add deleting, promoting/demoting, guesting (soft banning) users

views/topics/topic.etlua

@@ -15,14 +15,14 @@
 <% if thread_create_error == ThreadCreateError.OK then %>
 <a href=<%= url_for("thread_create", nil, {topic_id = topic.id}) %>>New thread</a>
 <% elseif thread_create_error == ThreadCreateError.GUEST then %>
-<p>Your account is still pending confirmation by an administrator. You are not able to create a new thread or post at this time.</p>
+<p>Your account is still pending confirmation by a moderator. You are not able to create a new thread or post at this time.</p>
 <% elseif thread_create_error == ThreadCreateError.LOGGED_OUT then %>
 <p>Only logged in users can create threads. <a href="<%= url_for("user_signup") %>">Sign up</a> or <a href="<%= url_for("user_login")%>">log in</a> to create a thread.</p>
 <% else %>
 <p>This topic is locked.</p>
 <% end %>
 
-<% if user:is_admin() then %>
+<% if user:is_mod() then %>
   <br>
   <a href="<%= url_for("topic_edit", {slug = topic.slug}) %>">Edit topic</a>
   <form method="post" action="<%= url_for("topic_edit", {slug = topic.slug}) %>">

views/topics/topics.etlua

@@ -11,6 +11,6 @@
   <% end %>
 <% end %>
 </ul>
-<% if user:is_admin() then %>
+<% if user:is_mod() then %>
 <a href="<%= url_for("topic_create") %>">Create new topic</a>
 <% end %>

views/user/delete_confirm.etlua

@@ -0,0 +1,12 @@
+<h1>Are you sure you want to delete your account, <%= user.username %>?</h1>
+<p>This cannot be undone. This will not delete your posts, only anonymize them.</p>
+<p>If you are sure, please type your password below.</p>
+
+<% if err then %>
+  <h2><%= err %></h2>
+<% end %>
+
+<form method="post" action="<%= url_for("user_delete", {username = user.username}) %>">
+  <input type="password" name="password" id="password" autocomplete="current-password" placeholder="Password" required><br>
+  <input type="submit" value="Delete my account (NO UNDO)">
+</form>

views/user/settings.etlua

@@ -1,18 +1,20 @@
 <h1>User settings</h1>
 <% if flash_msg then %>
-<h2><%= flash_msg %></h2>
+  <h2><%= flash_msg %></h2>
 <% end %>
 <form method="post" action="<%= url_for("user_set_avatar", {username = user.username}) %>" enctype="multipart/form-data">
-<img src="<%= avatar_url(user) %>"><br>
-<input type="file" name="avatar" accept="image/*"><br>
-<input type="submit" value="Update avatar">
+  <img src="<%= avatar_url(user) %>"><br>
+  <input type="file" name="avatar" accept="image/*"><br>
+  <input type="submit" value="Update avatar">
 <% if not user:is_default_avatar() then %>
-<input type="submit" value="Clear avatar" formaction="<%= url_for("user_clear_avatar", {username = user.username}) %>">
+  <input type="submit" value="Clear avatar" formaction="<%= url_for("user_clear_avatar", {username = user.username}) %>">
 <% end %>
 <br>
 </form>
 <form method="post" action="">
-<label for="status">Status</label>
-<input type="text" id="status" name="status" value="<%= user.status %>" maxlength="30"><br>
-<input type="submit" value="Save">
+  <label for="status">Status</label>
+  <input type="text" id="status" name="status" value="<%= user.status %>" maxlength="30"><br>
+  <input type="submit" value="Save">
 </form>
+<br>
+<a href="<%= url_for("user_delete_confirm", {username = user.username}) %>">Delete account</a>

views/user/signup.etlua

@@ -12,4 +12,4 @@
   <input type="password" id="password2" name="password2" pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_])(?!.*\s).{10,}" title="10+ chars with: 1 uppercase, 1 lowercase, 1 number, 1 special char, and no spaces" required autocomplete="new-password"><br>
   <input type="submit" value="Sign up">
 </form>
-<p>After you sign up, an administrator will need to confirm your account before you will be allowed to post.</p>
+<p>After you sign up, a moderator will need to confirm your account before you will be allowed to post.</p>

views/user/user.etlua

@@ -1,22 +1,41 @@
 <% if just_logged_in then %>
-<h1>Logged in successfully.</h1>
+  <h1>Logged in successfully.</h1>
 <% end %>
 <img src="<%= avatar_url(user) %>">
 <h1><%= user.username %></h1>
+<h2><%= PermissionLevelString[user.permission] %></h2>
 <% if user:is_guest() and user_is_me then %>
-<h2>You are a guest. An administrator needs to approve your account before you will be able to post.</h2>
+  <h2>You are a guest. An Moderator needs to approve your account before you will be able to post.</h2>
 <% end %>
 <% if user_is_me then %>
-<a href="<%= url_for("user_settings", {username = user.username}) %>">Settings</a>
-<form method="post" action="<%= url_for("user_logout", {user_id = me.id}) %>">
-<input type="submit" value="Log out">
-</form>
+  <a href="<%= url_for("user_settings", {username = user.username}) %>">Settings</a>
+  <form method="post" action="<%= url_for("user_logout", {user_id = me.id}) %>">
+    <input type="submit" value="Log out">
+  </form>
 <% end %>
-<% if me:is_admin() and user:is_guest() then %>
-<p>This user is a guest. They signed up on <%= os.date("%c", user.created_at) %>.</p>
-<form method="post" action="<%= url_for("confirm_user", {user_id = user.id}) %>">
-<input type="submit" value="Confirm user">
-</form>
-<% elseif me:is_admin() then %>
-<p>This user signed up on <%= os.date("%c", user.created_at) %> and was confirmed on <%= os.date("%c", user.confirmed_on) %>.</p>
+
+<% if me:is_mod() and not user:is_system() then %>
+  <h1>Moderator controls</h2>
+  <% if user:is_guest() then %>
+    <p>This user is a guest. They signed up on <%= os.date("%c", user.created_at) %>.</p>
+    <form method="post" action="<%= url_for("confirm_user", {user_id = user.id}) %>">
+      <input type="submit" value="Confirm user">
+    </form>
+  <% else %> <% --[[ user is not guest ]] %>
+    <p>This user signed up on <%= os.date("%c", user.created_at) %> and was confirmed on <%= os.date("%c", user.confirmed_on) %>.</p>
+    <% if user.id ~= me.id and user.permission < me.permission then %>
+    <form method="post" action="<%= url_for("guest_user", {user_id = user.id}) %>">
+      <input type="submit" value="Demote user to guest (soft ban)">
+    </form>
+    <% end %>
+    <% if me:is_admin() and not user:is_mod() then %>
+      <form method="post" action="<%= url_for("mod_user", {user_id = user.id}) %>">
+        <input type="submit" value="Promote user to moderator">
+      </form>
+    <% elseif me:is_admin() then %>
+      <form method="post" action="<%= url_for("demod_user", {user_id = user.id}) %>">
+        <input type="submit" value="Demote user to regular user">
+      </form>
+    <% end %>
+  <% end %>
 <% end %>