blockmine 1.18.3 → 1.19.0

package/backend/prisma/migrations/20250816083216_add_panel_user_bot_access/migration.sql

@@ -0,0 +1,30 @@
+-- CreateTable
+CREATE TABLE "PanelUserBotAccess" (
+    "userId" INTEGER NOT NULL,
+    "botId" INTEGER NOT NULL,
+
+    PRIMARY KEY ("userId", "botId"),
+    CONSTRAINT "PanelUserBotAccess_userId_fkey" FOREIGN KEY ("userId") REFERENCES "PanelUser" ("id") ON DELETE CASCADE ON UPDATE CASCADE,
+    CONSTRAINT "PanelUserBotAccess_botId_fkey" FOREIGN KEY ("botId") REFERENCES "Bot" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+-- RedefineTables
+PRAGMA defer_foreign_keys=ON;
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_PanelUser" (
+    "id" INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    "uuid" TEXT NOT NULL,
+    "username" TEXT NOT NULL,
+    "passwordHash" TEXT NOT NULL,
+    "roleId" INTEGER NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "allBots" BOOLEAN NOT NULL DEFAULT true,
+    CONSTRAINT "PanelUser_roleId_fkey" FOREIGN KEY ("roleId") REFERENCES "PanelRole" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+INSERT INTO "new_PanelUser" ("createdAt", "id", "passwordHash", "roleId", "username", "uuid") SELECT "createdAt", "id", "passwordHash", "roleId", "username", "uuid" FROM "PanelUser";
+DROP TABLE "PanelUser";
+ALTER TABLE "new_PanelUser" RENAME TO "PanelUser";
+CREATE UNIQUE INDEX "PanelUser_uuid_key" ON "PanelUser"("uuid");
+CREATE UNIQUE INDEX "PanelUser_username_key" ON "PanelUser"("username");
+PRAGMA foreign_keys=ON;
+PRAGMA defer_foreign_keys=OFF;

package/backend/prisma/migrations/migration_lock.toml

@@ -1,3 +1,3 @@
-# Please do not edit this file manually
-# It should be added in your version-control system (i.e. Git)
+# Please do not edit this file manually
+# It should be added in your version-control system (i.e. Git)
 provider = "sqlite"

package/backend/prisma/schema.prisma

@@ -1,229 +1,244 @@
-generator client {
-  provider = "prisma-client-js"
-}
-
-datasource db {
-  provider = "sqlite"
-  url      = env("DATABASE_URL")
-}
-
-model Server {
-  id      Int    @id @default(autoincrement())
-  name    String @unique
-  host    String
-  port    Int    @default(25565)
-  version String
-  bots    Bot[]
-}
-
-model Bot {
-  id       Int    @id @default(autoincrement())
-  username String @unique
-  password String?
-  prefix   String? @default("@")
-  note     String?
-  owners   String? @default("")
-  sortOrder Int?
-
-  server   Server @relation(fields: [serverId], references: [id])
-  serverId Int
-
-  proxyHost     String?
-  proxyPort     Int?
-  proxyUsername String?
-  proxyPassword String?
-
-  installedPlugins InstalledPlugin[]
-  users            User[]
-  groups           Group[]
-  permissions      Permission[]
-  commands         Command[]
-  eventGraphs      EventGraph[]
-  pluginData       PluginDataStore[]
-
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-}
-
-
-model InstalledPlugin {
-  id          Int     @id @default(autoincrement())
-  botId       Int
-  bot         Bot     @relation(fields: [botId], references: [id], onDelete: Cascade)
-  name        String
-  version     String
-  description String?
-  sourceType  String
-  sourceUri   String?
-  path        String
-  isEnabled   Boolean @default(true)
-
-  manifest String?
-  settings String? @default("{}")
-
-  createdAt DateTime @default(now())
-
-  commands    Command[]
-  eventGraphs EventGraph[]
-
-  @@unique([botId, name])
-}
-
-model Command {
-  id               Int     @id @default(autoincrement())
-  botId            Int
-  bot              Bot     @relation(fields: [botId], references: [id], onDelete: Cascade)
-  name             String
-  isEnabled        Boolean @default(true)
-  cooldown         Int     @default(0)
-  aliases          String  @default("[]")
-  description      String?
-  owner            String?
-  permissionId     Int?
-  permission       Permission? @relation(fields: [permissionId], references: [id], onDelete: SetNull)
-  allowedChatTypes String  @default("[\"chat\", \"private\"]")
-
-  isVisual         Boolean @default(false)
-  argumentsJson    String? @default("[]")
-  graphJson        String? @default("null")
-  
-  pluginOwnerId    Int?
-  pluginOwner      InstalledPlugin? @relation(fields: [pluginOwnerId], references: [id], onDelete: SetNull)
-
-  @@unique([botId, name])
-}
-
-model EventGraph {
-  id          Int     @id @default(autoincrement())
-  botId       Int
-  bot         Bot     @relation(fields: [botId], references: [id], onDelete: Cascade)
-  name        String
-  isEnabled   Boolean @default(true)
-  graphJson   String? @default("null")
-  variables   String? @default("[]")
-
-  triggers    EventTrigger[]
-
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-  
-  pluginOwnerId    Int?
-  pluginOwner      InstalledPlugin? @relation(fields: [pluginOwnerId], references: [id], onDelete: SetNull)
-
-  @@unique([botId, name])
-}
-
-model EventTrigger {
-  id        Int      @id @default(autoincrement())
-  graphId   Int
-  graph     EventGraph @relation(fields: [graphId], references: [id], onDelete: Cascade)
-  eventType String   // e.g., "entitySpawn", "chat"
-
-  @@unique([graphId, eventType])
-}
-
-model User {
-  id            Int       @id @default(autoincrement())
-  username      String
-  isBlacklisted Boolean   @default(false)
-  botId         Int
-  bot           Bot       @relation(fields: [botId], references: [id], onDelete: Cascade)
-  groups        UserGroup[]
-
-  @@unique([botId, username])
-}
-
-model Group {
-  id          Int             @id @default(autoincrement())
-  name        String
-  owner       String          @default("system")
-  botId       Int
-  bot         Bot             @relation(fields: [botId], references: [id], onDelete: Cascade)
-  permissions GroupPermission[]
-  users       UserGroup[]
-
-  @@unique([botId, name])
-}
-
-model Permission {
-  id          Int             @id @default(autoincrement())
-  name        String
-  description String?
-  owner       String          @default("system")
-  botId       Int
-  bot         Bot             @relation(fields: [botId], references: [id], onDelete: Cascade)
-  groups      GroupPermission[]
-  commands    Command[] 
-
-  @@unique([botId, name])
-}
-
-
-model UserGroup {
-  user    User  @relation(fields: [userId], references: [id], onDelete: Cascade)
-  userId  Int
-  group   Group @relation(fields: [groupId], references: [id], onDelete: Cascade)
-  groupId Int
-
-  @@id([userId, groupId])
-}
-
-model GroupPermission {
-  group        Group      @relation(fields: [groupId], references: [id], onDelete: Cascade)
-  groupId      Int
-  permission   Permission @relation(fields: [permissionId], references: [id], onDelete: Cascade)
-  permissionId Int
-
-  @@id([groupId, permissionId])
-}
-
-
-
-model ScheduledTask {
-  id           Int        @id @default(autoincrement())
-  name         String
-  cronPattern  String?
-  action       String
-  targetBotIds String // джсон массив ID ботов или "ALL"
-  payload      String?    @default("{}") // джсон для доп данных, например, команды
-  isEnabled    Boolean    @default(true)
-  runOnStartup Boolean    @default(false)
-  lastRun      DateTime?
-  createdAt    DateTime   @default(now())
-  updatedAt    DateTime   @updatedAt
-}
-
-model PanelUser {
-  id           Int      @id @default(autoincrement())
-  uuid         String   @unique @default(uuid())
-  username     String   @unique
-  passwordHash String  
-  role         PanelRole @relation(fields: [roleId], references: [id])
-  roleId       Int
-  createdAt    DateTime @default(now())
-}
-
-// Роли пользователей (Admin, Moderator, Viewer)
-model PanelRole {
-  id          Int      @id @default(autoincrement())
-  name        String   @unique 
-  
-  // Храним права как джсон строку.  SQLite не поддерживает массивы.
-  // Пример: '[\"bot:create\", \"bot:delete\", \"user:manage\"]'
-  permissions String   @default("[]") 
-  users       PanelUser[]
-}
-
-model PluginDataStore {
-  id         Int      @id @default(autoincrement())
-  pluginName String
-  botId      Int
-  key        String
-  value      String // в виде json
-  createdAt  DateTime @default(now())
-  updatedAt  DateTime @updatedAt
-
-  bot Bot @relation(fields: [botId], references: [id], onDelete: Cascade)
-
-  @@unique([pluginName, botId, key])
-}
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "sqlite"
+  url      = env("DATABASE_URL")
+}
+
+model Server {
+  id      Int    @id @default(autoincrement())
+  name    String @unique
+  host    String
+  port    Int    @default(25565)
+  version String
+  bots    Bot[]
+}
+
+model Bot {
+  id       Int    @id @default(autoincrement())
+  username String @unique
+  password String?
+  prefix   String? @default("@")
+  note     String?
+  owners   String? @default("")
+  sortOrder Int?
+
+  server   Server @relation(fields: [serverId], references: [id])
+  serverId Int
+
+  proxyHost     String?
+  proxyPort     Int?
+  proxyUsername String?
+  proxyPassword String?
+
+  installedPlugins InstalledPlugin[]
+  users            User[]
+  groups           Group[]
+  permissions      Permission[]
+  commands         Command[]
+  eventGraphs      EventGraph[]
+  pluginData       PluginDataStore[]
+
+  panelUserAccess  PanelUserBotAccess[]
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+}
+
+
+model InstalledPlugin {
+  id          Int     @id @default(autoincrement())
+  botId       Int
+  bot         Bot     @relation(fields: [botId], references: [id], onDelete: Cascade)
+  name        String
+  version     String
+  description String?
+  sourceType  String
+  sourceUri   String?
+  path        String
+  isEnabled   Boolean @default(true)
+
+  manifest String?
+  settings String? @default("{}")
+
+  createdAt DateTime @default(now())
+
+  commands    Command[]
+  eventGraphs EventGraph[]
+
+  @@unique([botId, name])
+}
+
+model Command {
+  id               Int     @id @default(autoincrement())
+  botId            Int
+  bot              Bot     @relation(fields: [botId], references: [id], onDelete: Cascade)
+  name             String
+  isEnabled        Boolean @default(true)
+  cooldown         Int     @default(0)
+  aliases          String  @default("[]")
+  description      String?
+  owner            String?
+  permissionId     Int?
+  permission       Permission? @relation(fields: [permissionId], references: [id], onDelete: SetNull)
+  allowedChatTypes String  @default("[\"chat\", \"private\"]")
+
+  isVisual         Boolean @default(false)
+  argumentsJson    String? @default("[]")
+  graphJson        String? @default("null")
+  
+  pluginOwnerId    Int?
+  pluginOwner      InstalledPlugin? @relation(fields: [pluginOwnerId], references: [id], onDelete: SetNull)
+
+  @@unique([botId, name])
+}
+
+model EventGraph {
+  id          Int     @id @default(autoincrement())
+  botId       Int
+  bot         Bot     @relation(fields: [botId], references: [id], onDelete: Cascade)
+  name        String
+  isEnabled   Boolean @default(true)
+  graphJson   String? @default("null")
+  variables   String? @default("[]")
+
+  triggers    EventTrigger[]
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+  
+  pluginOwnerId    Int?
+  pluginOwner      InstalledPlugin? @relation(fields: [pluginOwnerId], references: [id], onDelete: SetNull)
+
+  @@unique([botId, name])
+}
+
+model EventTrigger {
+  id        Int      @id @default(autoincrement())
+  graphId   Int
+  graph     EventGraph @relation(fields: [graphId], references: [id], onDelete: Cascade)
+  eventType String   // e.g., "entitySpawn", "chat"
+
+  @@unique([graphId, eventType])
+}
+
+model User {
+  id            Int       @id @default(autoincrement())
+  username      String
+  isBlacklisted Boolean   @default(false)
+  botId         Int
+  bot           Bot       @relation(fields: [botId], references: [id], onDelete: Cascade)
+  groups        UserGroup[]
+
+  @@unique([botId, username])
+}
+
+model Group {
+  id          Int             @id @default(autoincrement())
+  name        String
+  owner       String          @default("system")
+  botId       Int
+  bot         Bot             @relation(fields: [botId], references: [id], onDelete: Cascade)
+  permissions GroupPermission[]
+  users       UserGroup[]
+
+  @@unique([botId, name])
+}
+
+model Permission {
+  id          Int             @id @default(autoincrement())
+  name        String
+  description String?
+  owner       String          @default("system")
+  botId       Int
+  bot         Bot             @relation(fields: [botId], references: [id], onDelete: Cascade)
+  groups      GroupPermission[]
+  commands    Command[] 
+
+  @@unique([botId, name])
+}
+
+
+model UserGroup {
+  user    User  @relation(fields: [userId], references: [id], onDelete: Cascade)
+  userId  Int
+  group   Group @relation(fields: [groupId], references: [id], onDelete: Cascade)
+  groupId Int
+
+  @@id([userId, groupId])
+}
+
+model GroupPermission {
+  group        Group      @relation(fields: [groupId], references: [id], onDelete: Cascade)
+  groupId      Int
+  permission   Permission @relation(fields: [permissionId], references: [id], onDelete: Cascade)
+  permissionId Int
+
+  @@id([groupId, permissionId])
+}
+
+
+
+model ScheduledTask {
+  id           Int        @id @default(autoincrement())
+  name         String
+  cronPattern  String?
+  action       String
+  targetBotIds String // джсон массив ID ботов или "ALL"
+  payload      String?    @default("{}") // джсон для доп данных, например, команды
+  isEnabled    Boolean    @default(true)
+  runOnStartup Boolean    @default(false)
+  lastRun      DateTime?
+  createdAt    DateTime   @default(now())
+  updatedAt    DateTime   @updatedAt
+}
+
+model PanelUser {
+  id           Int      @id @default(autoincrement())
+  uuid         String   @unique @default(uuid())
+  username     String   @unique
+  passwordHash String  
+  role         PanelRole @relation(fields: [roleId], references: [id])
+  roleId       Int
+  createdAt    DateTime @default(now())
+
+  allBots      Boolean  @default(true)
+
+  botAccess    PanelUserBotAccess[]
+}
+
+// Роли пользователей (Admin, Moderator, Viewer)
+model PanelRole {
+  id          Int      @id @default(autoincrement())
+  name        String   @unique 
+  
+  // Храним права как джсон строку.  SQLite не поддерживает массивы.
+  // Пример: '[\"bot:create\", \"bot:delete\", \"user:manage\"]'
+  permissions String   @default("[]") 
+  users       PanelUser[]
+}
+
+model PanelUserBotAccess {
+  user   PanelUser @relation(fields: [userId], references: [id], onDelete: Cascade)
+  userId Int
+  bot    Bot       @relation(fields: [botId], references: [id], onDelete: Cascade)
+  botId  Int
+
+  @@id([userId, botId])
+}
+
+model PluginDataStore {
+  id         Int      @id @default(autoincrement())
+  pluginName String
+  botId      Int
+  key        String
+  value      String // в виде json
+  createdAt  DateTime @default(now())
+  updatedAt  DateTime @updatedAt
+
+  bot Bot @relation(fields: [botId], references: [id], onDelete: Cascade)
+
+  @@unique([pluginName, botId, key])
+}

package/backend/src/api/middleware/botAccess.js

@@ -0,0 +1,35 @@
+const { PrismaClient } = require('@prisma/client');
+const prisma = new PrismaClient();
+
+/**
+ * Проверяет доступ текущего panelUser (из req.user.userId) к botId из params
+ * Если у пользователя allBots=true (или поля нет), доступ разрешен.
+ * Иначе проверяется наличие записи в PanelUserBotAccess.
+ */
+async function checkBotAccess(req, res, next) {
+	try {
+		const userId = req.user?.userId;
+		if (!userId) return res.status(401).json({ error: 'Неавторизовано' });
+
+		const botIdRaw = req.params.botId ?? req.params.id;
+		const botId = parseInt(botIdRaw, 10);
+		if (isNaN(botId)) return res.status(400).json({ error: 'Некорректный botId' });
+
+		const user = await prisma.panelUser.findUnique({
+			where: { id: userId },
+			include: { botAccess: { select: { botId: true } } }
+		});
+		if (!user) return res.status(401).json({ error: 'Пользователь не найден' });
+
+		// Если поле allBots отсутствует (старый клиент) — считаем true
+		if (user.allBots !== false) return next();
+		const allowed = user.botAccess.some((a) => a.botId === botId);
+		if (!allowed) return res.status(403).json({ error: 'Доступ к боту запрещен' });
+		return next();
+	} catch (e) {
+		console.error('[checkBotAccess] error', e);
+		return res.status(500).json({ error: 'Ошибка проверки доступа' });
+	}
+}
+
+module.exports = { checkBotAccess };