Implement role and user management enhancements

- Added MaxIpLimit to roles, allowing for the configuration of simultaneous IP limits for users.
- Updated role creation and update commands to include MaxIpLimit, ensuring proper handling in the application logic.
- Enhanced user management by introducing a DELETE endpoint for user accounts, with appropriate checks to prevent self-deletion.
- Updated documentation to reflect changes in role and user management, clarifying the new IP limit functionality and user deletion process.
- Adjusted related tests to cover new functionality and ensure robust validation of role and user management features.

backend/tests/PnvPanel.Application.Tests/Admin/Users/DeleteUserCommandHandlerTests.cs

@@ -0,0 +1,108 @@
+using NSubstitute;
+using PnvPanel.Application.Admin.Users;
+using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Common.Models;
+using PnvPanel.Application.Tests.TestSupport;
+using PnvPanel.Domain.Configs;
+using PnvPanel.Domain.Inbounds;
+using PnvPanel.Domain.Nodes;
+using Xunit;
+
+namespace PnvPanel.Application.Tests.Admin.Users;
+
+public class DeleteUserCommandHandlerTests
+{
+    private readonly IIdentityService _identityService = Substitute.For<IIdentityService>();
+    private readonly IXuiPanelGateway _gateway = Substitute.For<IXuiPanelGateway>();
+    private readonly ITelegramNotifier _telegramNotifier = Substitute.For<ITelegramNotifier>();
+    private readonly ICurrentUser _currentUser = Substitute.For<ICurrentUser>();
+
+    [Fact]
+    public async Task Handle_WhenAdminTargetsSelf_ReturnsCannotDeleteSelfWithoutTouchingConfigs()
+    {
+        using var dbContext = InMemoryDbContextFactory.Create();
+        var adminId = Guid.NewGuid();
+        _currentUser.UserId.Returns(adminId);
+
+        var handler = new DeleteUserCommandHandler(dbContext, _identityService, _gateway, _telegramNotifier, _currentUser);
+
+        var result = await handler.Handle(new DeleteUserCommand(adminId), CancellationToken.None);
+
+        Assert.False(result.IsSuccess);
+        Assert.Equal(UserErrors.CannotDeleteSelf, result.Error);
+        await _identityService.DidNotReceive().DeleteUserAsync(Arg.Any<Guid>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task Handle_Success_RevokesConfigsWritesAuditNotifiesThenDeletesUser()
+    {
+        using var dbContext = InMemoryDbContextFactory.Create();
+        var userId = Guid.NewGuid();
+        var adminId = Guid.NewGuid();
+
+        var node = Node.Register("node-1", new Uri("https://node1.example.com"), new NodeCredentials("admin", "protected"), null);
+        var inbound = Inbound.FromRemote(node.Id, "1", VpnProtocol.Vless, "remark", 443);
+        var config = VpnConfig.Create(userId, inbound.Id, VpnProtocol.Vless, "my-config");
+        config.AssignRemoteClient("external-id");
+
+        dbContext.Nodes.Add(node);
+        dbContext.Inbounds.Add(inbound);
+        dbContext.VpnConfigs.Add(config);
+        await dbContext.SaveChangesAsync(CancellationToken.None);
+
+        _currentUser.UserId.Returns(adminId);
+        _gateway.RemoveClientAsync(Arg.Any<Node>(), Arg.Any<string>(), Arg.Any<string>(), Arg.Any<VpnProtocol>(), Arg.Any<CancellationToken>())
+            .Returns(Result.Success());
+        _identityService.DeleteUserAsync(userId, Arg.Any<CancellationToken>()).Returns(Result.Success());
+
+        var handler = new DeleteUserCommandHandler(dbContext, _identityService, _gateway, _telegramNotifier, _currentUser);
+
+        var result = await handler.Handle(new DeleteUserCommand(userId), CancellationToken.None);
+
+        Assert.True(result.IsSuccess);
+        Assert.Equal(ConfigStatus.Revoked, config.Status);
+
+        await _gateway.Received(1).RemoveClientAsync(
+            Arg.Is<Node>(n => n.Id == node.Id), inbound.RemoteInboundId, "external-id", config.Protocol, Arg.Any<CancellationToken>());
+        await _telegramNotifier.Received(1).NotifyUserAsync(userId, Arg.Any<string>(), Arg.Any<CancellationToken>());
+        await _identityService.Received(1).DeleteUserAsync(userId, Arg.Any<CancellationToken>());
+
+        var audit = Assert.Single(dbContext.AuditLogs.Local);
+        Assert.Equal("UserDeleted", audit.Action);
+        Assert.Equal(adminId, audit.ActorId);
+        Assert.Equal(userId.ToString(), audit.TargetId);
+    }
+
+    [Fact]
+    public async Task Handle_NoConfigs_SkipsGatewayButStillDeletesUser()
+    {
+        using var dbContext = InMemoryDbContextFactory.Create();
+        var userId = Guid.NewGuid();
+        _currentUser.UserId.Returns(Guid.NewGuid());
+        _identityService.DeleteUserAsync(userId, Arg.Any<CancellationToken>()).Returns(Result.Success());
+
+        var handler = new DeleteUserCommandHandler(dbContext, _identityService, _gateway, _telegramNotifier, _currentUser);
+
+        var result = await handler.Handle(new DeleteUserCommand(userId), CancellationToken.None);
+
+        Assert.True(result.IsSuccess);
+        await _gateway.DidNotReceive().RemoveClientAsync(
+            Arg.Any<Node>(), Arg.Any<string>(), Arg.Any<string>(), Arg.Any<VpnProtocol>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task Handle_WhenIdentityServiceFails_ReturnsFailure()
+    {
+        using var dbContext = InMemoryDbContextFactory.Create();
+        var userId = Guid.NewGuid();
+        _currentUser.UserId.Returns(Guid.NewGuid());
+        _identityService.DeleteUserAsync(userId, Arg.Any<CancellationToken>()).Returns(Result.Failure(UserErrors.NotFound));
+
+        var handler = new DeleteUserCommandHandler(dbContext, _identityService, _gateway, _telegramNotifier, _currentUser);
+
+        var result = await handler.Handle(new DeleteUserCommand(userId), CancellationToken.None);
+
+        Assert.False(result.IsSuccess);
+        Assert.Equal(UserErrors.NotFound, result.Error);
+    }
+}

backend/tests/PnvPanel.Application.Tests/Auth/GetCurrentUserQueryHandlerTests.cs

@@ -2,6 +2,7 @@ using NSubstitute;
 using PnvPanel.Application.Auth;
 using PnvPanel.Application.Auth.Me;
 using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Common.Models;
 using PnvPanel.Application.Tests.TestSupport;
 using Xunit;
 
@@ -40,7 +41,7 @@ public class GetCurrentUserQueryHandlerTests
     public async Task Handle_AuthenticatedWithProfile_ReturnsCurrentUserDto()
     {
         var userId = Guid.NewGuid();
-        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", true, false, 3, "sub-token");
+        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", true, false, 3, RoleQuota.Unlimited, "sub-token");
         _identityService.GetProfileAsync(userId, Arg.Any<CancellationToken>()).Returns(profile);
         _identityService.GetTelegramLinkInfoAsync(userId, Arg.Any<CancellationToken>())
             .Returns(new TelegramLinkInfo(true, 42, "alice_tg"));

backend/tests/PnvPanel.Application.Tests/Auth/LoginCommandHandlerTests.cs

@@ -20,7 +20,9 @@ public class LoginCommandHandlerTests
     {
         var userId = Guid.NewGuid();
         var authUser = new AuthenticatedUser(userId, "alice", "user");
-        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", IsActivated: true, IsBlocked: false, MaxConfigs: 3, SubscriptionToken: "sub-token");
+        var profile = new CurrentUserProfile(
+            userId, "alice", Guid.NewGuid(), "user", IsActivated: true, IsBlocked: false, MaxConfigs: 3,
+            MaxIpLimit: RoleQuota.Unlimited, SubscriptionToken: "sub-token");
 
         _identityService.ValidateCredentialsAsync("alice", "P@ssw0rd", Arg.Any<CancellationToken>())
             .Returns(Result.Success(authUser));

backend/tests/PnvPanel.Application.Tests/Auth/RefreshCommandHandlerTests.cs

@@ -19,7 +19,9 @@ public class RefreshCommandHandlerTests
     public async Task Handle_WithValidToken_RotatesAndReturnsNewAuthResult()
     {
         var userId = Guid.NewGuid();
-        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", IsActivated: true, IsBlocked: false, MaxConfigs: 3, SubscriptionToken: "sub-token");
+        var profile = new CurrentUserProfile(
+            userId, "alice", Guid.NewGuid(), "user", IsActivated: true, IsBlocked: false, MaxConfigs: 3,
+            MaxIpLimit: RoleQuota.Unlimited, SubscriptionToken: "sub-token");
         var rotated = new RotatedRefreshToken(userId, "new-refresh-token", DateTimeOffset.UtcNow.AddDays(30));
 
         _refreshTokenService.RotateAsync("old-token", Arg.Any<CancellationToken>()).Returns(Result.Success(rotated));

backend/tests/PnvPanel.Application.Tests/Configs/GetMyConfigs/GetMyConfigsQueryHandlerTests.cs

@@ -1,6 +1,7 @@
 using NSubstitute;
 using PnvPanel.Application.Auth;
 using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Common.Models;
 using PnvPanel.Application.Configs.GetMyConfigs;
 using PnvPanel.Application.Tests.TestSupport;
 using PnvPanel.Domain.Configs;
@@ -32,7 +33,7 @@ public class GetMyConfigsQueryHandlerTests
         dbContext.VpnConfigs.AddRange(activeConfig, revokedConfig, otherUsersConfig);
         await dbContext.SaveChangesAsync(CancellationToken.None);
 
-        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", true, false, 5, "sub-token");
+        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", true, false, 5, RoleQuota.Unlimited, "sub-token");
         _identityService.GetProfileAsync(userId, Arg.Any<CancellationToken>()).Returns(profile);
 
         var handler = new GetMyConfigsQueryHandler(dbContext, _identityService, FakeCurrentUser.Authenticated(userId));

backend/tests/PnvPanel.Application.Tests/Configs/Rotate/RotateVpnConfigCommandHandlerTests.cs

@@ -15,12 +15,17 @@ namespace PnvPanel.Application.Tests.Configs.Rotate;
 public class RotateVpnConfigCommandHandlerTests
 {
     private readonly IXuiPanelGateway _gateway = Substitute.For<IXuiPanelGateway>();
+    private readonly IIdentityService _identityService = Substitute.For<IIdentityService>();
+
+    private static CurrentUserProfile MakeProfile(Guid userId) =>
+        new(userId, "alice", Guid.NewGuid(), "user", true, false, 3, RoleQuota.Unlimited, "sub-token");
 
     [Fact]
     public async Task Handle_WhenActiveConfigOwnedByUser_RotatesAndAddsNewClient()
     {
         using var dbContext = InMemoryDbContextFactory.Create();
         var userId = Guid.NewGuid();
+        _identityService.GetProfileAsync(userId, Arg.Any<CancellationToken>()).Returns(MakeProfile(userId));
 
         var node = Node.Register("node-1", new Uri("https://node1.example.com"), new NodeCredentials("admin", "protected"), null);
         var inbound = Inbound.FromRemote(node.Id, "1", VpnProtocol.Vless, "remark", 443);
@@ -34,10 +39,10 @@ public class RotateVpnConfigCommandHandlerTests
 
         _gateway.AddClientAsync(
                 Arg.Any<Node>(), inbound.RemoteInboundId, config.Protocol, Arg.Any<string>(),
-                Arg.Any<string>(), Arg.Any<CancellationToken>())
+                Arg.Any<string>(), Arg.Any<int>(), Arg.Any<CancellationToken>())
             .Returns(Result.Success("new-external-id"));
 
-        var handler = new RotateVpnConfigCommandHandler(dbContext, _gateway, FakeCurrentUser.Authenticated(userId));
+        var handler = new RotateVpnConfigCommandHandler(dbContext, _gateway, _identityService, FakeCurrentUser.Authenticated(userId));
 
         var result = await handler.Handle(new RotateVpnConfigCommand(config.Id), CancellationToken.None);
 
@@ -53,7 +58,7 @@ public class RotateVpnConfigCommandHandlerTests
         using var dbContext = InMemoryDbContextFactory.Create();
         var userId = Guid.NewGuid();
 
-        var handler = new RotateVpnConfigCommandHandler(dbContext, _gateway, FakeCurrentUser.Authenticated(userId));
+        var handler = new RotateVpnConfigCommandHandler(dbContext, _gateway, _identityService, FakeCurrentUser.Authenticated(userId));
 
         var result = await handler.Handle(new RotateVpnConfigCommand(Guid.NewGuid()), CancellationToken.None);
 
@@ -75,7 +80,7 @@ public class RotateVpnConfigCommandHandlerTests
         dbContext.VpnConfigs.Add(config);
         await dbContext.SaveChangesAsync(CancellationToken.None);
 
-        var handler = new RotateVpnConfigCommandHandler(dbContext, _gateway, FakeCurrentUser.Authenticated(otherUserId));
+        var handler = new RotateVpnConfigCommandHandler(dbContext, _gateway, _identityService, FakeCurrentUser.Authenticated(otherUserId));
 
         var result = await handler.Handle(new RotateVpnConfigCommand(config.Id), CancellationToken.None);
 
@@ -97,7 +102,7 @@ public class RotateVpnConfigCommandHandlerTests
         dbContext.VpnConfigs.Add(config);
         await dbContext.SaveChangesAsync(CancellationToken.None);
 
-        var handler = new RotateVpnConfigCommandHandler(dbContext, _gateway, FakeCurrentUser.Authenticated(userId));
+        var handler = new RotateVpnConfigCommandHandler(dbContext, _gateway, _identityService, FakeCurrentUser.Authenticated(userId));
 
         var result = await handler.Handle(new RotateVpnConfigCommand(config.Id), CancellationToken.None);
 
@@ -110,6 +115,7 @@ public class RotateVpnConfigCommandHandlerTests
     {
         using var dbContext = InMemoryDbContextFactory.Create();
         var userId = Guid.NewGuid();
+        _identityService.GetProfileAsync(userId, Arg.Any<CancellationToken>()).Returns(MakeProfile(userId));
 
         var node = Node.Register("node-1", new Uri("https://node1.example.com"), new NodeCredentials("admin", "protected"), null);
         var inbound = Inbound.FromRemote(node.Id, "1", VpnProtocol.Vless, "remark", 443);
@@ -124,10 +130,10 @@ public class RotateVpnConfigCommandHandlerTests
         var gatewayError = Error.Failure("Xui.Unreachable", "Панель недоступна.");
         _gateway.AddClientAsync(
                 Arg.Any<Node>(), inbound.RemoteInboundId, config.Protocol, Arg.Any<string>(),
-                Arg.Any<string>(), Arg.Any<CancellationToken>())
+                Arg.Any<string>(), Arg.Any<int>(), Arg.Any<CancellationToken>())
             .Returns(Result.Failure<string>(gatewayError));
 
-        var handler = new RotateVpnConfigCommandHandler(dbContext, _gateway, FakeCurrentUser.Authenticated(userId));
+        var handler = new RotateVpnConfigCommandHandler(dbContext, _gateway, _identityService, FakeCurrentUser.Authenticated(userId));
 
         var result = await handler.Handle(new RotateVpnConfigCommand(config.Id), CancellationToken.None);
 

backend/tests/PnvPanel.Application.Tests/Telegram/GetLoginRequestStatusQueryHandlerTests.cs

@@ -1,6 +1,7 @@
 using NSubstitute;
 using PnvPanel.Application.Auth;
 using PnvPanel.Application.Common.Interfaces;
+using PnvPanel.Application.Common.Models;
 using PnvPanel.Application.Tests.TestSupport;
 using PnvPanel.Domain.Telegram;
 using Xunit;
@@ -75,7 +76,7 @@ public class GetLoginRequestStatusQueryHandlerTests
         dbContext.TelegramLoginRequests.Add(request);
         await dbContext.SaveChangesAsync(CancellationToken.None);
 
-        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", true, false, 3, "sub-token");
+        var profile = new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", true, false, 3, RoleQuota.Unlimited, "sub-token");
         _identityService.GetProfileAsync(userId, Arg.Any<CancellationToken>()).Returns(profile);
         _jwtTokenService.GenerateAccessToken(Arg.Any<AuthenticatedUser>())
             .Returns(("access-token", DateTimeOffset.UtcNow.AddMinutes(15)));

backend/tests/PnvPanel.IntegrationTests/Configs/ConfigQuotaTests.cs

@@ -40,7 +40,8 @@ public class ConfigQuotaTests(PnvPanelWebApplicationFactory factory)
         var roles = await rolesResponse.ReadAsAsync<List<RoleResponse>>();
         var userRole = roles!.Single(r => r.Name == "user");
 
-        var updateRoleResponse = await adminClient.SendPutJsonAsync($"/api/admin/roles/{userRole.Id}", new { maxConfigs = Quota });
+        var updateRoleResponse = await adminClient.SendPutJsonAsync(
+            $"/api/admin/roles/{userRole.Id}", new { maxConfigs = Quota, maxIpLimit = -1 });
         Assert.Equal(HttpStatusCode.OK, updateRoleResponse.StatusCode);
 
         var registerNodeResponse = await adminClient.PostJsonAsync("/api/admin/nodes", new

backend/tests/PnvPanel.IntegrationTests/TestSupport/FakeXuiPanelGateway.cs

@@ -31,7 +31,7 @@ public sealed class FakeXuiPanelGateway : IXuiPanelGateway
     }
 
     public Task<Result<string>> AddClientAsync(
-        Node node, string inboundRemoteId, VpnProtocol protocol, string clientEmail, string clientName,
+        Node node, string inboundRemoteId, VpnProtocol protocol, string clientEmail, string clientName, int limitIp,
         CancellationToken cancellationToken)
         => Task.FromResult(Result.Success(Guid.NewGuid().ToString()));