R5 the server's own settings: instance, rules, announcements, relays, media limits, the staff's log

A singleton ServerSettings (title, descriptions, contact, thumbnail, privacy policy, terms, rules, relays, media
overrides, PublishActivity), cached by InstanceSettings and read by the instance API, NodeInfo, the instance actor, the
web pages and the mailer; its defaults are the old literals, so nothing changes until an administrator edits.
/clientapi/admin/settings (and /thumbnail), /announcements, /relays for administrators; /clientapi/moderator/log, the
staff's log (AdminAction, written by domain blocks, backups, settings and the CLI; no IP, never a root paired with its
personas). The Mastodon API's rules, extended description, privacy policy, terms of service, domain blocks (Published,
Obfuscate), announcements (dismiss, reactions, streaming) and activity (only when published). Reports carry rule ids.
Media overrides clamped to hard caps. Relays named by the settings reconcile next to the configured ones.

Verified: interop.sh instance accounts relay with mastodon, relay, aoderelay and mailpit, 119 passed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Infrastructure/Cli/AdminCommands.cs

@@ -4,6 +4,7 @@ using OpenIddict.Abstractions;
 
 using PrivaPub.ClientModels;
 using PrivaPub.ClientModels.User;
+using PrivaPub.Domain.Moderation;
 using PrivaPub.Infrastructure.Backup;
 using PrivaPub.Models;
 using PrivaPub.Models.User;
@@ -46,7 +47,7 @@ namespace PrivaPub.Infrastructure.Cli
 			switch (args)
 			{
 				case [("promote" or "demote") and var verb, var userName]:
-					return await Promote(verb == "promote", userName, output);
+					return await Promote(services, verb == "promote", userName, output);
 				case ["create-root", var login, .. var flags] when flags.All(f => f == "--admin"):
 					return await CreateRoot(services, login, input.ReadLine(), flags.Contains("--admin"), output);
 				case ["move-persona", var persona, var root]:
@@ -54,7 +55,7 @@ namespace PrivaPub.Infrastructure.Cli
 				case ["delete-root", var root]:
 					return await DeleteRoot(services, root, output);
 				case ["reset-totp", var root]:
-					return await ResetTotp(root, output);
+					return await ResetTotp(services, root, output);
 				case ["media", "audit", .. var flags] when flags.All(f => f == "--fix"):
 					return await AuditMedia(services, flags.Contains("--fix"), output);
 				case ["backup", "verify", var id]:
@@ -139,6 +140,7 @@ namespace PrivaPub.Infrastructure.Cli
 				Console.Error.WriteLine(refused);
 				return 1;
 			}
+			await Log(services, AdminActions.BackupRestore, AdminTargets.Backup, id, id);
 			output.WriteLine($"{id} will be restored: the running service stops within seconds and restores it when it starts again");
 			output.WriteLine("(systemd starts it again; follow it with journalctl -u privapub, then PrivaPub admin restore --status)");
 			return 0;
@@ -187,7 +189,12 @@ namespace PrivaPub.Infrastructure.Cli
 			return 0;
 		}
 
-		static async Task<int> Promote(bool promote, string userName, TextWriter output)
+		// every act below is kept in the staff's log as the command line's ("cli"): a login's by its name alone, a persona's
+		// without the login it went to
+		static Task Log(IServiceProvider services, string action, string kind, string id, string label, string note = default) =>
+			services.GetRequiredService<IModerationLog>().Write(AdminAction.Cli, action, kind, id, label, note: note);
+
+		static async Task<int> Promote(IServiceProvider services, bool promote, string userName, TextWriter output, bool created = false)
 		{
 			userName = userName.ToLowerInvariant();
 			var user = await DB.Default.Find<RootUser>().Match(u => u.UserName == userName).ExecuteFirstAsync();
@@ -201,6 +208,8 @@ namespace PrivaPub.Infrastructure.Cli
 			await DB.Default.SaveAsync(user);
 			if (promote)
 				await ServerSetup.Seal(user.ID, default);//an administrator exists: the client's setup is closed
+			if (!created)
+				await Log(services, promote ? AdminActions.RootPromote : AdminActions.RootDemote, AdminTargets.Root, user.ID, userName);
 
 			output.WriteLine($"{userName}: {string.Join(", ", user.Policies)}");
 			return 0;
@@ -223,7 +232,9 @@ namespace PrivaPub.Infrastructure.Cli
 				Console.Error.WriteLine(created.ErrorMessage);
 				return 1;
 			}
-			return admin ? await Promote(true, login, output) : await Report(login, output);
+			var made = await DB.Default.Find<RootUser>().Match(u => u.UserName == login.ToLowerInvariant()).ExecuteFirstAsync();
+			await Log(services, AdminActions.RootCreate, AdminTargets.Root, made?.ID, login.ToLowerInvariant(), admin ? "administrator" : default);
+			return admin ? await Promote(services, true, login, output, created: true) : await Report(login, output);
 		}
 
 		static Task<int> Report(string login, TextWriter output)
@@ -266,22 +277,24 @@ namespace PrivaPub.Infrastructure.Cli
 			await DB.Default.Update<RootToAvatar>().MatchID(link.ID).Modify(ra => ra.RootId, root.ID).ExecuteAsync();
 			await services.GetRequiredService<IOpenIddictTokenManager>().RevokeBySubjectAsync(persona.ID);
 			await services.GetRequiredService<IOpenIddictAuthorizationManager>().RevokeBySubjectAsync(persona.ID);
+			await Log(services, AdminActions.PersonaMove, AdminTargets.Persona, persona.ID, "@" + personaName, "moved to another login");
 			output.WriteLine($"@{personaName}: moved to {login}");
 			return 0;
 		}
 
 		// The way back for a login that lost its authenticator and its recovery codes: its two-factor sign-in goes, its
 		// password stays.
-		static async Task<int> ResetTotp(string login, TextWriter output)
+		static async Task<int> ResetTotp(IServiceProvider services, string login, TextWriter output)
 		{
 			login = login.ToLowerInvariant();
-			var updated = await DB.Default.Update<RootUser>().Match(u => u.UserName == login && u.DeletedAt == null)
-				.Modify(u => u.Totp, null).ExecuteAsync();
-			if (updated.MatchedCount == 0)
+			var root = await DB.Default.Find<RootUser>().Match(u => u.UserName == login && u.DeletedAt == null).ExecuteFirstAsync();
+			var updated = root == default ? default : await DB.Default.Update<RootUser>().MatchID(root.ID).Modify(u => u.Totp, null).ExecuteAsync();
+			if (updated == default || updated.MatchedCount == 0)
 			{
 				Console.Error.WriteLine($"no root user '{login}'");
 				return 1;
 			}
+			await Log(services, AdminActions.RootResetTotp, AdminTargets.Root, root.ID, login);
 			output.WriteLine($"{login}: two-factor sign-in is off");
 			return 0;
 		}
@@ -305,6 +318,7 @@ namespace PrivaPub.Infrastructure.Cli
 				Console.Error.WriteLine($"'{login}' could not be deleted");
 				return 1;
 			}
+			await Log(services, AdminActions.RootDelete, AdminTargets.Root, root.ID, login);
 			output.WriteLine($"{login}: deleted{(personas.Count > 0 ? ", with " + string.Join(", ", personas) : string.Empty)}");
 			return 0;
 		}