fix: align group management APIs

server/internal_api.go

@@ -98,7 +98,7 @@ func serveInternalAdminQuery(wrt http.ResponseWriter, req *http.Request, prefix
 	if !ok {
 		return
 	}
-	if req.Method == http.MethodPost && !(len(parts) == 3 && parts[2] == "users") {
+	if req.Method == http.MethodPost && !isInternalAdminPostRoute(parts) {
 		writeIMError(wrt, req, http.StatusMethodNotAllowed, 30002, imReasonMethodNotAllowed, "method not allowed", nil)
 		return
 	}
@@ -114,6 +114,8 @@ func serveInternalAdminQuery(wrt http.ResponseWriter, req *http.Request, prefix
 		serveInternalAdminResourceList(wrt, req, tenant.ID, "group-messages", "")
 	case req.Method == http.MethodPost && len(parts) == 3 && parts[2] == "users":
 		serveInternalUserCreate(wrt, req, tenant.ID)
+	case req.Method == http.MethodPost && len(parts) == 5 && parts[2] == "users" && parts[4] == "action":
+		serveInternalUserAction(wrt, req, tenant.ID, parts[3])
 	case req.Method == http.MethodGet && len(parts) == 3 && parts[2] == "users":
 		serveInternalAdminResourceList(wrt, req, tenant.ID, "users", "")
 	case len(parts) == 4 && parts[2] == "users":
@@ -163,6 +165,11 @@ func serveInternalAdminQuery(wrt http.ResponseWriter, req *http.Request, prefix
 	}
 }
 
+func isInternalAdminPostRoute(parts []string) bool {
+	return (len(parts) == 3 && parts[2] == "users") ||
+		(len(parts) == 5 && parts[2] == "users" && parts[4] == "action")
+}
+
 type internalUserCreateRequest struct {
 	Username string `json:"username"`
 	Nickname string `json:"nickname"`
@@ -170,6 +177,15 @@ type internalUserCreateRequest struct {
 	Password string `json:"password"`
 }
 
+type internalUserActionRequest struct {
+	EventType    string `json:"event_type"`
+	ActorUserID  string `json:"actor_user_id"`
+	DeviceID     string `json:"device_id"`
+	PasswordHash string `json:"password_hash"`
+	Reason       string `json:"reason"`
+	Hard         bool   `json:"hard"`
+}
+
 func serveInternalUserCreate(wrt http.ResponseWriter, req *http.Request, tenantID types.TenantID) {
 	var body internalUserCreateRequest
 	if err := json.NewDecoder(io.LimitReader(req.Body, 1<<20)).Decode(&body); err != nil {
@@ -244,6 +260,78 @@ func serveInternalUserCreate(wrt http.ResponseWriter, req *http.Request, tenantI
 	})
 }
 
+func serveInternalUserAction(wrt http.ResponseWriter, req *http.Request, tenantID types.TenantID, rawUserID string) {
+	var body internalUserActionRequest
+	if err := json.NewDecoder(io.LimitReader(req.Body, 1<<20)).Decode(&body); err != nil {
+		writeIMError(wrt, req, http.StatusBadRequest, 30000, imReasonMalformedRequest, "malformed request", nil)
+		return
+	}
+	eventType := strings.TrimSpace(body.EventType)
+	if !isInternalUserActionSupported(eventType) {
+		writeIMError(wrt, req, http.StatusBadRequest, 30000, imReasonMalformedRequest, "unsupported user action", map[string]any{"event_type": eventType})
+		return
+	}
+	target := parseKafkaCommandUser(rawUserID)
+	if target.IsZero() {
+		writeIMError(wrt, req, http.StatusBadRequest, 30000, imReasonMalformedRequest, "用户ID不能为空", nil)
+		return
+	}
+	payload := adminCommandPayload{
+		CommandID:    firstNonEmpty(strings.TrimSpace(req.Header.Get("X-Request-ID")), "internal-"+strconv.FormatInt(time.Now().UTC().UnixNano(), 10)),
+		ActorUserID:  strings.TrimSpace(body.ActorUserID),
+		UserID:       strconv.FormatInt(internalAdminUIDRaw(target), 10),
+		TargetID:     strconv.FormatInt(internalAdminUIDRaw(target), 10),
+		DeviceID:     strings.TrimSpace(body.DeviceID),
+		PasswordHash: strings.TrimSpace(body.PasswordHash),
+		Reason:       strings.TrimSpace(body.Reason),
+		Hard:         body.Hard,
+	}
+	envelope := kafkaEnvelope{
+		EventID:    payload.CommandID,
+		TraceID:    strings.TrimSpace(req.Header.Get("X-Request-ID")),
+		EventType:  eventType,
+		BizType:    "user",
+		BizID:      strconv.FormatInt(internalAdminUIDRaw(target), 10),
+		OccurredAt: time.Now().UTC(),
+	}
+	var (
+		result map[string]any
+		err    error
+	)
+	if eventType == adminCommandUserPasswordReset {
+		result, err = executeKafkaUserPasswordResetCommand(tenantID, payload)
+	} else {
+		result, err = executeKafkaUserGovernanceCommand(tenantID, envelope, payload, parseKafkaCommandUser(payload.ActorUserID))
+	}
+	if err != nil {
+		writeInternalQueryError(wrt, req, err)
+		return
+	}
+	if err := enqueueKafkaAuditEvent(req.Context(), tenantID, "admin", parseKafkaCommandUser(payload.ActorUserID),
+		eventType, "internal_user_action", payload.CommandID, "succeeded", "", result); err != nil {
+		logs.Warn.Printf("internal user action audit enqueue failed tenant:%d user:%d event:%s err:%v", tenantID, internalAdminUIDRaw(target), eventType, err)
+	}
+	writeIMSuccess(wrt, req, map[string]any{
+		"user_id":    internalAdminUIDRaw(target),
+		"event_type": eventType,
+		"status":     "succeeded",
+		"result":     result,
+	})
+}
+
+func isInternalUserActionSupported(eventType string) bool {
+	switch strings.TrimSpace(eventType) {
+	case adminCommandUserBan, adminCommandUserUnban,
+		adminCommandUserFreeze, adminCommandUserUnfreeze,
+		adminCommandUserDeviceKick, adminCommandUserLogoutAll,
+		adminCommandUserCancel, adminCommandUserDelete,
+		adminCommandUserPasswordReset:
+		return true
+	default:
+		return false
+	}
+}
+
 func authorizeInternalAPI(wrt http.ResponseWriter, req *http.Request, capability string) bool {
 	if !internalAPI.config.Enabled {
 		writeIMError(wrt, req, http.StatusNotFound, 30004, imReasonMalformedRequest, "resource not found", nil)