up

src/main/java/su/xserver/iikocon/AuthHandler.java

@@ -21,25 +21,52 @@ public class AuthHandler {
       return;
     }
 
-    userService.findByLogin(login).onComplete(ar -> {
+    userService.findByLoginOrEmail(login).onComplete(ar -> {
       if (ar.succeeded() && ar.result() != null) {
         JsonObject user = ar.result();
-        if (userService.checkPassword(password, user.getString("password"))) {
+        System.out.println("User found: " + user.encode());
+
+        boolean passwordOk = userService.checkPassword(password, user.getString("password"));
+        System.out.println("Password OK: " + passwordOk);
+
+        if (passwordOk) {
+          // Надёжное получение флага активности
+          Boolean active = user.getBoolean("active");
+          if (active == null) {
+            // Если поле отсутствует, пробуем получить как Integer (на случай TINYINT)
+            Integer activeInt = user.getInteger("active");
+            active = activeInt != null && activeInt == 1;
+          }
+          System.out.println("Active flag: " + active);
+
+          if (!active) {
+            System.out.println("Sending: Account not activated");
+            ctx.response().setStatusCode(401).end("Account not activated");
+            return;
+          }
+
           Session session = ctx.session();
           session.put("userId", user.getInteger("id"));
           session.put("login", user.getString("login"));
           ctx.response().end(new JsonObject().put("success", true).put("login", user.getString("login")).encode());
         } else {
+          System.out.println("Sending: Invalid credentials (password mismatch)");
           ctx.response().setStatusCode(401).end("Invalid credentials");
         }
       } else {
+        System.out.println("Sending: Invalid credentials (user not found or error)");
         ctx.response().setStatusCode(401).end("Invalid credentials");
       }
     });
   }
 
   public void handleLogout(RoutingContext ctx) {
-    ctx.session().destroy();
+    Session session = ctx.session();
+    if (session != null) {
+      session.destroy();
+    }
+    // Явное удаление cookie сессии
+    ctx.response().removeCookie("admin.session");
     ctx.response().end(new JsonObject().put("success", true).encode());
   }
 
@@ -50,5 +77,5 @@ public class AuthHandler {
     } else {
       ctx.next();
     }
-  };
+  }
 }

src/main/java/su/xserver/iikocon/MainVerticle.java

@@ -186,6 +186,7 @@ public class MainVerticle extends AbstractVerticle {
         rc.response().setStatusCode(400).end("Missing login, email or password");
         return;
       }
+      // Создаём активного пользователя (active = true)
       userService.createUser(login, email, password, ip, true)
         .onSuccess(v -> rc.response().setStatusCode(201).end())
         .onFailure(err -> rc.response().setStatusCode(500).end(err.getMessage()));
@@ -209,6 +210,15 @@ public class MainVerticle extends AbstractVerticle {
 
     router.delete("/api/admin/users/:id").handler(rc -> {
       int id = Integer.parseInt(rc.pathParam("id"));
+      Integer currentUserId = rc.session().get("userId");
+
+      if (currentUserId != null && currentUserId == id) {
+        rc.response().setStatusCode(403).end(new JsonObject()
+          .put("error", "You cannot delete your own account")
+          .encode());
+        return;
+      }
+
       userService.deleteUser(id)
         .onSuccess(v -> rc.response().end())
         .onFailure(err -> rc.response().setStatusCode(500).end(err.getMessage()));
@@ -217,6 +227,13 @@ public class MainVerticle extends AbstractVerticle {
     router.put("/api/admin/users/:id/activate").handler(rc -> {
       int id = Integer.parseInt(rc.pathParam("id"));
       boolean active = Boolean.parseBoolean(rc.queryParam("active").get(0));
+      Integer currentUserId = rc.session().get("userId");
+
+      if (currentUserId != null && currentUserId == id) {
+        rc.response().setStatusCode(403).end(new JsonObject().put("error", "You cannot deactivate yourself").encode());
+        return;
+      }
+
       userService.setActive(id, active)
         .onSuccess(v -> rc.response().end())
         .onFailure(err -> rc.response().setStatusCode(500).end(err.getMessage()));

src/main/java/su/xserver/iikocon/UserService.java

@@ -5,6 +5,7 @@ import io.vertx.core.json.JsonArray;
 import io.vertx.core.json.JsonObject;
 import io.vertx.sqlclient.Pool;
 import io.vertx.sqlclient.Row;
+import io.vertx.sqlclient.Tuple;
 import io.vertx.sqlclient.templates.SqlTemplate;
 import org.mindrot.jbcrypt.BCrypt;
 
@@ -66,6 +67,21 @@ public class UserService {
       .execute(Map.of("id", id, "active", active)).mapEmpty();
   }
 
+  public Future<JsonObject> findByLoginOrEmail(String loginOrEmail) {
+    String sql = "SELECT id, login, email, password, active, ip, created, updated FROM users WHERE login = ? OR email = ?";
+    return pool.preparedQuery(sql)
+      .execute(Tuple.of(loginOrEmail, loginOrEmail))
+      .map(rows -> {
+        if (rows.size() == 0) {
+          System.out.println("User not found: " + loginOrEmail);
+          return null;
+        }
+        Row row = rows.iterator().next();
+        System.out.println("User found, active=" + row.getBoolean("active"));
+        return toJson(row);
+      });
+  }
+
   public Future<JsonObject> findByEmail(String email) {
     return SqlTemplate.forQuery(pool, "SELECT id, login, email, password, active, ip, created, updated FROM users WHERE email = #{email}")
       .mapTo(this::toJson)
@@ -94,7 +110,16 @@ public class UserService {
       .execute()
       .map(rows -> {
         JsonArray array = new JsonArray();
-        rows.forEach(row -> array.add(toJson(row)));
+        for (Row row : rows) {
+          array.add(new JsonObject()
+            .put("id", row.getInteger("id"))
+            .put("login", row.getString("login"))
+            .put("email", row.getString("email"))
+            .put("active", row.getBoolean("active"))
+            .put("ip", row.getString("ip"))
+            .put("created", row.getLocalDateTime("created") != null ? row.getLocalDateTime("created").toString() : null)
+            .put("updated", row.getLocalDateTime("updated") != null ? row.getLocalDateTime("updated").toString() : null));
+        }
         return array;
       });
   }
@@ -135,6 +160,7 @@ public class UserService {
       .put("id", row.getInteger("id"))
       .put("login", row.getString("login"))
       .put("email", row.getString("email"))
+      .put("password", row.getString("password"))  // ← ДОБАВИТЬ ЭТУ СТРОКУ
       .put("active", row.getBoolean("active"))
       .put("ip", row.getString("ip"))
       .put("created", row.getLocalDateTime("created") != null ? row.getLocalDateTime("created").toString() : null)