1 files changed, 52 insertions, 30 deletions

diff --git a/app/models/user.rb b/app/models/user.rb
index 325e27f44..326b871a1 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -3,9 +3,8 @@
 #
 # Table name: users
 #
-#  id                        :integer          not null, primary key
+#  id                        :bigint           not null, primary key
 #  email                     :string           default(""), not null
-#  account_id                :integer          not null
 #  created_at                :datetime         not null
 #  updated_at                :datetime         not null
 #  encrypted_password        :string           default(""), not null
@@ -31,10 +30,14 @@
 #  last_emailed_at           :datetime
 #  otp_backup_codes          :string           is an Array
 #  filtered_languages        :string           default([]), not null, is an Array
+#  account_id                :bigint           not null
+#  disabled                  :boolean          default(FALSE), not null
+#  moderator                 :boolean          default(FALSE), not null
 #
 
 class User < ApplicationRecord
   include Settings::Extend
+
   ACTIVE_DURATION = 14.days
 
   devise :registerable, :recoverable,
@@ -51,8 +54,10 @@ class User < ApplicationRecord
   validates :locale, inclusion: I18n.available_locales.map(&:to_s), if: :locale?
   validates_with BlacklistedEmailValidator, if: :email_changed?
 
-  scope :recent,    -> { order(id: :desc) }
-  scope :admins,    -> { where(admin: true) }
+  scope :recent, -> { order(id: :desc) }
+  scope :admins, -> { where(admin: true) }
+  scope :moderators, -> { where(moderator: true) }
+  scope :staff, -> { admins.or(moderators) }
   scope :confirmed, -> { where.not(confirmed_at: nil) }
   scope :inactive, -> { where(arel_table[:current_sign_in_at].lt(ACTIVE_DURATION.ago)) }
   scope :active, -> { confirmed.where(arel_table[:current_sign_in_at].gteq(ACTIVE_DURATION.ago)).joins(:account).where(accounts: { suspended: false }) }
@@ -68,54 +73,71 @@ class User < ApplicationRecord
 
   has_many :session_activations, dependent: :destroy
 
+  delegate :auto_play_gif, :default_sensitive, :unfollow_modal, :boost_modal, :delete_modal,
+           :reduce_motion, :system_font_ui, :noindex, :theme,
+           to: :settings, prefix: :setting, allow_nil: false
+
   def confirmed?
     confirmed_at.present?
   end
 
-  def disable_two_factor!
-    self.otp_required_for_login = false
-    otp_backup_codes&.clear
-    save!
-  end
-
-  def setting_default_privacy
-    settings.default_privacy || (account.locked? ? 'private' : 'public')
+  def staff?
+    admin? || moderator?
   end
 
-  def setting_default_sensitive
-    settings.default_sensitive
+  def role
+    if admin?
+      'admin'
+    elsif moderator?
+      'moderator'
+    else
+      'user'
+    end
   end
 
-  def setting_unfollow_modal
-    settings.unfollow_modal
+  def disable!
+    update!(disabled: true,
+            last_sign_in_at: current_sign_in_at,
+            current_sign_in_at: nil)
   end
 
-  def setting_boost_modal
-    settings.boost_modal
+  def enable!
+    update!(disabled: false)
   end
 
-  def setting_delete_modal
-    settings.delete_modal
+  def confirm!
+    skip_confirmation!
+    save!
   end
 
-  def setting_auto_play_gif
-    settings.auto_play_gif
+  def promote!
+    if moderator?
+      update!(moderator: false, admin: true)
+    elsif !admin?
+      update!(moderator: true)
+    end
   end
 
-  def setting_reduce_motion
-    settings.reduce_motion
+  def demote!
+    if admin?
+      update!(admin: false, moderator: true)
+    elsif moderator?
+      update!(moderator: false)
+    end
   end
 
-  def setting_system_font_ui
-    settings.system_font_ui
+  def disable_two_factor!
+    self.otp_required_for_login = false
+    otp_backup_codes&.clear
+    save!
   end
 
-  def setting_noindex
-    settings.noindex
+  def active_for_authentication?
+    super && !disabled?
   end
 
-  def setting_theme
-    settings.theme
+  def setting_default_privacy
+    settings.default_privacy || (account.locked? ? 'private' : 'public')
   end
 
   def token_for_app(a)