feat: add auth_restriction separate from user restriction

Author: ddrayko

config/migrate.js

@@ -14,6 +14,7 @@ const tables = {
       { name: 'password_set', def: 'TINYINT(1) NOT NULL DEFAULT 0' },
       { name: 'is_admin', def: 'TINYINT(1) NOT NULL DEFAULT 0' },
       { name: 'restricted', def: 'TINYINT(1) NOT NULL DEFAULT 0' },
+      { name: 'auth_restricted', def: 'TINYINT(1) NOT NULL DEFAULT 0' },
       { name: 'avatar', def: 'VARCHAR(255) DEFAULT NULL' },
       { name: 'ptero_client_api_key', def: 'VARCHAR(255) DEFAULT NULL' },
       { name: 'created_at', def: 'TIMESTAMP DEFAULT CURRENT_TIMESTAMP' },

public/js/admin.js

@@ -858,7 +858,7 @@ async function renderAdminUserDetail(userId) {
             <div class="detail-item"><span class="detail-label">Username</span><span class="detail-value">${u.username}</span></div>
             <div class="detail-item"><span class="detail-label">Email</span><span class="detail-value">${u.email}</span></div>
             <div class="detail-item"><span class="detail-label">Role</span><span class="detail-value">${u.is_admin ? '<span class="server-card-status status-active" style="font-size:0.75rem">Admin</span>' : '<span class="server-card-status status-installing" style="font-size:0.75rem">User</span>'}</span></div>
-            <div class="detail-item"><span class="detail-label">Status</span><span class="detail-value">${u.restricted ? '<span class="server-card-status status-suspended" style="font-size:0.75rem">Restricted</span>' : '<span class="server-card-status status-active" style="font-size:0.75rem">Active</span>'}</span></div>
+            <div class="detail-item"><span class="detail-label">Status</span><span class="detail-value">${u.restricted ? '<span class="server-card-status status-suspended" style="font-size:0.75rem">Restricted</span>' : '<span class="server-card-status status-active" style="font-size:0.75rem">Active</span>'} ${u.auth_restricted ? '<span class="server-card-status status-suspended" style="font-size:0.75rem">Auth Restricted</span>' : ''}</span></div>
             <div class="detail-item"><span class="detail-label">Ptero ID</span><span class="detail-value" style="font-family:monospace">${u.ptero_user_id || 'N/A'}</span></div>
             <div class="detail-item"><span class="detail-label">API Key Set</span><span class="detail-value">${u.ptero_client_api_key ? 'Yes' : 'No'}</span></div>
             <div class="detail-item"><span class="detail-label">Created</span><span class="detail-value">${formatDateWithTooltip(u.created_at)}</span></div>
@@ -916,6 +916,7 @@ async function renderAdminUserDetail(userId) {
         <div style="display:flex;gap:8px;flex-wrap:wrap">
           <button class="btn ${u.is_admin ? 'btn-warning' : 'btn-primary'}" id="admin-btn-toggle-admin" style="width:auto">${u.is_admin ? 'Remove Admin' : 'Make Admin'}</button>
           <button class="btn ${u.restricted ? 'btn-primary' : 'btn-warning'}" id="admin-btn-toggle-restriction" style="width:auto">${u.restricted ? 'Unrestrict User' : 'Restrict User'}</button>
+          <button class="btn ${u.auth_restricted ? 'btn-primary' : 'btn-warning'}" id="admin-btn-toggle-auth-restriction" style="width:auto">${u.auth_restricted ? 'Unrestrict Auth' : 'Restrict Auth'}</button>
           <button class="btn btn-danger" id="admin-btn-delete-user" style="width:auto">Delete User</button>
         </div>
         <div id="admin-user-action-msg" style="margin-top:12px;display:none"></div>
@@ -980,6 +981,22 @@ function initUserActions(userId) {
     }
   });
 
+  $a('#admin-btn-toggle-auth-restriction')?.addEventListener('click', async () => {
+    const btn = $a('#admin-btn-toggle-auth-restriction');
+    btn.disabled = true;
+    btn.innerHTML = '<span class="spinner"></span> Updating...';
+    clearMsg();
+    try {
+      const data = await adminApi(`/users/${userId}/toggle-auth-restriction`, { method: 'POST' });
+      showMsg(data.auth_restricted ? 'Auth restricted' : 'Auth unrestricted');
+      setTimeout(() => renderAdminUserDetail(userId), 1500);
+    } catch (err) {
+      showMsg(err.message, 'error');
+      btn.disabled = false;
+      btn.innerHTML = 'Toggle Auth Restriction';
+    }
+  });
+
   $a('#admin-btn-delete-user')?.addEventListener('click', async () => {
     if (!confirm('Are you sure you want to permanently delete this user? All their servers will be deleted. This action cannot be undone.')) return;
     const btn = $a('#admin-btn-delete-user');

routes/admin.js

@@ -36,7 +36,7 @@ router.post('/login', async (req, res) => {
     }
 
     const user = users[0];
-    if (user.restricted) {
+    if (user.auth_restricted) {
       return res.status(403).json({ error: 'Your account has been restricted. Contact support for assistance.' });
     }
     if (!user.is_admin) {
@@ -266,7 +266,7 @@ router.get('/users/:id', authenticateToken, requireAdmin, async (req, res) => {
     }
 
     const users = await query(
-      'SELECT id, email, username, is_admin, restricted, ptero_user_id, ptero_client_api_key, created_at FROM users WHERE id = ?',
+      'SELECT id, email, username, is_admin, restricted, auth_restricted, ptero_user_id, ptero_client_api_key, created_at FROM users WHERE id = ?',
       [userId]
     );
     if (users.length === 0) {
@@ -331,6 +331,33 @@ router.post('/users/:id/toggle-restriction', authenticateToken, requireAdmin, as
   }
 });
 
+router.post('/users/:id/toggle-auth-restriction', authenticateToken, requireAdmin, async (req, res) => {
+  try {
+    const userId = parseInt(req.params.id, 10);
+    if (isNaN(userId)) {
+      return res.status(400).json({ error: 'Invalid user ID' });
+    }
+
+    if (userId === req.user.userId) {
+      return res.status(400).json({ error: 'You cannot restrict your own auth' });
+    }
+
+    const users = await query('SELECT auth_restricted FROM users WHERE id = ?', [userId]);
+    if (users.length === 0) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+
+    const newStatus = users[0].auth_restricted ? 0 : 1;
+    await query('UPDATE users SET auth_restricted = ? WHERE id = ?', [newStatus, userId]);
+
+    await logActivity(req.user.userId, 'admin_toggle_auth_restriction', `${newStatus ? 'Auth restricted' : 'Auth unrestricted'} user #${userId}`);
+    res.json({ success: true, auth_restricted: !!newStatus });
+  } catch (err) {
+    console.error('Admin toggle-auth-restriction error:', err.message);
+    res.status(500).json({ error: 'Failed to toggle auth restriction status' });
+  }
+});
+
 router.post('/users/:id/toggle-admin', authenticateToken, requireAdmin, async (req, res) => {
   try {
     const userId = parseInt(req.params.id, 10);

routes/auth.js

@@ -198,7 +198,7 @@ router.post('/login', async (req, res) => {
 
     if (process.env.NODE_ENV !== 'production') console.log('[LOGIN] User found:', { id: user.id, email: user.email });
 
-    if (user.restricted) {
+    if (user.auth_restricted) {
       return res.status(403).json({ error: 'Your account has been restricted. Contact support for assistance.' });
     }