Merge branch 'lichess-org:master' into patch-7

Author: Carbrex

app/controllers/BulkPairing.scala

@@ -12,6 +12,12 @@ final class BulkPairing(env: Env) extends LilaController(env):
       JsonOk(Json.obj("bulks" -> list.map(SetupBulk.toJson)))
   }
 
+  def show(id: String) = ScopedBody(_.Challenge.Bulk) { _ ?=> me ?=>
+    env.challenge.bulk.findBy(id, me) map:
+      _.fold(notFoundJson()): bulk =>
+        JsonOk(SetupBulk.toJson(bulk))
+  }
+
   def delete(id: String) = ScopedBody(_.Challenge.Bulk) { _ ?=> me ?=>
     env.challenge.bulk.deleteBy(id, me) flatMap:
       if _ then jsonOkResult else notFoundJson()

app/controllers/Game.scala

@@ -116,12 +116,13 @@ final class Game(env: Env, apiC: => Api) extends LilaController(env):
         .as(pgnContentType)
   }
 
-  def exportByIds = AnonBodyOf(parse.tolerantText): body =>
+  def exportByIds = AnonOrScopedBody(parse.tolerantText)(): ctx ?=>
+    val (limit, perSec) = if ctx.me.exists(_.isVerifiedOrChallengeAdmin) then (600, 100) else (300, 30)
     val config = GameApiV2.ByIdsConfig(
-      ids = GameId from body.split(',').view.take(300).toSeq,
+      ids = GameId from ctx.body.body.split(',').view.take(limit).toSeq,
       format = GameApiV2.Format byRequest req,
       flags = requestPgnFlags(extended = false),
-      perSecond = MaxPerSecond(30),
+      perSecond = MaxPerSecond(perSec),
       playerFile = get("players")
     )
     apiC.GlobalConcurrencyLimitPerIP

app/controllers/OAuth.scala

@@ -129,14 +129,16 @@ final class OAuth(env: Env, apiC: => Api) extends LilaController(env):
 
   def challengeTokens = ScopedBody(_.Web.Mod) { ctx ?=> me ?=>
     if isGranted(_.ApiChallengeAdmin) then
-      lila.oauth.OAuthTokenForm.adminChallengeTokens
+      lila.oauth.OAuthTokenForm
+        .adminChallengeTokens()
         .bindFromRequest()
         .fold(
           jsonFormError,
           data =>
-            env.oAuth.tokenApi.adminChallengeTokens(data, me).map { tokens =>
-              JsonOk(tokens.view.mapValues(_.plain).toMap)
-            }
+            env.oAuth.tokenApi
+              .adminChallengeTokens(data, me)
+              .map: tokens =>
+                JsonOk(tokens.view.mapValues(_.plain).toMap)
         )
     else Unauthorized(jsonError("Missing permission"))
   }

conf/routes

@@ -702,6 +702,7 @@ GET   /api/cloud-eval                  controllers.Api.cloudEval
 POST  /api/import                      controllers.Importer.apiSendGame
 GET   /api/bulk-pairing                controllers.BulkPairing.list
 POST  /api/bulk-pairing                controllers.BulkPairing.create
+GET   /api/bulk-pairing/:id            controllers.BulkPairing.show(id)
 DELETE /api/bulk-pairing/:id           controllers.BulkPairing.delete(id)
 POST  /api/bulk-pairing/:id/start-clocks  controllers.BulkPairing.startClocks(id)
 

modules/challenge/src/main/ChallengeBulk.scala

@@ -42,7 +42,10 @@ final class ChallengeBulkApi(
   )
 
   def scheduledBy(me: User): Fu[List[ScheduledBulk]] =
-    coll.list[ScheduledBulk]($doc("by" -> me.id))
+    coll.find($doc("by" -> me.id)).sort($sort desc "pairAt").cursor[ScheduledBulk]().list(100)
+
+  def findBy(id: String, me: User): Fu[Option[ScheduledBulk]] =
+    coll.one[ScheduledBulk]($doc("_id" -> id, "by" -> me.id))
 
   def deleteBy(id: String, me: User): Fu[Boolean] =
     coll.delete.one($doc("_id" -> id, "by" -> me.id)).map(_.n == 1)
@@ -72,10 +75,12 @@ final class ChallengeBulkApi(
           makePairings(bulk).void
 
   private def checkForClocks: Funit =
-    coll.one[ScheduledBulk]($doc("startClocksAt" $lte nowInstant, "pairedAt" $exists true)) flatMapz: bulk =>
+    coll.one[ScheduledBulk](
+      $doc("startClocksAt" $lte nowInstant, "startedClocksAt" $exists false, "pairedAt" $exists true)
+    ) flatMapz: bulk =>
       workQueue(bulk.by):
-        fuccess:
-          Bus.publish(TellMany(bulk.games.map(_.id.value), StartClock), "roundSocket")
+        Bus.publish(TellMany(bulk.games.map(_.id.value), StartClock), "roundSocket")
+        coll.updateField($id(bulk.id), "startedClocksAt", nowInstant).void
 
   private def makePairings(bulk: ScheduledBulk): Funit =
     def timeControl =

modules/game/src/main/GamesByUsersStream.scala

@@ -8,10 +8,7 @@ import lila.common.Bus
 import lila.common.Json.given
 import lila.db.dsl.given
 
-final class GamesByUsersStream(gameRepo: lila.game.GameRepo)(using
-    mat: akka.stream.Materializer,
-    ec: Executor
-):
+final class GamesByUsersStream(gameRepo: lila.game.GameRepo)(using akka.stream.Materializer, Executor):
 
   private val chans = List("startGame", "finishGame")
 

modules/oauth/src/main/OAuthTokenForm.scala

@@ -21,11 +21,10 @@ object OAuthTokenForm:
 
   case class Data(description: String, scopes: List[String])
 
-  def adminChallengeTokens = Form(
+  def adminChallengeTokens(max: Int = 1000) = Form(
     mapping(
       "description" -> descriptionField,
-      "users" -> cleanText
-        .verifying("No more than 500 users", _.split(',').size <= 500)
+      "users"       -> cleanText.verifying(s"No more than $max users", _.split(',').sizeIs <= max)
     )(AdminChallengeTokensData.apply)(unapply)
   )
 

modules/setup/src/main/SetupBulk.scala

@@ -51,7 +51,7 @@ object SetupBulk:
     mapping(
       "players" -> nonEmptyText
         .verifying("Not enough tokens", t => extractTokenPairs(t).nonEmpty)
-        .verifying(s"Too many tokens (max: ${maxGames * 2})", t => extractTokenPairs(t).sizeIs < maxGames),
+        .verifying(s"Too many tokens (max: ${maxGames * 2})", t => extractTokenPairs(t).sizeIs <= maxGames),
       SetupForm.api.variant,
       SetupForm.api.clock,
       SetupForm.api.optionalDays,
@@ -225,7 +225,7 @@ final class SetupBulkApi(oauthServer: OAuthServer, idGenerator: IdGenerator)(usi
               .collect { case List(w, b) => (w, b) }
               .toList
             val nbGames = pairs.size
-            val cost    = nbGames * (if me.isVerified || me.isApiHog then 1 else 3)
+            val cost    = nbGames * (if me.isVerifiedOrChallengeAdmin || me.isApiHog then 1 else 3)
             rateLimit(me.id, fuccess(Left(ScheduleError.RateLimited)), cost = cost):
               lila.mon.api.challenge.bulk.scheduleNb(me.id.value).increment(nbGames)
               idGenerator

modules/user/src/main/User.scala

@@ -91,11 +91,12 @@ case class User(
 
   def addRole(role: String) = copy(roles = role :: roles)
 
-  def isVerified        = roles.exists(_ contains "ROLE_VERIFIED")
-  def isSuperAdmin      = roles.exists(_ contains "ROLE_SUPER_ADMIN")
-  def isAdmin           = roles.exists(_ contains "ROLE_ADMIN") || isSuperAdmin
-  def isApiHog          = roles.exists(_ contains "ROLE_API_HOG")
-  def isVerifiedOrAdmin = isVerified || isAdmin
+  def isVerified                 = roles.exists(_ contains "ROLE_VERIFIED")
+  def isSuperAdmin               = roles.exists(_ contains "ROLE_SUPER_ADMIN")
+  def isAdmin                    = roles.exists(_ contains "ROLE_ADMIN") || isSuperAdmin
+  def isApiHog                   = roles.exists(_ contains "ROLE_API_HOG")
+  def isVerifiedOrAdmin          = isVerified || isAdmin
+  def isVerifiedOrChallengeAdmin = isVerifiedOrAdmin || roles.exists(_ contains "ROLE_CHALLENGE_ADMIN")
 
   def has2fa = totpSecret.isDefined