feat: user profile/settings pages (#958)

server/entity/User.ts

@@ -7,6 +7,7 @@ import {
   OneToMany,
   RelationCount,
   AfterLoad,
+  OneToOne,
 } from 'typeorm';
 import {
   Permission,
@@ -22,18 +23,18 @@ import { getSettings } from '../lib/settings';
 import { default as generatePassword } from 'secure-random-password';
 import { UserType } from '../constants/user';
 import { v4 as uuid } from 'uuid';
+import { UserSettings } from './UserSettings';
 
 @Entity()
 export class User {
-  public static filterMany(users: User[]): Partial<User>[] {
-    return users.map((u) => u.filter());
+  public static filterMany(
+    users: User[],
+    showFiltered?: boolean
+  ): Partial<User>[] {
+    return users.map((u) => u.filter(showFiltered));
   }
 
-  static readonly filteredFields: string[] = [
-    'plexToken',
-    'password',
-    'resetPasswordGuid',
-  ];
+  static readonly filteredFields: string[] = ['email'];
 
   public displayName: string;
 
@@ -79,6 +80,13 @@ export class User {
   @OneToMany(() => MediaRequest, (request) => request.requestedBy)
   public requests: MediaRequest[];
 
+  @OneToOne(() => UserSettings, (settings) => settings.user, {
+    cascade: true,
+    eager: true,
+    onDelete: 'CASCADE',
+  })
+  public settings?: UserSettings;
+
   @CreateDateColumn()
   public createdAt: Date;
 
@@ -89,11 +97,11 @@ export class User {
     Object.assign(this, init);
   }
 
-  public filter(): Partial<User> {
+  public filter(showFiltered?: boolean): Partial<User> {
     const filtered: Partial<User> = Object.assign(
       {},
       ...(Object.keys(this) as (keyof User)[])
-        .filter((k) => !User.filteredFields.includes(k))
+        .filter((k) => showFiltered || !User.filteredFields.includes(k))
         .map((k) => ({ [k]: this[k] }))
     );
 

server/entity/UserSettings.ts

@@ -0,0 +1,28 @@
+import {
+  Column,
+  Entity,
+  JoinColumn,
+  OneToOne,
+  PrimaryGeneratedColumn,
+} from 'typeorm';
+import { User } from './User';
+
+@Entity()
+export class UserSettings {
+  constructor(init?: Partial<UserSettings>) {
+    Object.assign(this, init);
+  }
+
+  @PrimaryGeneratedColumn()
+  public id: number;
+
+  @OneToOne(() => User, (user) => user.settings, { onDelete: 'CASCADE' })
+  @JoinColumn()
+  public user: User;
+
+  @Column({ default: true })
+  public enableNotifications: boolean;
+
+  @Column({ nullable: true })
+  public discordId?: string;
+}

server/interfaces/api/userInterfaces.ts

@@ -0,0 +1,6 @@
+import { MediaRequest } from '../../entity/MediaRequest';
+import { PaginatedResponse } from './common';
+
+export interface UserRequestsResponse extends PaginatedResponse {
+  results: MediaRequest[];
+}

server/interfaces/api/userSettingsInterfaces.ts

@@ -0,0 +1,4 @@
+export interface UserSettingsNotificationsResponse {
+  enableNotifications: boolean;
+  discordId?: string;
+}

server/lib/notifications/agents/agent.ts

@@ -24,6 +24,6 @@ export abstract class BaseAgent<T extends NotificationAgentConfig> {
 }
 
 export interface NotificationAgent {
-  shouldSend(type: Notification): boolean;
+  shouldSend(type: Notification, payload: NotificationPayload): boolean;
   send(type: Notification, payload: NotificationPayload): Promise<boolean>;
 }

server/lib/notifications/agents/discord.ts

@@ -74,6 +74,12 @@ interface DiscordWebhookPayload {
   username: string;
   avatar_url?: string;
   tts: boolean;
+  content?: string;
+  allowed_mentions?: {
+    parse?: ('users' | 'roles' | 'everyone')[];
+    roles?: string[];
+    users?: string[];
+  };
 }
 
 class DiscordAgent
@@ -204,9 +210,24 @@ class DiscordAgent
         return false;
       }
 
+      const mentionedUsers: string[] = [];
+      let content = undefined;
+
+      if (
+        payload.notifyUser.settings?.enableNotifications &&
+        payload.notifyUser.settings?.discordId
+      ) {
+        mentionedUsers.push(payload.notifyUser.settings.discordId);
+        content = `<@${payload.notifyUser.settings.discordId}>`;
+      }
+
       await axios.post(webhookUrl, {
         username: settings.main.applicationTitle,
         embeds: [this.buildEmbed(type, payload)],
+        content,
+        allowed_mentions: {
+          users: mentionedUsers,
+        },
       } as DiscordWebhookPayload);
 
       return true;
@@ -214,6 +235,7 @@ class DiscordAgent
       logger.error('Error sending Discord notification', {
         label: 'Notifications',
         message: e.message,
+        response: e.response.data,
       });
       return false;
     }

server/lib/notifications/agents/email.ts

@@ -21,12 +21,13 @@ class EmailAgent
     return settings.notifications.agents.email;
   }
 
-  public shouldSend(type: Notification): boolean {
+  public shouldSend(type: Notification, payload: NotificationPayload): boolean {
     const settings = this.getSettings();
 
     if (
       settings.enabled &&
-      hasNotificationType(type, this.getSettings().types)
+      hasNotificationType(type, this.getSettings().types) &&
+      (payload.notifyUser.settings?.enableNotifications ?? true)
     ) {
       return true;
     }

server/lib/notifications/agents/webhook.ts

@@ -19,6 +19,7 @@ const KeyMap: Record<string, string | KeyMapFunction> = {
   notifyuser_username: 'notifyUser.displayName',
   notifyuser_email: 'notifyUser.email',
   notifyuser_avatar: 'notifyUser.avatar',
+  notifyuser_settings_discordId: 'notifyUser.settings.discordId',
   media_tmdbid: 'media.tmdbId',
   media_imdbid: 'media.imdbId',
   media_tvdbid: 'media.tvdbId',

server/lib/notifications/index.ts

@@ -49,7 +49,7 @@ class NotificationManager {
       label: 'Notifications',
     });
     this.activeAgents.forEach((agent) => {
-      if (settings.enabled && agent.shouldSend(type)) {
+      if (settings.enabled && agent.shouldSend(type, payload)) {
         agent.send(type, payload);
       }
     });

server/migration/1613615266968-CreateUserSettings.ts

@@ -0,0 +1,35 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class CreateUserSettings1613615266968 implements MigrationInterface {
+  name = 'CreateUserSettings1613615266968';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "user_settings" ("id" integer PRIMARY KEY AUTOINCREMENT NOT NULL, "enableNotifications" boolean NOT NULL DEFAULT (1), "discordId" varchar, "userId" integer, CONSTRAINT "REL_986a2b6d3c05eb4091bb8066f7" UNIQUE ("userId"))`
+    );
+    await queryRunner.query(
+      `CREATE TABLE "temporary_user_settings" ("id" integer PRIMARY KEY AUTOINCREMENT NOT NULL, "enableNotifications" boolean NOT NULL DEFAULT (1), "discordId" varchar, "userId" integer, CONSTRAINT "REL_986a2b6d3c05eb4091bb8066f7" UNIQUE ("userId"), CONSTRAINT "FK_986a2b6d3c05eb4091bb8066f78" FOREIGN KEY ("userId") REFERENCES "user" ("id") ON DELETE CASCADE ON UPDATE NO ACTION)`
+    );
+    await queryRunner.query(
+      `INSERT INTO "temporary_user_settings"("id", "enableNotifications", "discordId", "userId") SELECT "id", "enableNotifications", "discordId", "userId" FROM "user_settings"`
+    );
+    await queryRunner.query(`DROP TABLE "user_settings"`);
+    await queryRunner.query(
+      `ALTER TABLE "temporary_user_settings" RENAME TO "user_settings"`
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "user_settings" RENAME TO "temporary_user_settings"`
+    );
+    await queryRunner.query(
+      `CREATE TABLE "user_settings" ("id" integer PRIMARY KEY AUTOINCREMENT NOT NULL, "enableNotifications" boolean NOT NULL DEFAULT (1), "discordId" varchar, "userId" integer, CONSTRAINT "REL_986a2b6d3c05eb4091bb8066f7" UNIQUE ("userId"))`
+    );
+    await queryRunner.query(
+      `INSERT INTO "user_settings"("id", "enableNotifications", "discordId", "userId") SELECT "id", "enableNotifications", "discordId", "userId" FROM "temporary_user_settings"`
+    );
+    await queryRunner.query(`DROP TABLE "temporary_user_settings"`);
+    await queryRunner.query(`DROP TABLE "user_settings"`);
+  }
+}

server/routes/auth.ts

@@ -23,7 +23,7 @@ authRoutes.get('/me', isAuthenticated(), async (req, res) => {
     where: { id: req.user.id },
   });
 
-  return res.status(200).json(user.filter());
+  return res.status(200).json(user);
 });
 
 authRoutes.post('/login', async (req, res, next) => {

server/routes/index.ts

@@ -35,7 +35,7 @@ router.get('/status/appdata', (_req, res) => {
   });
 });
 
-router.use('/user', isAuthenticated(Permission.MANAGE_USERS), user);
+router.use('/user', user);
 router.get('/settings/public', (_req, res) => {
   const settings = getSettings();
 

server/routes/user.ts

@@ -1,289 +0,0 @@
-import { Router } from 'express';
-import { getRepository, Not } from 'typeorm';
-import PlexTvAPI from '../api/plextv';
-import { MediaRequest } from '../entity/MediaRequest';
-import { User } from '../entity/User';
-import { hasPermission, Permission } from '../lib/permissions';
-import { getSettings } from '../lib/settings';
-import logger from '../logger';
-import gravatarUrl from 'gravatar-url';
-import { UserType } from '../constants/user';
-
-const router = Router();
-
-router.get('/', async (req, res) => {
-  let query = getRepository(User).createQueryBuilder('user');
-
-  switch (req.query.sort) {
-    case 'updated':
-      query = query.orderBy('user.updatedAt', 'DESC');
-      break;
-    case 'displayname':
-      query = query.orderBy(
-        '(CASE WHEN user.username IS NULL THEN user.plexUsername ELSE user.username END)',
-        'ASC'
-      );
-      break;
-    case 'requests':
-      query = query
-        .addSelect((subQuery) => {
-          return subQuery
-            .select('COUNT(request.id)', 'requestCount')
-            .from(MediaRequest, 'request')
-            .where('request.requestedBy.id = user.id');
-        }, 'requestCount')
-        .orderBy('requestCount', 'DESC');
-      break;
-    default:
-      query = query.orderBy('user.id', 'ASC');
-      break;
-  }
-
-  const users = await query.getMany();
-
-  return res.status(200).json(User.filterMany(users));
-});
-
-router.post('/', async (req, res, next) => {
-  try {
-    const settings = getSettings();
-
-    const body = req.body;
-    const userRepository = getRepository(User);
-
-    const passedExplicitPassword = body.password && body.password.length > 0;
-    const avatar = gravatarUrl(body.email, { default: 'mm', size: 200 });
-
-    if (!passedExplicitPassword && !settings.notifications.agents.email) {
-      throw new Error('Email notifications must be enabled');
-    }
-
-    const user = new User({
-      avatar: body.avatar ?? avatar,
-      username: body.username ?? body.email,
-      email: body.email,
-      password: body.password,
-      permissions: settings.main.defaultPermissions,
-      plexToken: '',
-      userType: UserType.LOCAL,
-    });
-
-    if (passedExplicitPassword) {
-      await user?.setPassword(body.password);
-    } else {
-      await user?.generatePassword();
-    }
-
-    await userRepository.save(user);
-    return res.status(201).json(user.filter());
-  } catch (e) {
-    next({ status: 500, message: e.message });
-  }
-});
-
-router.get<{ id: string }>('/:id', async (req, res, next) => {
-  try {
-    const userRepository = getRepository(User);
-
-    const user = await userRepository.findOneOrFail({
-      where: { id: Number(req.params.id) },
-    });
-
-    return res.status(200).json(user.filter());
-  } catch (e) {
-    next({ status: 404, message: 'User not found' });
-  }
-});
-
-const canMakePermissionsChange = (permissions: number, user?: User) =>
-  // Only let the owner grant admin privileges
-  !(hasPermission(Permission.ADMIN, permissions) && user?.id !== 1) ||
-  // Only let users with the manage settings permission, grant the same permission
-  !(
-    hasPermission(Permission.MANAGE_SETTINGS, permissions) &&
-    !hasPermission(Permission.MANAGE_SETTINGS, user?.permissions ?? 0)
-  );
-
-router.put<
-  Record<string, never>,
-  Partial<User>[],
-  { ids: string[]; permissions: number }
->('/', async (req, res, next) => {
-  try {
-    const isOwner = req.user?.id === 1;
-
-    if (!canMakePermissionsChange(req.body.permissions, req.user)) {
-      return next({
-        status: 403,
-        message: 'You do not have permission to grant this level of access',
-      });
-    }
-
-    const userRepository = getRepository(User);
-
-    const users = await userRepository.findByIds(req.body.ids, {
-      ...(!isOwner ? { id: Not(1) } : {}),
-    });
-
-    const updatedUsers = await Promise.all(
-      users.map(async (user) => {
-        return userRepository.save(<User>{
-          ...user,
-          ...{ permissions: req.body.permissions },
-        });
-      })
-    );
-
-    return res.status(200).json(updatedUsers);
-  } catch (e) {
-    next({ status: 500, message: e.message });
-  }
-});
-
-router.put<{ id: string }>('/:id', async (req, res, next) => {
-  try {
-    const userRepository = getRepository(User);
-
-    const user = await userRepository.findOneOrFail({
-      where: { id: Number(req.params.id) },
-    });
-
-    // Only let the owner user modify themselves
-    if (user.id === 1 && req.user?.id !== 1) {
-      return next({
-        status: 403,
-        message: 'You do not have permission to modify this user',
-      });
-    }
-
-    if (!canMakePermissionsChange(req.body.permissions, req.user)) {
-      return next({
-        status: 403,
-        message: 'You do not have permission to grant this level of access',
-      });
-    }
-
-    Object.assign(user, {
-      username: req.body.username,
-      permissions: req.body.permissions,
-    });
-
-    await userRepository.save(user);
-
-    return res.status(200).json(user.filter());
-  } catch (e) {
-    next({ status: 404, message: 'User not found' });
-  }
-});
-
-router.delete<{ id: string }>('/:id', async (req, res, next) => {
-  try {
-    const userRepository = getRepository(User);
-
-    const user = await userRepository.findOne({
-      where: { id: Number(req.params.id) },
-      relations: ['requests'],
-    });
-
-    if (!user) {
-      return next({ status: 404, message: 'User not found' });
-    }
-
-    if (user.id === 1) {
-      return next({ status: 405, message: 'This account cannot be deleted.' });
-    }
-
-    if (user.hasPermission(Permission.ADMIN)) {
-      return next({
-        status: 405,
-        message: 'You cannot delete users with administrative privileges.',
-      });
-    }
-
-    const requestRepository = getRepository(MediaRequest);
-
-    /**
-     * Requests are usually deleted through a cascade constraint. Those however, do
-     * not trigger the removal event so listeners to not run and the parent Media
-     * will not be updated back to unknown for titles that were still pending. So
-     * we manually remove all requests from the user here so the parent media's
-     * properly reflect the change.
-     */
-    await requestRepository.remove(user.requests);
-
-    await userRepository.delete(user.id);
-    return res.status(200).json(user.filter());
-  } catch (e) {
-    logger.error('Something went wrong deleting a user', {
-      label: 'API',
-      userId: req.params.id,
-      errorMessage: e.message,
-    });
-    return next({
-      status: 500,
-      message: 'Something went wrong deleting the user',
-    });
-  }
-});
-
-router.post('/import-from-plex', async (req, res, next) => {
-  try {
-    const settings = getSettings();
-    const userRepository = getRepository(User);
-
-    // taken from auth.ts
-    const mainUser = await userRepository.findOneOrFail({
-      select: ['id', 'plexToken'],
-      order: { id: 'ASC' },
-    });
-    const mainPlexTv = new PlexTvAPI(mainUser.plexToken ?? '');
-
-    const plexUsersResponse = await mainPlexTv.getUsers();
-    const createdUsers: User[] = [];
-    for (const rawUser of plexUsersResponse.MediaContainer.User) {
-      const account = rawUser.$;
-
-      const user = await userRepository.findOne({
-        where: [{ plexId: account.id }, { email: account.email }],
-      });
-
-      if (user) {
-        // Update the users avatar with their plex thumbnail (incase it changed)
-        user.avatar = account.thumb;
-        user.email = account.email;
-        user.plexUsername = account.username;
-
-        // in-case the user was previously a local account
-        if (user.userType === UserType.LOCAL) {
-          user.userType = UserType.PLEX;
-          user.plexId = parseInt(account.id);
-
-          if (user.username === account.username) {
-            user.username = '';
-          }
-        }
-        await userRepository.save(user);
-      } else {
-        // Check to make sure it's a real account
-        if (account.email && account.username) {
-          const newUser = new User({
-            plexUsername: account.username,
-            email: account.email,
-            permissions: settings.main.defaultPermissions,
-            plexId: parseInt(account.id),
-            plexToken: '',
-            avatar: account.thumb,
-            userType: UserType.PLEX,
-          });
-          await userRepository.save(newUser);
-          createdUsers.push(newUser);
-        }
-      }
-    }
-    return res.status(201).json(User.filterMany(createdUsers));
-  } catch (e) {
-    next({ status: 500, message: e.message });
-  }
-});
-
-export default router;

server/routes/user/index.ts

@@ -0,0 +1,358 @@
+import { Router } from 'express';
+import { getRepository, Not } from 'typeorm';
+import PlexTvAPI from '../../api/plextv';
+import { MediaRequest } from '../../entity/MediaRequest';
+import { User } from '../../entity/User';
+import { hasPermission, Permission } from '../../lib/permissions';
+import { getSettings } from '../../lib/settings';
+import logger from '../../logger';
+import gravatarUrl from 'gravatar-url';
+import { UserType } from '../../constants/user';
+import { isAuthenticated } from '../../middleware/auth';
+import { UserRequestsResponse } from '../../interfaces/api/userInterfaces';
+import userSettingsRoutes from './usersettings';
+
+const router = Router();
+
+router.get('/', async (req, res) => {
+  let query = getRepository(User).createQueryBuilder('user');
+
+  switch (req.query.sort) {
+    case 'updated':
+      query = query.orderBy('user.updatedAt', 'DESC');
+      break;
+    case 'displayname':
+      query = query.orderBy(
+        '(CASE WHEN user.username IS NULL THEN user.plexUsername ELSE user.username END)',
+        'ASC'
+      );
+      break;
+    case 'requests':
+      query = query
+        .addSelect((subQuery) => {
+          return subQuery
+            .select('COUNT(request.id)', 'requestCount')
+            .from(MediaRequest, 'request')
+            .where('request.requestedBy.id = user.id');
+        }, 'requestCount')
+        .orderBy('requestCount', 'DESC');
+      break;
+    default:
+      query = query.orderBy('user.id', 'ASC');
+      break;
+  }
+
+  const users = await query.getMany();
+
+  return res
+    .status(200)
+    .json(
+      User.filterMany(users, req.user?.hasPermission(Permission.MANAGE_USERS))
+    );
+});
+
+router.post(
+  '/',
+  isAuthenticated(Permission.MANAGE_USERS),
+  async (req, res, next) => {
+    try {
+      const settings = getSettings();
+
+      const body = req.body;
+      const userRepository = getRepository(User);
+
+      const passedExplicitPassword = body.password && body.password.length > 0;
+      const avatar = gravatarUrl(body.email, { default: 'mm', size: 200 });
+
+      if (!passedExplicitPassword && !settings.notifications.agents.email) {
+        throw new Error('Email notifications must be enabled');
+      }
+
+      const user = new User({
+        avatar: body.avatar ?? avatar,
+        username: body.username ?? body.email,
+        email: body.email,
+        password: body.password,
+        permissions: settings.main.defaultPermissions,
+        plexToken: '',
+        userType: UserType.LOCAL,
+      });
+
+      if (passedExplicitPassword) {
+        await user?.setPassword(body.password);
+      } else {
+        await user?.generatePassword();
+      }
+
+      await userRepository.save(user);
+      return res.status(201).json(user.filter());
+    } catch (e) {
+      next({ status: 500, message: e.message });
+    }
+  }
+);
+
+router.get<{ id: string }>('/:id', async (req, res, next) => {
+  try {
+    const userRepository = getRepository(User);
+
+    const user = await userRepository.findOneOrFail({
+      where: { id: Number(req.params.id) },
+    });
+
+    return res
+      .status(200)
+      .json(user.filter(req.user?.hasPermission(Permission.MANAGE_USERS)));
+  } catch (e) {
+    next({ status: 404, message: 'User not found.' });
+  }
+});
+
+router.use('/:id/settings', userSettingsRoutes);
+
+router.get<{ id: string }, UserRequestsResponse>(
+  '/:id/requests',
+  async (req, res, next) => {
+    const userRepository = getRepository(User);
+    const requestRepository = getRepository(MediaRequest);
+
+    const pageSize = req.query.take ? Number(req.query.take) : 20;
+    const skip = req.query.skip ? Number(req.query.skip) : 0;
+
+    try {
+      const user = await userRepository.findOne({
+        where: { id: Number(req.params.id) },
+      });
+
+      if (!user) {
+        return next({ status: 404, message: 'User not found.' });
+      }
+
+      const [requests, requestCount] = await requestRepository.findAndCount({
+        where: { requestedBy: user },
+        take: pageSize,
+        skip,
+      });
+
+      return res.status(200).json({
+        pageInfo: {
+          pages: Math.ceil(requestCount / pageSize),
+          pageSize,
+          results: requestCount,
+          page: Math.ceil(skip / pageSize) + 1,
+        },
+        results: requests,
+      });
+    } catch (e) {
+      next({ status: 500, message: e.message });
+    }
+  }
+);
+
+const canMakePermissionsChange = (permissions: number, user?: User) =>
+  // Only let the owner grant admin privileges
+  !(hasPermission(Permission.ADMIN, permissions) && user?.id !== 1) ||
+  // Only let users with the manage settings permission, grant the same permission
+  !(
+    hasPermission(Permission.MANAGE_SETTINGS, permissions) &&
+    !hasPermission(Permission.MANAGE_SETTINGS, user?.permissions ?? 0)
+  );
+
+router.put<
+  Record<string, never>,
+  Partial<User>[],
+  { ids: string[]; permissions: number }
+>('/', isAuthenticated(Permission.MANAGE_USERS), async (req, res, next) => {
+  try {
+    const isOwner = req.user?.id === 1;
+
+    if (!canMakePermissionsChange(req.body.permissions, req.user)) {
+      return next({
+        status: 403,
+        message: 'You do not have permission to grant this level of access',
+      });
+    }
+
+    const userRepository = getRepository(User);
+
+    const users = await userRepository.findByIds(req.body.ids, {
+      ...(!isOwner ? { id: Not(1) } : {}),
+    });
+
+    const updatedUsers = await Promise.all(
+      users.map(async (user) => {
+        return userRepository.save(<User>{
+          ...user,
+          ...{ permissions: req.body.permissions },
+        });
+      })
+    );
+
+    return res.status(200).json(updatedUsers);
+  } catch (e) {
+    next({ status: 500, message: e.message });
+  }
+});
+
+router.put<{ id: string }>(
+  '/:id',
+  isAuthenticated(Permission.MANAGE_USERS),
+  async (req, res, next) => {
+    try {
+      const userRepository = getRepository(User);
+
+      const user = await userRepository.findOneOrFail({
+        where: { id: Number(req.params.id) },
+      });
+
+      // Only let the owner user modify themselves
+      if (user.id === 1 && req.user?.id !== 1) {
+        return next({
+          status: 403,
+          message: 'You do not have permission to modify this user',
+        });
+      }
+
+      if (!canMakePermissionsChange(req.body.permissions, req.user)) {
+        return next({
+          status: 403,
+          message: 'You do not have permission to grant this level of access',
+        });
+      }
+
+      Object.assign(user, {
+        username: req.body.username,
+        permissions: req.body.permissions,
+      });
+
+      await userRepository.save(user);
+
+      return res.status(200).json(user.filter());
+    } catch (e) {
+      next({ status: 404, message: 'User not found.' });
+    }
+  }
+);
+
+router.delete<{ id: string }>(
+  '/:id',
+  isAuthenticated(Permission.MANAGE_USERS),
+  async (req, res, next) => {
+    try {
+      const userRepository = getRepository(User);
+
+      const user = await userRepository.findOne({
+        where: { id: Number(req.params.id) },
+        relations: ['requests'],
+      });
+
+      if (!user) {
+        return next({ status: 404, message: 'User not found.' });
+      }
+
+      if (user.id === 1) {
+        return next({
+          status: 405,
+          message: 'This account cannot be deleted.',
+        });
+      }
+
+      if (user.hasPermission(Permission.ADMIN)) {
+        return next({
+          status: 405,
+          message: 'You cannot delete users with administrative privileges.',
+        });
+      }
+
+      const requestRepository = getRepository(MediaRequest);
+
+      /**
+       * Requests are usually deleted through a cascade constraint. Those however, do
+       * not trigger the removal event so listeners to not run and the parent Media
+       * will not be updated back to unknown for titles that were still pending. So
+       * we manually remove all requests from the user here so the parent media's
+       * properly reflect the change.
+       */
+      await requestRepository.remove(user.requests);
+
+      await userRepository.delete(user.id);
+      return res.status(200).json(user.filter());
+    } catch (e) {
+      logger.error('Something went wrong deleting a user', {
+        label: 'API',
+        userId: req.params.id,
+        errorMessage: e.message,
+      });
+      return next({
+        status: 500,
+        message: 'Something went wrong deleting the user',
+      });
+    }
+  }
+);
+
+router.post(
+  '/import-from-plex',
+  isAuthenticated(Permission.MANAGE_USERS),
+  async (req, res, next) => {
+    try {
+      const settings = getSettings();
+      const userRepository = getRepository(User);
+
+      // taken from auth.ts
+      const mainUser = await userRepository.findOneOrFail({
+        select: ['id', 'plexToken'],
+        order: { id: 'ASC' },
+      });
+      const mainPlexTv = new PlexTvAPI(mainUser.plexToken ?? '');
+
+      const plexUsersResponse = await mainPlexTv.getUsers();
+      const createdUsers: User[] = [];
+      for (const rawUser of plexUsersResponse.MediaContainer.User) {
+        const account = rawUser.$;
+
+        const user = await userRepository.findOne({
+          where: [{ plexId: account.id }, { email: account.email }],
+        });
+
+        if (user) {
+          // Update the users avatar with their plex thumbnail (incase it changed)
+          user.avatar = account.thumb;
+          user.email = account.email;
+          user.plexUsername = account.username;
+
+          // in-case the user was previously a local account
+          if (user.userType === UserType.LOCAL) {
+            user.userType = UserType.PLEX;
+            user.plexId = parseInt(account.id);
+
+            if (user.username === account.username) {
+              user.username = '';
+            }
+          }
+          await userRepository.save(user);
+        } else {
+          // Check to make sure it's a real account
+          if (account.email && account.username) {
+            const newUser = new User({
+              plexUsername: account.username,
+              email: account.email,
+              permissions: settings.main.defaultPermissions,
+              plexId: parseInt(account.id),
+              plexToken: '',
+              avatar: account.thumb,
+              userType: UserType.PLEX,
+            });
+            await userRepository.save(newUser);
+            createdUsers.push(newUser);
+          }
+        }
+      }
+      return res.status(201).json(User.filterMany(createdUsers));
+    } catch (e) {
+      next({ status: 500, message: e.message });
+    }
+  }
+);
+
+export default router;

server/routes/user/usersettings.ts

@@ -0,0 +1,280 @@
+import { Router } from 'express';
+import { getRepository } from 'typeorm';
+import { User } from '../../entity/User';
+import { UserSettings } from '../../entity/UserSettings';
+import { UserSettingsNotificationsResponse } from '../../interfaces/api/userSettingsInterfaces';
+import { Permission } from '../../lib/permissions';
+import logger from '../../logger';
+import { isAuthenticated } from '../../middleware/auth';
+
+const isOwnProfileOrAdmin = (): Middleware => {
+  const authMiddleware: Middleware = (req, res, next) => {
+    if (
+      !req.user?.hasPermission(Permission.MANAGE_USERS) &&
+      req.user?.id !== Number(req.params.id)
+    ) {
+      return next({
+        status: 403,
+        message: "You do not have permission to view this user's settings.",
+      });
+    }
+    next();
+  };
+  return authMiddleware;
+};
+
+const userSettingsRoutes = Router({ mergeParams: true });
+
+userSettingsRoutes.get<{ id: string }, { username?: string }>(
+  '/main',
+  isOwnProfileOrAdmin(),
+  async (req, res, next) => {
+    const userRepository = getRepository(User);
+
+    try {
+      const user = await userRepository.findOne({
+        where: { id: Number(req.params.id) },
+      });
+
+      if (!user) {
+        return next({ status: 404, message: 'User not found.' });
+      }
+
+      return res.status(200).json({ username: user.username });
+    } catch (e) {
+      next({ status: 500, message: e.message });
+    }
+  }
+);
+
+userSettingsRoutes.post<
+  { id: string },
+  { username?: string },
+  { username?: string }
+>('/main', isOwnProfileOrAdmin(), async (req, res, next) => {
+  const userRepository = getRepository(User);
+
+  try {
+    const user = await userRepository.findOne({
+      where: { id: Number(req.params.id) },
+    });
+
+    if (!user) {
+      return next({ status: 404, message: 'User not found.' });
+    }
+
+    user.username = req.body.username;
+
+    await userRepository.save(user);
+
+    return res.status(200).json({ username: user.username });
+  } catch (e) {
+    next({ status: 500, message: e.message });
+  }
+});
+
+userSettingsRoutes.get<{ id: string }, { hasPassword: boolean }>(
+  '/password',
+  isOwnProfileOrAdmin(),
+  async (req, res, next) => {
+    const userRepository = getRepository(User);
+
+    try {
+      const user = await userRepository.findOne({
+        where: { id: Number(req.params.id) },
+        select: ['id', 'password'],
+      });
+
+      if (!user) {
+        return next({ status: 404, message: 'User not found.' });
+      }
+
+      return res.status(200).json({ hasPassword: !!user.password });
+    } catch (e) {
+      next({ status: 500, message: e.message });
+    }
+  }
+);
+
+userSettingsRoutes.post<
+  { id: string },
+  null,
+  { currentPassword?: string; newPassword: string }
+>('/password', isOwnProfileOrAdmin(), async (req, res, next) => {
+  const userRepository = getRepository(User);
+
+  try {
+    const user = await userRepository.findOne({
+      where: { id: Number(req.params.id) },
+    });
+
+    const userWithPassword = await userRepository.findOne({
+      select: ['id', 'password'],
+      where: { id: Number(req.params.id) },
+    });
+
+    if (!user || !userWithPassword) {
+      return next({ status: 404, message: 'User not found.' });
+    }
+
+    if (req.body.newPassword.length < 8) {
+      return next({
+        status: 400,
+        message: 'Password must be at least 8 characters',
+      });
+    }
+
+    // If the user has the permission to manage users and they are not
+    // editing themselves, we will just set the new password
+    if (
+      req.user?.hasPermission(Permission.MANAGE_USERS) &&
+      req.user?.id !== user.id
+    ) {
+      await user.setPassword(req.body.newPassword);
+      await userRepository.save(user);
+      logger.debug('Password overriden by user.', {
+        label: 'User Settings',
+        userEmail: user.email,
+        changingUser: req.user.email,
+      });
+      return res.status(204).send();
+    }
+
+    // If the user has a password, we need to check the currentPassword is correct
+    if (
+      user.password &&
+      (!req.body.currentPassword ||
+        !(await userWithPassword.passwordMatch(req.body.currentPassword)))
+    ) {
+      logger.debug(
+        'Attempt to change password for user failed. Invalid current password provided.',
+        { label: 'User Settings', userEmail: user.email }
+      );
+      return next({ status: 403, message: 'Current password is invalid.' });
+    }
+
+    await user.setPassword(req.body.newPassword);
+    await userRepository.save(user);
+
+    return res.status(204).send();
+  } catch (e) {
+    next({ status: 500, message: e.message });
+  }
+});
+
+userSettingsRoutes.get<{ id: string }, UserSettingsNotificationsResponse>(
+  '/notifications',
+  isOwnProfileOrAdmin(),
+  async (req, res, next) => {
+    const userRepository = getRepository(User);
+
+    try {
+      const user = await userRepository.findOne({
+        where: { id: Number(req.params.id) },
+      });
+
+      if (!user) {
+        return next({ status: 404, message: 'User not found.' });
+      }
+
+      return res.status(200).json({
+        enableNotifications: user.settings?.enableNotifications ?? true,
+        discordId: user.settings?.discordId,
+      });
+    } catch (e) {
+      next({ status: 500, message: e.message });
+    }
+  }
+);
+
+userSettingsRoutes.post<
+  { id: string },
+  UserSettingsNotificationsResponse,
+  UserSettingsNotificationsResponse
+>('/notifications', isOwnProfileOrAdmin(), async (req, res, next) => {
+  const userRepository = getRepository(User);
+
+  try {
+    const user = await userRepository.findOne({
+      where: { id: Number(req.params.id) },
+    });
+
+    if (!user) {
+      return next({ status: 404, message: 'User not found.' });
+    }
+
+    if (!user.settings) {
+      user.settings = new UserSettings({
+        user: req.user,
+        enableNotifications: req.body.enableNotifications,
+        discordId: req.body.discordId,
+      });
+    } else {
+      user.settings.enableNotifications = req.body.enableNotifications;
+      user.settings.discordId = req.body.discordId;
+    }
+
+    userRepository.save(user);
+
+    return res.status(200).json({
+      enableNotifications: user.settings.enableNotifications,
+      discordId: user.settings.discordId,
+    });
+  } catch (e) {
+    next({ status: 500, message: e.message });
+  }
+});
+
+userSettingsRoutes.get<{ id: string }, { permissions?: number }>(
+  '/permissions',
+  isAuthenticated(Permission.MANAGE_USERS),
+  async (req, res, next) => {
+    const userRepository = getRepository(User);
+
+    try {
+      const user = await userRepository.findOne({
+        where: { id: Number(req.params.id) },
+      });
+
+      if (!user) {
+        return next({ status: 404, message: 'User not found.' });
+      }
+
+      return res.status(200).json({ permissions: user.permissions });
+    } catch (e) {
+      next({ status: 500, message: e.message });
+    }
+  }
+);
+
+userSettingsRoutes.post<
+  { id: string },
+  { permissions?: number },
+  { permissions: number }
+>(
+  '/permissions',
+  isAuthenticated(Permission.MANAGE_USERS),
+  async (req, res, next) => {
+    const userRepository = getRepository(User);
+
+    try {
+      const user = await userRepository.findOne({
+        where: { id: Number(req.params.id) },
+      });
+
+      if (!user) {
+        return next({ status: 404, message: 'User not found.' });
+      }
+
+      user.permissions = req.body.permissions;
+
+      await userRepository.save(user);
+
+      return res.status(200).json({ permissions: user.permissions });
+    } catch (e) {
+      next({ status: 500, message: e.message });
+    }
+  }
+);
+
+export default userSettingsRoutes;