 1", []);
+}

package/src/editor.ts

@@ -0,0 +1,277 @@
+/**
+ * The web editor: `perms editor` uploads the permissions to the store as a
+ * session and prints the page's link; while the session lives, the module
+ * polls it for the changes the page saved, commits them, and tells the page
+ * what it did.
+ */
+import { Cvar, clearInterval, fetch, server, setInterval } from "@amxts/core";
+import type { Change, ChangeOp, Grant, Membership } from "./model";
+import { allGroups, allUsers, changeOf, declaredNodes, serverName, userWith } from "./model";
+import { FLAGS, idOf } from "./players";
+import { commit, storageName } from "./state";
+import { momentOf, textOf } from "./time";
+
+const PAGE = "https://amxts.github.io/modules/perms/editor";
+export const DEFAULT_STORE = "https://perms-store.brokukaschannel.workers.dev";
+const POLL_MS = 3000;
+const LIFETIME_MS = 60 * 60 * 1000;
+
+interface WireGrant {
+	node: string;
+	value: boolean;
+	until: string | null;
+	server: string | null;
+}
+
+interface WireMembership {
+	group: string;
+	until: string | null;
+	server: string | null;
+}
+
+interface WireGroup {
+	name: string;
+	weight: number;
+	inherits: string[];
+	grants: WireGrant[];
+}
+
+interface WireUser {
+	id: string;
+	name: string;
+	online: boolean;
+	groups: WireMembership[];
+	grants: WireGrant[];
+}
+
+interface WireNode {
+	node: string;
+	description: string;
+	everyone: boolean;
+	plugin: string;
+	pawn: boolean;
+	letter: string;
+}
+
+interface WireServer {
+	name: string;
+	address: string;
+	storage: string;
+	context: string;
+}
+
+interface Session {
+	version: number;
+	server: WireServer;
+	createdAt: string;
+	expiresAt: string;
+	nodes: WireNode[];
+	groups: WireGroup[];
+	users: WireUser[];
+}
+
+interface Created {
+	id: string;
+	key: string;
+}
+
+interface WireOwner {
+	group?: string;
+	user?: string;
+}
+
+interface WireChange {
+	op: string;
+	owner?: WireOwner;
+	node?: string;
+	value?: boolean;
+	until?: string | null;
+	server?: string | null;
+	group?: string;
+	weight?: number;
+	parent?: string;
+	user?: string;
+	name?: string;
+}
+
+interface WireRevision {
+	revision: number;
+	changes: WireChange[];
+}
+
+interface WireSkipped {
+	change: WireChange;
+	reason: string;
+	code: string;
+}
+
+interface Applied {
+	revision: number;
+	done: WireChange[];
+	skipped: WireSkipped[];
+}
+
+let store = DEFAULT_STORE;
+let sessionId = "";
+let sessionKey = "";
+let expiresAt = 0;
+let seen = 0;
+let polling = 0;
+let busy = false;
+
+export function setStore(url: string) {
+	store = url.endsWith("/") ? url.substring(0, url.length - 1) : url;
+}
+
+function nullable(text: string) {
+	const value: string | null = text == "" ? null : text;
+	return value;
+}
+
+function wireGrant(grant: Grant): WireGrant {
+	return { node: grant.node, value: grant.value, until: nullable(textOf(grant.until)), server: nullable(grant.server) };
+}
+
+function wireMembership(membership: Membership): WireMembership {
+	return { group: membership.group, until: nullable(textOf(membership.until)), server: nullable(membership.server) };
+}
+
+function sessionOf(now: number) {
+	const nodes = declaredNodes().map<WireNode>(each => ({ node: each.node, description: each.description, everyone: each.byDefault, plugin: each.node.split(".")[0], pawn: each.pawn, letter: "" }));
+	for (const flag of FLAGS) nodes.push({ node: `amxx.${flag.name}`, description: `AMX Mod X: ${flag.name} (${flag.letter})`, everyone: false, plugin: "amxx", pawn: true, letter: flag.letter });
+
+	const users = allUsers().map<WireUser>(user => ({ id: user.id, name: user.name, online: false, groups: user.groups.map<WireMembership>(wireMembership), grants: user.grants.map<WireGrant>(wireGrant) }));
+	for (const player of server.players.filter(each => !each.isBot)) {
+		const id = idOf(player);
+		const known = users.find(user => user.id == id);
+		if (known != null) {
+			known.online = true;
+			known.name = player.name;
+		} else {
+			users.push({ id, name: player.name, online: true, groups: [], grants: [] });
+		}
+	}
+
+	const session: Session = {
+		version: 1,
+		server: { name: new Cvar("hostname").value, address: new Cvar("net_address").value, storage: storageName(), context: serverName() },
+		createdAt: textOf(now),
+		expiresAt: textOf(now + LIFETIME_MS),
+		nodes,
+		groups: allGroups().map<WireGroup>(group => ({ name: group.name, weight: group.weight, inherits: group.inherits, grants: group.grants.map<WireGrant>(wireGrant) })),
+		users,
+	};
+	return session;
+}
+
+/** The page's link for the open session. */
+function link() {
+	const page = store == DEFAULT_STORE ? PAGE : `${store}/editor`;
+	return `${page}#${sessionId}`;
+}
+
+export function isOpen() {
+	return sessionId != "" && Date.now() < expiresAt;
+}
+
+/** Opens a session, or gives the one that is open; the lines to print, or an error's. */
+export async function openEditor() {
+	if (isOpen()) return `[perms] The editor is open: ${link()}`;
+
+	const now = Date.now();
+	const response = await fetch(`${store}/session`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(sessionOf(now)) });
+	if (!response.ok) return `[perms] The editor's store answered ${response.status}: ${await response.text()}`;
+
+	const created = await response.json<Created>();
+	sessionId = created.id;
+	sessionKey = created.key;
+	expiresAt = now + LIFETIME_MS;
+	seen = 0;
+	if (polling == 0) polling = setInterval(() => poll(), POLL_MS);
+	return `[perms] Open the editor (an hour): ${link()}`;
+}
+
+/** Closes the session: the store forgets it and the module stops polling. */
+export async function closeEditor() {
+	if (sessionId == "") return;
+
+	const id = sessionId;
+	stopPolling();
+	await fetch(`${store}/session/${id}`, { method: "DELETE", headers: { Authorization: `Bearer ${sessionKey}` } });
+}
+
+function stopPolling() {
+	sessionId = "";
+	if (polling != 0) clearInterval(polling);
+	polling = 0;
+}
+
+async function poll() {
+	if (busy || sessionId == "") return;
+	if (Date.now() >= expiresAt) {
+		stopPolling();
+		return;
+	}
+
+	busy = true;
+	try {
+		const response = await fetch(`${store}/session/${sessionId}/changes?after=${seen}`, { headers: { Authorization: `Bearer ${sessionKey}` } });
+		if (response.status == 404) stopPolling();
+		if (response.ok) await applyRevisions(await response.json<WireRevision[]>());
+	} catch (error) {
+		console.error(`[perms] editor: ${error.message}`);
+	}
+	busy = false;
+}
+
+/** Applies what the page saved, revision by revision, applies it and says so to the store. */
+export async function applyRevisions(revisions: WireRevision[]) {
+	for (const entry of revisions) {
+		const committed = await commit(entry.changes.map<Change>(changeFrom));
+		seen = entry.revision;
+		const applied: Applied = {
+			revision: entry.revision,
+			done: committed.done.map<WireChange>(wireChange),
+			skipped: committed.skipped.map<WireSkipped>(skip => ({ change: wireChange(skip.change), reason: skip.reason, code: skip.code })),
+		};
+		console.log(`[perms] the editor's changes: ${applied.done.length} applied${applied.skipped.length > 0 ? `, ${applied.skipped.length} skipped` : ""}`);
+		applied.skipped.forEach(skip => console.log(`[perms]   skipped: ${skip.reason}`));
+		await fetch(`${store}/session/${sessionId}/applied`, { method: "POST", headers: { "Authorization": `Bearer ${sessionKey}`, "Content-Type": "application/json" }, body: JSON.stringify(applied) });
+	}
+}
+
+const OPS = ["grant", "revoke", "groupCreate", "groupDelete", "groupWeight", "parentAdd", "parentRemove", "memberAdd", "memberRemove", "userCreate"];
+
+/** A change as the page wrote it; an op the module does not know becomes a grant of no node, which is skipped as invalid. */
+function changeFrom(wire: WireChange) {
+	const known = OPS.includes(wire.op);
+	const change = changeOf(known ? (wire.op as ChangeOp) : "grant");
+	const owner = wire.owner;
+	change.group = owner != null ? (owner.group ?? "") : (wire.group ?? "");
+	change.user = owner != null ? (owner.user ?? "") : (wire.user ?? "");
+	change.node = known ? (wire.node ?? "") : "";
+	change.value = wire.value ?? true;
+	change.until = momentOf(wire.until ?? "");
+	change.server = wire.server ?? "";
+	change.weight = wire.weight ?? 0;
+	change.parent = wire.parent ?? "";
+	change.name = wire.name ?? "";
+	if (userWith(change.user) != null) change.user = userWith(change.user)!.id;
+	return change;
+}
+
+function wireChange(change: Change) {
+	const usesOwner = change.op == "grant" || change.op == "revoke";
+	const wire: WireChange = { op: change.op };
+	if (usesOwner) wire.owner = change.user != "" ? { user: change.user } : { group: change.group };
+	if (!usesOwner && change.group != "") wire.group = change.group;
+	if (!usesOwner && change.user != "") wire.user = change.user;
+	if (change.node != "") wire.node = change.node;
+	if (change.op == "grant") wire.value = change.value;
+	if (change.until != 0) wire.until = textOf(change.until);
+	if (change.server != "") wire.server = change.server;
+	if (change.op == "groupCreate" || change.op == "groupWeight") wire.weight = change.weight;
+	if (change.parent != "") wire.parent = change.parent;
+	if (change.name != "") wire.name = change.name;
+	return wire;
+}

package/src/file-store.ts

@@ -0,0 +1,134 @@
+/**
+ * The permissions in a config file, `perms.yaml` by default (or `.json`),
+ * read and written whole through config-core:
+ *
+ *     groups:
+ *       admin:
+ *         weight: 50
+ *         inherits: [vip]
+ *         permissions: [amxx.kick, "kz.admin.*", "-kz.admin.wipe", { node: kz.vip, until: 2026-12-01T00:00:00Z }]
+ *     users:
+ *       - id: "STEAM_0:1:12345"
+ *         name: Bob
+ *         groups: [admin, { group: vip, until: 2026-12-01T00:00:00Z, server: kz1 }]
+ *         permissions: [kz.admin.wipe]
+ */
+import * as fs from "@amxts/core/fs";
+import * as configs from "@amxts/config-core";
+import type { ConfigNode } from "@amxts/config-core";
+import type { Grant, Group, Membership, User } from "./model";
+import { allGroups, allUsers, normalId, replaceAll } from "./model";
+import { momentOf, textOf } from "./time";
+
+let fileName = "perms";
+
+export function setFile(name: string) {
+	fileName = name;
+}
+
+/** The file's path, for the console. */
+export function filePath() {
+	return configs.resolve(fileName);
+}
+
+function grantOf(item: ConfigNode): Grant {
+	if (item.kind == "object") {
+		const node = item.getString("node");
+		const negated = node.startsWith("-");
+		return { node: negated ? node.substring(1) : node, value: !negated && item.getBoolean("value", true), until: momentOf(item.getString("until")), server: item.getString("server") };
+	}
+	const text = item.getString();
+	const negated = text.startsWith("-");
+	return { node: negated ? text.substring(1) : text, value: !negated, until: 0, server: "" };
+}
+
+function membershipOf(item: ConfigNode): Membership {
+	if (item.kind == "object") return { group: item.getString("group"), until: momentOf(item.getString("until")), server: item.getString("server") };
+	return { group: item.getString(), until: 0, server: "" };
+}
+
+function grantsAt(node: ConfigNode, path: string) {
+	return node.values(path).map<Grant>(grantOf).filter(grant => grant.node != "");
+}
+
+/** Reads the file into the model; `false`, with the model untouched, when it could not be read. */
+export function readFile() {
+	const root = configs.read(fileName);
+	if (root.kind != "object") return false;
+	if (root.keys().length == 0 && hasContent(root.file)) return false;
+
+	const groups: Group[] = [];
+	for (const name of root.keys("groups")) {
+		const group = root.get(`groups.${name}`)!;
+		groups.push({ name, weight: group.getNumber("weight"), inherits: group.getStrings("inherits"), grants: grantsAt(group, "permissions") });
+	}
+
+	const users: User[] = [];
+	for (const entry of root.values("users")) {
+		const id = entry.getString("id");
+		if (id == "") continue;
+
+		users.push({
+			id: normalId(id),
+			name: entry.getString("name"),
+			password: entry.getString("password"),
+			groups: entry.values("groups").map<Membership>(membershipOf).filter(membership => membership.group != ""),
+			grants: grantsAt(entry, "permissions"),
+		});
+	}
+
+	replaceAll(groups, users);
+	console.log(`[perms] ${root.file}: ${groups.length} groups, ${users.length} players`);
+	return true;
+}
+
+/** Whether a file has more than comments: one that does and reads as empty failed to read, and config-core said where. */
+function hasContent(path: string) {
+	const text = fs.readFileSync(path) ?? "";
+	return text.split("\n").some(line => line.trim() != "" && !line.trim().startsWith("#") && !line.trim().startsWith("//"));
+}
+
+/** A plain grant as text (`node`, `-node`), one with an expiry or a server as an object. */
+function writeGrant(root: ConfigNode, path: string, grant: Grant) {
+	const text = grant.value ? grant.node : `-${grant.node}`;
+	if (grant.until == 0 && grant.server == "") return root.set(path, text);
+
+	root.set(`${path}.node`, text);
+	if (grant.until != 0) root.set(`${path}.until`, textOf(grant.until));
+	if (grant.server != "") root.set(`${path}.server`, grant.server);
+	return true;
+}
+
+function writeMembership(root: ConfigNode, path: string, membership: Membership) {
+	if (membership.until == 0 && membership.server == "") return root.set(path, membership.group);
+
+	root.set(`${path}.group`, membership.group);
+	if (membership.until != 0) root.set(`${path}.until`, textOf(membership.until));
+	if (membership.server != "") root.set(`${path}.server`, membership.server);
+	return true;
+}
+
+/** Writes the model into the file, keeping its comments on lines of their own. */
+export function writeFile() {
+	const root = configs.read(fileName);
+	root.remove("groups");
+	root.remove("users");
+
+	for (const group of allGroups()) {
+		const at = `groups.${group.name}`;
+		root.setNumber(`${at}.weight`, group.weight);
+		if (group.inherits.length > 0) root.setStrings(`${at}.inherits`, group.inherits);
+		group.grants.forEach((grant, i) => writeGrant(root, `${at}.permissions[${i}]`, grant));
+	}
+
+	allUsers().forEach((user, i) => {
+		const at = `users[${i}]`;
+		root.set(`${at}.id`, user.id);
+		if (user.name != "") root.set(`${at}.name`, user.name);
+		if (user.password != "") root.set(`${at}.password`, user.password);
+		user.groups.forEach((membership, j) => writeMembership(root, `${at}.groups[${j}]`, membership));
+		user.grants.forEach((grant, j) => writeGrant(root, `${at}.permissions[${j}]`, grant));
+	});
+
+	return root.save();
+}

package/src/import.ts

@@ -0,0 +1,63 @@
+/**
+ * `perms import users.ini`: AMX Mod X's admins, each line a player with his
+ * flags as `amxx.*` grants of his own.
+ *
+ *     "STEAM_0:0:123456" "" "abcdefghijklmnopqrstu" "ce"
+ *     "Bob"              "secret" "abc"               "a"
+ */
+import * as fs from "@amxts/core/fs";
+import { server } from "@amxts/core";
+import type { Grant, User } from "./model";
+import { allUsers, normalId } from "./model";
+import { FLAGS, sha256 } from "./players";
+
+/** The quoted words of a line, or the plain ones between spaces. */
+function wordsOf(line: string) {
+	const words: string[] = [];
+	let rest = line.trim();
+	while (rest != "") {
+		const quoted = rest.startsWith("\"");
+		const end = quoted ? rest.indexOf("\"", 1) : rest.indexOf(" ");
+		const stop = end < 0 ? rest.length : end;
+		words.push(rest.substring(quoted ? 1 : 0, stop));
+		rest = rest.substring(Math.min(rest.length, stop + 1)).trim();
+	}
+	return words;
+}
+
+function userOfLine(words: string[]) {
+	const auth = words[0];
+	const password = words.length > 1 ? words[1] : "";
+	const access = words.length > 2 ? words[2] : "";
+	const account = words.length > 3 ? words[3] : "";
+
+	const id = account.includes("c") ? auth : account.includes("d") ? `ip:${auth}` : `name:${auth}`;
+	const grants = FLAGS.filter(flag => access.includes(flag.letter)).map<Grant>(flag => ({ node: `amxx.${flag.name}`, value: true, until: 0, server: "" }));
+	const user: User = {
+		id: normalId(id),
+		name: id.startsWith("name:") ? auth : "",
+		password: id.startsWith("name:") && !account.includes("e") && password != "" ? sha256(password) : "",
+		groups: [],
+		grants,
+	};
+	return user;
+}
+
+/** Reads `users.ini` (or another file of the configs folder) into the model; how many players it held, -1 when there is no file. */
+export function importUsers(file: string) {
+	const text = fs.readFileSync(`${server.configsDir}/${file}`);
+	if (text == null) return -1;
+
+	const lines = text.split("\n").map<string>(line => line.trim()).filter(line => line != "" && !line.startsWith(";") && !line.startsWith("//"));
+	const users = allUsers();
+	for (const line of lines) {
+		const words = wordsOf(line);
+		if (words.length < 3 || words[0] == "") continue;
+
+		const user = userOfLine(words);
+		const at = users.findIndex(each => each.id == user.id);
+		if (at >= 0) users[at] = user;
+		else users.push(user);
+	}
+	return lines.length;
+}