Implement role and user management enhancements

- Added MaxIpLimit to roles, allowing for the configuration of simultaneous IP limits for users.
- Updated role creation and update commands to include MaxIpLimit, ensuring proper handling in the application logic.
- Enhanced user management by introducing a DELETE endpoint for user accounts, with appropriate checks to prevent self-deletion.
- Updated documentation to reflect changes in role and user management, clarifying the new IP limit functionality and user deletion process.
- Adjusted related tests to cover new functionality and ensure robust validation of role and user management features.

backend/src/PnvPanel.Application/Admin/Roles/CreateRoleCommand.cs

@@ -4,4 +4,4 @@ using PnvPanel.Application.Common.Models;
 
 namespace PnvPanel.Application.Admin.Roles;
 
-public sealed record CreateRoleCommand(string Name, int MaxConfigs) : ICommand<Result<RoleDto>>;
+public sealed record CreateRoleCommand(string Name, int MaxConfigs, int MaxIpLimit) : ICommand<Result<RoleDto>>;

backend/src/PnvPanel.Application/Admin/Roles/CreateRoleCommandHandler.cs

@@ -7,5 +7,5 @@ namespace PnvPanel.Application.Admin.Roles;
 public sealed class CreateRoleCommandHandler(IRoleService roleService) : ICommandHandler<CreateRoleCommand, Result<RoleDto>>
 {
     public Task<Result<RoleDto>> Handle(CreateRoleCommand command, CancellationToken cancellationToken)
-        => roleService.CreateRoleAsync(command.Name, command.MaxConfigs, cancellationToken);
+        => roleService.CreateRoleAsync(command.Name, command.MaxConfigs, command.MaxIpLimit, cancellationToken);
 }

backend/src/PnvPanel.Application/Admin/Roles/CreateRoleCommandValidator.cs

@@ -12,5 +12,6 @@ public sealed class CreateRoleCommandValidator : AbstractValidator<CreateRoleCom
             .Matches("^[a-zA-Z0-9_-]+$");
 
         RuleFor(x => x.MaxConfigs).GreaterThanOrEqualTo(-1);
+        RuleFor(x => x.MaxIpLimit).GreaterThanOrEqualTo(-1);
     }
 }

backend/src/PnvPanel.Application/Admin/Roles/UpdateRoleCommand.cs

@@ -4,4 +4,4 @@ using PnvPanel.Application.Common.Models;
 
 namespace PnvPanel.Application.Admin.Roles;
 
-public sealed record UpdateRoleCommand(Guid RoleId, int MaxConfigs) : ICommand<Result<RoleDto>>;
+public sealed record UpdateRoleCommand(Guid RoleId, int MaxConfigs, int MaxIpLimit) : ICommand<Result<RoleDto>>;

backend/src/PnvPanel.Application/Admin/Roles/UpdateRoleCommandHandler.cs

@@ -7,5 +7,5 @@ namespace PnvPanel.Application.Admin.Roles;
 public sealed class UpdateRoleCommandHandler(IRoleService roleService) : ICommandHandler<UpdateRoleCommand, Result<RoleDto>>
 {
     public Task<Result<RoleDto>> Handle(UpdateRoleCommand command, CancellationToken cancellationToken)
-        => roleService.UpdateRoleAsync(command.RoleId, command.MaxConfigs, cancellationToken);
+        => roleService.UpdateRoleAsync(command.RoleId, command.MaxConfigs, command.MaxIpLimit, cancellationToken);
 }

backend/src/PnvPanel.Application/Admin/Roles/UpdateRoleCommandValidator.cs

@@ -7,5 +7,6 @@ public sealed class UpdateRoleCommandValidator : AbstractValidator<UpdateRoleCom
     public UpdateRoleCommandValidator()
     {
         RuleFor(x => x.MaxConfigs).GreaterThanOrEqualTo(-1);
+        RuleFor(x => x.MaxIpLimit).GreaterThanOrEqualTo(-1);
     }
 }

backend/src/PnvPanel.Application/Admin/Users/DeleteUserCommand.cs

@@ -0,0 +1,6 @@
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+
+namespace PnvPanel.Application.Admin.Users;
+
+public sealed record DeleteUserCommand(Guid UserId) : ICommand<Result>;

backend/src/PnvPanel.Application/Admin/Users/DeleteUserCommandHandler.cs

@@ -0,0 +1,49 @@
+using Microsoft.EntityFrameworkCore;
+using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Common.Messaging;
+using PnvPanel.Application.Common.Models;
+using PnvPanel.Domain.Audit;
+using PnvPanel.Domain.Configs;
+
+namespace PnvPanel.Application.Admin.Users;
+
+/// <summary>Удаление пользователя админом: отзывает все его конфиги в 3x-ui, затем удаляет учётку.</summary>
+public sealed class DeleteUserCommandHandler(
+    IAppDbContext dbContext, IIdentityService identityService, IXuiPanelGateway gateway,
+    ITelegramNotifier telegramNotifier, ICurrentUser currentUser)
+    : ICommandHandler<DeleteUserCommand, Result>
+{
+    public async Task<Result> Handle(DeleteUserCommand command, CancellationToken cancellationToken)
+    {
+        if (currentUser.UserId == command.UserId)
+            return Result.Failure(UserErrors.CannotDeleteSelf);
+
+        var configs = await dbContext.VpnConfigs
+            .Where(c => c.UserId == command.UserId && c.Status != ConfigStatus.Revoked)
+            .ToListAsync(cancellationToken);
+
+        foreach (var config in configs)
+        {
+            var inbound = await dbContext.Inbounds.AsNoTracking().FirstOrDefaultAsync(i => i.Id == config.InboundId, cancellationToken);
+            var node = inbound is null
+                ? null
+                : await dbContext.Nodes.AsNoTracking().FirstOrDefaultAsync(n => n.Id == inbound.NodeId, cancellationToken);
+
+            if (inbound is not null && node is not null)
+                await gateway.RemoveClientAsync(node, inbound.RemoteInboundId, config.ClientExternalId, config.Protocol, cancellationToken);
+
+            config.Revoke();
+        }
+
+        dbContext.AuditLogs.Add(AuditLog.Create(
+            currentUser.UserId, "UserDeleted", "User", command.UserId.ToString(), metadata: null, AuditSource.Web));
+
+        // Коммитим отзыв конфигов + аудит ДО удаления учётки: UserManager.DeleteAsync ниже удаляет
+        // AppUser отдельным путём (Identity store), после чего NotifyUserAsync уже не найдёт Telegram-привязку.
+        await dbContext.SaveChangesAsync(cancellationToken);
+
+        await telegramNotifier.NotifyUserAsync(command.UserId, "🗑 Ваш аккаунт удалён администратором.", cancellationToken);
+
+        return await identityService.DeleteUserAsync(command.UserId, cancellationToken);
+    }
+}

backend/src/PnvPanel.Application/Admin/Users/UserErrors.cs

@@ -5,4 +5,7 @@ namespace PnvPanel.Application.Admin.Users;
 public static class UserErrors
 {
     public static readonly Error NotFound = Error.NotFound("Users.NotFound", "Пользователь не найден.");
+
+    public static readonly Error CannotDeleteSelf = Error.Validation(
+        "Users.CannotDeleteSelf", "Нельзя удалить свою учётную запись здесь — используйте удаление аккаунта в Настройках.");
 }

backend/src/PnvPanel.Application/Common/Interfaces/IIdentityService.cs

@@ -5,7 +5,8 @@ namespace PnvPanel.Application.Common.Interfaces;
 public sealed record AuthenticatedUser(Guid Id, string UserName, string Role);
 
 public sealed record CurrentUserProfile(
-    Guid Id, string UserName, Guid RoleId, string Role, bool IsActivated, bool IsBlocked, int MaxConfigs, string SubscriptionToken);
+    Guid Id, string UserName, Guid RoleId, string Role, bool IsActivated, bool IsBlocked, int MaxConfigs, int MaxIpLimit,
+    string SubscriptionToken);
 
 public sealed record UserSummaryDto(Guid Id, string UserName, string Role, bool IsActivated, bool IsBlocked, DateTimeOffset? ActivatedAt);
 

backend/src/PnvPanel.Application/Common/Interfaces/IRoleService.cs

@@ -2,13 +2,13 @@ using PnvPanel.Application.Common.Models;
 
 namespace PnvPanel.Application.Common.Interfaces;
 
-public sealed record RoleDto(Guid Id, string Name, int MaxConfigs, bool IsSystem);
+public sealed record RoleDto(Guid Id, string Name, int MaxConfigs, int MaxIpLimit, bool IsSystem);
 
 public interface IRoleService
 {
-    Task<Result<RoleDto>> CreateRoleAsync(string name, int maxConfigs, CancellationToken cancellationToken);
+    Task<Result<RoleDto>> CreateRoleAsync(string name, int maxConfigs, int maxIpLimit, CancellationToken cancellationToken);
 
-    Task<Result<RoleDto>> UpdateRoleAsync(Guid roleId, int maxConfigs, CancellationToken cancellationToken);
+    Task<Result<RoleDto>> UpdateRoleAsync(Guid roleId, int maxConfigs, int maxIpLimit, CancellationToken cancellationToken);
 
     Task<Result> DeleteRoleAsync(Guid roleId, CancellationToken cancellationToken);
 

backend/src/PnvPanel.Application/Common/Interfaces/IXuiPanelGateway.cs

@@ -24,9 +24,13 @@ public interface IXuiPanelGateway
 
     void InvalidateClient(Guid nodeId);
 
-    /// <summary>Возвращает ClientExternalId, присвоенный панелью (UUID для VLESS/VMess, пароль для Trojan/Shadowsocks).</summary>
+    /// <summary>
+    /// Возвращает ClientExternalId, присвоенный панелью (UUID для VLESS/VMess, пароль для Trojan/Shadowsocks).
+    /// <paramref name="limitIp"/> — лимит одновременных IP клиента (квота роли, см. AppRole.MaxIpLimit);
+    /// -1 (RoleQuota.Unlimited) означает без лимита — гейтвей сам переводит его в нативное значение 3x-ui.
+    /// </summary>
     Task<Result<string>> AddClientAsync(
-        Node node, string inboundRemoteId, VpnProtocol protocol, string clientEmail, string clientName,
+        Node node, string inboundRemoteId, VpnProtocol protocol, string clientEmail, string clientName, int limitIp,
         CancellationToken cancellationToken);
 
     Task<Result> RemoveClientAsync(

backend/src/PnvPanel.Application/Configs/Create/CreateVpnConfigCommandHandler.cs

@@ -44,7 +44,7 @@ public sealed class CreateVpnConfigCommandHandler(
 
         var addResult = await gateway.AddClientAsync(
             node, inbound.RemoteInboundId, inbound.Protocol, config.ClientEmail,
-            config.Label ?? config.ClientEmail, cancellationToken);
+            config.Label ?? config.ClientEmail, profile.MaxIpLimit, cancellationToken);
 
         if (!addResult.IsSuccess)
         {

backend/src/PnvPanel.Application/Configs/Rotate/RotateVpnConfigCommandHandler.cs

@@ -7,7 +7,8 @@ using PnvPanel.Domain.Configs;
 
 namespace PnvPanel.Application.Configs.Rotate;
 
-public sealed class RotateVpnConfigCommandHandler(IAppDbContext dbContext, IXuiPanelGateway gateway, ICurrentUser currentUser)
+public sealed class RotateVpnConfigCommandHandler(
+    IAppDbContext dbContext, IXuiPanelGateway gateway, IIdentityService identityService, ICurrentUser currentUser)
     : ICommandHandler<RotateVpnConfigCommand, Result<VpnConfigDto>>
 {
     public async Task<Result<VpnConfigDto>> Handle(RotateVpnConfigCommand command, CancellationToken cancellationToken)
@@ -32,10 +33,14 @@ public sealed class RotateVpnConfigCommandHandler(IAppDbContext dbContext, IXuiP
         if (node is null)
             return Result.Failure<VpnConfigDto>(ConfigErrors.NodeDisabled);
 
+        var profile = await identityService.GetProfileAsync(userId, cancellationToken);
+        if (profile is null)
+            return Result.Failure<VpnConfigDto>(AuthErrors.Unauthorized);
+
         var newClientEmail = VpnConfig.GenerateClientEmail(userId);
         var addResult = await gateway.AddClientAsync(
             node, inbound.RemoteInboundId, config.Protocol, newClientEmail,
-            config.Label ?? newClientEmail, cancellationToken);
+            config.Label ?? newClientEmail, profile.MaxIpLimit, cancellationToken);
 
         if (!addResult.IsSuccess)
             return Result.Failure<VpnConfigDto>(addResult.Error);