[Server/Client/Protocol] Reporting users + moderation queue functionality (#7091)

* [Server/Client/Protocol] Reporting users + moderation queue functionality

Took 6 minutes

Took 3 minutes

Took 8 seconds

Took 11 minutes

Took 12 minutes

Took 7 minutes

Took 15 seconds

Took 2 minutes

Took 1 minute


Took 30 seconds

Took 16 seconds

* CI Fix

Took 6 minutes

* CI Fix

Took 6 minutes

* [Protocol] Add moderation investigation commands

Adds the protocol layer for the moderation investigation suite:
- Command_GetUserSessions/GetUserAlts/GetModeratorLastLogins/ResetUserPassword/RemoveUserAvatar (1013-1017)
- Response extensions 1215-1219 with ServerInfo messages for sessions, alts, and staff logins
- last_login on Response_ReportUserInfo and warning_il on Response_WarnList

Took 2 minutes

* [Utility] Add warning categories parser with infraction levels

Parses the server's 'officialwarnings' setting (comma-separated, optional
'|IL' suffix) into WarningCategory structs so the client can display the
infraction level of each warning category. Includes GTest coverage.

* [Server] Add moderation investigation tools

Implements the server side of the moderation suite:
- getUserSessions/getUserAlts/getModeratorLastLogins/removeUserAvatar DB methods
- Handlers for all five new commands with audit records (PASSWORD_RESET,
  REMOVE_USER_AVATAR); password resets return a generated temporary password
- cmdGetWarnList now reports per-category infraction levels from the
  officialwarnings setting; cmdReportUserInfo reports last_login
- Update servatrice.ini.example with the warning taxonomy
- Password/avatar mutations report RespNameNotFound when the user does not exist

* [Client] Add moderation tab with investigate, password reset, and avatar removal

- New Moderation tab: search a user to show account info, alternate
  accounts, login sessions, and staff last logins; actions to reset the
  user's password (shows the generated temporary password) and remove the
  user's avatar
- 'Investigate user' entry in the user context menu opens the tab pre-loaded
  for that user
- Warning dialog shows the infraction level of each warning category
- Tab wired into TabSupervisor with a moderator-gated menu action, shortcut,
  and tabs.ini persistence (default closed)

* [Server/Client/Protocol] Address PR #7091 review: security, bug, and perf fixes

Security:
- Promote RESET_USER_PASSWORD to admin-only dispatch (was moderator-accessible)
- Reject password reset on users with equal/higher privilege than caller
- Notify affected user via Event_NotifyUser::CUSTOM when password is reset
- Add server-side category whitelist for reports
- Drop reporter name fallback in comment/details authorization (ID-only)
- Force password change: new DB column + login enforcement + client disconnect

Bugs:
- XSS via QTextEdit::append() → insertPlainText() in report tab and utils
- allNotified initialized to true even with empty recipients list
- Warning combo box: use currentData() instead of baked-in display text
- Report resolution now records who resolved (resolved_by column + audit)

Performance:
- IP-correlation subquery: add 6-month window + LIMIT 200
- getUserSessions: clamp limit to 500

Non-blocking:
- Palette-aware colors in report_utils.cpp (dark/light mode)
- Report list pagination: offset/limit fields + total_count in response
- SessionCommand enum gap comment for reserved values 1201-1203

Schema: 36→37 (force_password_change), 37→38 (resolved_by)

Took 12 minutes


Took 16 seconds

* Fix macOs pedantry

Took 5 minutes

---------

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

libcockatrice_utility/CMakeLists.txt

@@ -5,8 +5,9 @@ set(CMAKE_AUTOMOC ON)
 set(CMAKE_AUTOUIC ON)
 set(CMAKE_AUTORCC ON)
 
-set(UTILITY_SOURCES libcockatrice/utility/expression.cpp libcockatrice/utility/levenshtein.cpp
-                    libcockatrice/utility/passwordhasher.cpp libcockatrice/utility/server_rate_limiter.cpp
+set(UTILITY_SOURCES
+    libcockatrice/utility/expression.cpp libcockatrice/utility/levenshtein.cpp libcockatrice/utility/passwordhasher.cpp
+    libcockatrice/utility/server_rate_limiter.cpp libcockatrice/utility/warning_categories.cpp
 )
 
 set(UTILITY_HEADERS
@@ -24,6 +25,7 @@ set(UTILITY_HEADERS
     libcockatrice/utility/zone_names.h
     libcockatrice/utility/days_years_between.h
     libcockatrice/utility/server_rate_limiter.h
+    libcockatrice/utility/warning_categories.h
 )
 
 add_library(libcockatrice_utility STATIC ${UTILITY_SOURCES} ${UTILITY_HEADERS})

libcockatrice_utility/libcockatrice/utility/string_limits.h

@@ -22,6 +22,19 @@ inline QString textFromStdString(const std::string &_string)
 {
     return QString::fromUtf8(_string.data(), std::min(int(_string.size()), MAX_TEXT_LENGTH));
 }
+/** @brief Returns a QString from a std::string, truncated to at most MAX_TEXT_LENGTH bytes, keeping the tail. */
+inline QString textTailFromStdString(const std::string &_string)
+{
+    if (int(_string.size()) <= MAX_TEXT_LENGTH) {
+        return QString::fromUtf8(_string.data(), int(_string.size()));
+    }
+
+    int start = int(_string.size()) - MAX_TEXT_LENGTH;
+    while (start < int(_string.size()) && (static_cast<unsigned char>(_string[start]) & 0xC0) == 0x80) {
+        ++start;
+    }
+    return QString::fromUtf8(_string.data() + start, int(_string.size()) - start);
+}
 /** @brief Returns a QString from a std::string, truncated to at most MAX_FILE_LENGTH bytes. */
 inline QString fileFromStdString(const std::string &_string)
 {

libcockatrice_utility/libcockatrice/utility/warning_categories.cpp

@@ -0,0 +1,24 @@
+#include "warning_categories.h"
+
+QList<WarningCategory> parseWarningCategories(const QString &value)
+{
+    QList<WarningCategory> categories;
+    const QStringList entries = value.split(',', Qt::SkipEmptyParts);
+    for (const QString &entry : entries) {
+        const QStringList parts = entry.split('|');
+        WarningCategory category;
+        category.name = parts.first().trimmed();
+        if (category.name.isEmpty()) {
+            continue;
+        }
+        if (parts.size() > 1) {
+            bool ok = false;
+            const int il = parts.at(1).trimmed().toInt(&ok);
+            if (ok && il > 0) {
+                category.startingIl = il;
+            }
+        }
+        categories.append(category);
+    }
+    return categories;
+}

libcockatrice_utility/libcockatrice/utility/warning_categories.h

@@ -0,0 +1,28 @@
+#ifndef WARNING_CATEGORIES_H
+#define WARNING_CATEGORIES_H
+
+#include <QList>
+#include <QString>
+
+/**
+ * A warning category the server offers to moderators, optionally carrying a
+ * recommended starting intervention level (see the moderator guide).
+ */
+struct WarningCategory
+{
+    QString name;
+    int startingIl = 1;
+};
+
+/**
+ * Parses the `server/officialwarnings` setting value into warning categories.
+ *
+ * Entries are separated by commas. Each entry is a category name, optionally
+ * followed by "|" and the recommended starting intervention level:
+ *   "Abusive Language|1,Cheating|2,Spamming"
+ * Entries without an explicit level default to intervention level 1.
+ * Empty entries are skipped.
+ */
+QList<WarningCategory> parseWarningCategories(const QString &value);
+
+#endif // WARNING_CATEGORIES_H