modrinth/apps/labrinth/src/routes/internal/moderation/mod.rs

use super::ApiError;
use crate::auth::get_user_from_headers;
use crate::database;
use crate::database::PgPool;
use crate::database::models::DBModerationLock;
use crate::database::models::moderation_external_item;
use crate::database::redis::RedisPool;
use crate::models::ids::OrganizationId;
use crate::models::projects::{Project, ProjectStatus};
use crate::queue::moderation::{ApprovalType, IdentifiedFile, MissingMetadata};
use crate::queue::session::AuthQueue;
use crate::util::error::Context;
use crate::{
    auth::{check_is_moderator_from_headers, get_user_from_bearer_token},
    models::pats::Scopes,
};
use actix_web::{HttpRequest, delete, get, post, web};
use ariadne::ids::{UserId, random_base62};
use chrono::{DateTime, Utc};
use ownership::get_projects_ownership;
use serde::{Deserialize, Serialize};
use std::collections::HashMap;

pub mod external_license;
mod ownership;
pub mod tech_review;

pub fn config(cfg: &mut actix_web::web::ServiceConfig) {
    cfg.service(get_projects)
        .service(get_project_meta)
        .service(set_project_meta)
        .service(acquire_lock)
        .service(override_lock)
        .service(get_lock_status)
        .service(release_lock)
        .service(release_lock_beacon)
        .service(delete_all_locks)
        .service(web::scope("/tech-review").configure(tech_review::config))
        .service(
            web::scope("/external-license").configure(external_license::config),
        );
}

#[derive(Deserialize, utoipa::ToSchema)]
pub struct ProjectsRequestOptions {
    /// How many projects to fetch.
    #[serde(default = "default_count")]
    pub count: u16,
    /// How many projects to skip.
    #[serde(default)]
    pub offset: u32,
    /// Whether to filter by modpacks that have external dependencies.
    #[serde(default)]
    pub has_external_dependencies: Option<bool>,
}

fn default_count() -> u16 {
    100
}

/// Project with extra information fetched from the database, to avoid having
/// clients make more round trips.
#[derive(Debug, Serialize, Deserialize, utoipa::ToSchema)]
pub struct FetchedProject {
    /// Project info.
    #[serde(flatten)]
    pub project: Project,
    /// Who owns the project.
    pub ownership: Ownership,
    /// How many external file dependencies the project has.
    pub external_dependencies_count: i64,
}

/// Fetched information on who owns a project.
#[derive(Debug, Serialize, Deserialize, utoipa::ToSchema, Clone)]
#[serde(tag = "kind", rename_all = "snake_case")]
pub enum Ownership {
    /// Project is owned by a team, and this is the team owner.
    User {
        /// ID of the team owner.
        id: UserId,
        /// Name of the team owner.
        name: String,
        /// URL of the team owner's icon.
        icon_url: Option<String>,
    },
    /// Project is owned by an organization.
    Organization {
        /// ID of the organization.
        id: OrganizationId,
        /// Name of the organization.
        name: String,
        /// URL of the organization's icon.
        icon_url: Option<String>,
    },
}

/// Response for lock status check
#[derive(Debug, Serialize, Deserialize, utoipa::ToSchema)]
pub struct LockStatusResponse {
    /// Whether the project is currently locked
    pub locked: bool,
    /// Whether the requesting user holds the lock
    pub is_own_lock: bool,
    /// Information about who holds the lock (if locked)
    #[serde(skip_serializing_if = "Option::is_none")]
    pub locked_by: Option<LockedByUser>,
    /// When the lock was acquired
    #[serde(skip_serializing_if = "Option::is_none")]
    pub locked_at: Option<DateTime<Utc>>,
    /// When the lock expires
    #[serde(skip_serializing_if = "Option::is_none")]
    pub expires_at: Option<DateTime<Utc>>,
    /// Whether the lock has expired
    #[serde(skip_serializing_if = "Option::is_none")]
    pub expired: Option<bool>,
}

/// Information about the moderator holding the lock
#[derive(Debug, Serialize, Deserialize, utoipa::ToSchema)]
pub struct LockedByUser {
    /// User ID (base62 encoded)
    pub id: String,
    /// Username
    pub username: String,
    /// Avatar URL
    pub avatar_url: Option<String>,
}

/// Response for successful lock acquisition
#[derive(Debug, Serialize, Deserialize, utoipa::ToSchema)]
pub struct LockAcquireResponse {
    /// Whether lock was successfully acquired
    pub success: bool,
    /// Whether the requesting user holds the lock (true when success is true)
    pub is_own_lock: bool,
    /// If blocked, info about who holds the lock
    #[serde(skip_serializing_if = "Option::is_none")]
    pub locked_by: Option<LockedByUser>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub locked_at: Option<DateTime<Utc>>,
    /// When the lock expires (present whether acquired or blocked)
    #[serde(skip_serializing_if = "Option::is_none")]
    pub expires_at: Option<DateTime<Utc>>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub expired: Option<bool>,
}

/// Response for lock release
#[derive(Debug, Serialize, Deserialize, utoipa::ToSchema)]
pub struct LockReleaseResponse {
    pub success: bool,
}

/// Response for deleting all locks
#[derive(Debug, Serialize, Deserialize, utoipa::ToSchema)]
pub struct DeleteAllLocksResponse {
    pub deleted_count: u64,
}

/// List projects in the moderation queue.  
#[utoipa::path(
	context_path = "/moderation",
	tag = "moderation",
	params(
		("count" = Option<u16>, Query),
		("offset" = Option<u32>, Query),
		("has_external_dependencies" = Option<bool>, Query)
	),
    responses((status = OK, body = inline(Vec<FetchedProject>)))
)]
#[get("/projects")]
pub async fn get_projects(
    req: HttpRequest,
    pool: web::Data<PgPool>,
    redis: web::Data<RedisPool>,
    request_opts: web::Query<ProjectsRequestOptions>,
    session_queue: web::Data<AuthQueue>,
) -> Result<web::Json<Vec<FetchedProject>>, ApiError> {
    get_projects_internal(req, pool, redis, request_opts, session_queue).await
}

pub async fn get_projects_internal(
    req: HttpRequest,
    pool: web::Data<PgPool>,
    redis: web::Data<RedisPool>,
    request_opts: web::Query<ProjectsRequestOptions>,
    session_queue: web::Data<AuthQueue>,
) -> Result<web::Json<Vec<FetchedProject>>, ApiError> {
    check_is_moderator_from_headers(
        &req,
        &**pool,
        &redis,
        &session_queue,
        Scopes::PROJECT_READ,
    )
    .await?;

    use futures::stream::TryStreamExt;

    let project_rows = sqlx::query!(
        r#"
        SELECT
            id,
            external_dependencies_count as "external_dependencies_count!"
        FROM (
            SELECT DISTINCT ON (m.id)
                m.id,
                m.queued,
                (
                    SELECT COUNT(*)
                    FROM versions v
                    INNER JOIN dependencies d ON d.dependent_id = v.id
                    WHERE v.mod_id = m.id
                        AND d.dependency_file_name IS NOT NULL
                ) external_dependencies_count
            FROM mods m

            /* -- Temporarily, don't exclude projects in tech rev q

                -- exclude projects in tech review queue
                LEFT JOIN delphi_issue_details_with_statuses didws
                    ON didws.project_id = m.id AND didws.status = 'pending'
            */

            WHERE
                m.status = $1
                /* AND didws.status IS NULL */ -- Temporarily don't exclude

            GROUP BY m.id
        ) t
        WHERE
            ($4::boolean IS NULL OR (external_dependencies_count > 0) = $4)
        ORDER BY queued ASC
        OFFSET $3
        LIMIT $2
        "#,
        ProjectStatus::Processing.as_str(),
        request_opts.count as i64,
        request_opts.offset as i64,
        request_opts.has_external_dependencies,
    )
    .fetch(&**pool)
    .try_collect::<Vec<_>>()
    .await
    .wrap_internal_err("failed to fetch projects awaiting review")?;

    let project_ids = project_rows
        .iter()
        .map(|m| database::models::DBProjectId(m.id))
        .collect::<Vec<_>>();
    let project_metadata = project_rows
        .into_iter()
        .map(|m| {
            (
                database::models::DBProjectId(m.id),
                m.external_dependencies_count,
            )
        })
        .collect::<HashMap<_, _>>();

    let projects =
        database::DBProject::get_many_ids(&project_ids, &**pool, &redis)
            .await
            .wrap_internal_err("failed to fetch projects")?
            .into_iter()
            .map(crate::models::projects::Project::from)
            .collect::<Vec<_>>();

    let ownerships = get_projects_ownership(&projects, &pool, &redis)
        .await
        .wrap_internal_err("failed to fetch project ownerships")?;

    let map_project =
        |(project, ownership): (Project, Ownership)| -> FetchedProject {
            let external_dependencies_count = project_metadata
                .get(&database::models::DBProjectId(project.id.0 as i64))
                .copied()
                .unwrap_or_default();

            FetchedProject {
                ownership,
                project,
                external_dependencies_count,
            }
        };

    let projects = projects
        .into_iter()
        .zip(ownerships)
        .map(map_project)
        .collect::<Vec<_>>();

    Ok(web::Json(projects))
}

/// Get project moderation metadata.  
#[utoipa::path(
	context_path = "/moderation",
	tag = "moderation",
	responses((status = OK, body = MissingMetadata))
)]
#[get("/project/{id}")]
pub async fn get_project_meta(
    req: HttpRequest,
    pool: web::Data<PgPool>,
    redis: web::Data<RedisPool>,
    session_queue: web::Data<AuthQueue>,
    info: web::Path<(String,)>,
) -> Result<web::Json<MissingMetadata>, ApiError> {
    check_is_moderator_from_headers(
        &req,
        &**pool,
        &redis,
        &session_queue,
        Scopes::PROJECT_READ,
    )
    .await?;

    let project_id = info.into_inner().0;
    let project =
        database::models::DBProject::get(&project_id, &**pool, &redis).await?;

    if let Some(project) = project {
        let rows = sqlx::query!(
            "
            SELECT
            f.metadata, v.id version_id
            FROM versions v
            INNER JOIN files f ON f.version_id = v.id
            WHERE v.mod_id = $1
            ",
            project.inner.id.0
        )
        .fetch_all(&**pool)
        .await?;

        let mut merged = MissingMetadata {
            identified: HashMap::new(),
            flame_files: HashMap::new(),
            unknown_files: HashMap::new(),
        };

        let mut check_hashes = Vec::new();
        let mut check_flames = Vec::new();

        for row in rows {
            if let Some(metadata) = row
                .metadata
                .and_then(|x| serde_json::from_value::<MissingMetadata>(x).ok())
            {
                merged.identified.extend(metadata.identified);
                merged.flame_files.extend(metadata.flame_files);
                merged.unknown_files.extend(metadata.unknown_files);

                check_hashes.extend(merged.flame_files.keys().cloned());
                check_hashes.extend(merged.unknown_files.keys().cloned());
                check_flames
                    .extend(merged.flame_files.values().map(|x| x.id as i32));
            }
        }

        let rows = sqlx::query!(
            "
            SELECT encode(mef.sha1, 'escape') sha1, mel.status status
            FROM moderation_external_files mef
            INNER JOIN moderation_external_licenses mel ON mef.external_license_id = mel.id
            WHERE mef.sha1 = ANY($1)
            ",
            &check_hashes
                .iter()
                .map(|x| x.as_bytes().to_vec())
                .collect::<Vec<_>>()
        )
        .fetch_all(&**pool)
        .await?;

        for row in rows {
            if let Some(sha1) = row.sha1 {
                if let Some(val) = merged.flame_files.remove(&sha1) {
                    merged.identified.insert(
                        sha1,
                        IdentifiedFile {
                            file_name: val.file_name,
                            status: ApprovalType::from_string(&row.status)
                                .unwrap_or(ApprovalType::Unidentified),
                        },
                    );
                } else if let Some(val) = merged.unknown_files.remove(&sha1) {
                    merged.identified.insert(
                        sha1,
                        IdentifiedFile {
                            file_name: val,
                            status: ApprovalType::from_string(&row.status)
                                .unwrap_or(ApprovalType::Unidentified),
                        },
                    );
                }
            }
        }

        let rows = sqlx::query!(
            "
            SELECT mel.id, mel.flame_project_id, mel.status status
            FROM moderation_external_licenses mel
            WHERE mel.flame_project_id = ANY($1)
            ",
            &check_flames,
        )
        .fetch_all(&**pool)
        .await?;

        for row in rows {
            if let Some(sha1) = merged
                .flame_files
                .iter()
                .find(|x| Some(x.1.id as i32) == row.flame_project_id)
                .map(|x| x.0.clone())
                && let Some(val) = merged.flame_files.remove(&sha1)
            {
                merged.identified.insert(
                    sha1,
                    IdentifiedFile {
                        file_name: val.file_name.clone(),
                        status: ApprovalType::from_string(&row.status)
                            .unwrap_or(ApprovalType::Unidentified),
                    },
                );
            }
        }

        Ok(web::Json(merged))
    } else {
        Err(ApiError::NotFound)
    }
}

#[derive(Debug, Serialize, Deserialize, utoipa::ToSchema)]
#[serde(tag = "type", rename_all = "snake_case")]
pub enum Judgement {
    Flame {
        id: i32,
        status: ApprovalType,
        link: String,
        title: String,
    },
    Unknown {
        status: ApprovalType,
        proof: Option<String>,
        link: Option<String>,
        title: Option<String>,
    },
}

/// Update project moderation judgements.  
#[utoipa::path(
	context_path = "/moderation",
	tag = "moderation",
	responses((status = NO_CONTENT))
)]
#[post("/project")]
pub async fn set_project_meta(
    req: HttpRequest,
    pool: web::Data<PgPool>,
    redis: web::Data<RedisPool>,
    session_queue: web::Data<AuthQueue>,
    judgements: web::Json<HashMap<String, Judgement>>,
) -> Result<(), ApiError> {
    let user = check_is_moderator_from_headers(
        &req,
        &**pool,
        &redis,
        &session_queue,
        Scopes::PROJECT_READ,
    )
    .await?;

    let mut transaction = pool.begin().await?;

    let mut licenses = Vec::new();
    let mut file_hashes = Vec::new();
    let mut file_filenames = Vec::new();
    let mut file_license_ids = Vec::new();

    for (hash, judgement) in judgements.0 {
        let id = random_base62(8);

        let (title, status, link, proof, flame_id) = match judgement {
            Judgement::Flame {
                id,
                status,
                link,
                title,
            } => (
                Some(title),
                status,
                Some(link),
                Some("See Flame page/license for permission".to_string()),
                Some(id),
            ),
            Judgement::Unknown {
                status,
                proof,
                link,
                title,
            } => (title, status, link, proof, None),
        };

        licenses.push(moderation_external_item::ExternalLicense {
            id: id as i64,
            title,
            status: status.as_str().to_string(),
            link,
            proof,
            flame_project_id: flame_id,
        });
        file_hashes.push(hash);
        file_filenames.push(None);
        file_license_ids.push(id as i64);
    }

    let user_id = database::models::ids::DBUserId::from(user.id);

    moderation_external_item::ExternalLicense::insert_many(
        &mut transaction,
        &licenses,
        user_id,
    )
    .await?;

    moderation_external_item::ExternalLicense::insert_files(
        &mut transaction,
        &file_hashes
            .iter()
            .map(|x| x.as_bytes().to_vec())
            .collect::<Vec<_>>(),
        &file_filenames,
        &file_license_ids,
        user_id,
    )
    .await?;

    transaction.commit().await?;

    Ok(())
}

/// Acquire a moderation lock.  
/// Returns success if acquired, or info about who holds the lock if blocked.
#[utoipa::path(
	context_path = "/moderation",
	tag = "moderation",
    responses(
        (status = OK, body = LockAcquireResponse),
        (status = NOT_FOUND, description = "Project not found")
    )
)]
#[post("/lock/{project_id}")]
pub async fn acquire_lock(
    req: HttpRequest,
    pool: web::Data<PgPool>,
    redis: web::Data<RedisPool>,
    session_queue: web::Data<AuthQueue>,
    path: web::Path<(String,)>,
) -> Result<web::Json<LockAcquireResponse>, ApiError> {
    let user = check_is_moderator_from_headers(
        &req,
        &**pool,
        &redis,
        &session_queue,
        Scopes::PROJECT_WRITE,
    )
    .await?;

    let project_id_str = path.into_inner().0;
    let project =
        database::models::DBProject::get(&project_id_str, &**pool, &redis)
            .await?
            .ok_or(ApiError::NotFound)?;

    let db_project_id = project.inner.id;
    let db_user_id = database::models::DBUserId::from(user.id);

    match DBModerationLock::acquire(db_project_id, db_user_id, &pool).await? {
        Ok(()) => Ok(web::Json(LockAcquireResponse {
            success: true,
            is_own_lock: true,
            locked_by: None,
            locked_at: None,
            expires_at: None,
            expired: None,
        })),
        Err(lock) => Ok(web::Json(LockAcquireResponse {
            success: false,
            is_own_lock: false,
            locked_by: Some(LockedByUser {
                id: UserId::from(lock.moderator_id).to_string(),
                username: lock.moderator_username,
                avatar_url: lock.moderator_avatar_url,
            }),
            locked_at: Some(lock.locked_at),
            expires_at: Some(lock.expires_at),
            expired: Some(lock.expired),
        })),
    }
}

/// Override a moderation lock.  
#[utoipa::path(
	context_path = "/moderation",
	tag = "moderation",
    responses(
        (status = OK, body = LockAcquireResponse),
        (status = NOT_FOUND, description = "Project not found")
    )
)]
#[post("/lock/{project_id}/override")]
pub async fn override_lock(
    req: HttpRequest,
    pool: web::Data<PgPool>,
    redis: web::Data<RedisPool>,
    session_queue: web::Data<AuthQueue>,
    path: web::Path<(String,)>,
) -> Result<web::Json<LockAcquireResponse>, ApiError> {
    let user = check_is_moderator_from_headers(
        &req,
        &**pool,
        &redis,
        &session_queue,
        Scopes::PROJECT_WRITE,
    )
    .await?;

    let project_id_str = path.into_inner().0;
    let project =
        database::models::DBProject::get(&project_id_str, &**pool, &redis)
            .await?
            .ok_or(ApiError::NotFound)?;

    let db_project_id = project.inner.id;
    let db_user_id = database::models::DBUserId::from(user.id);

    DBModerationLock::force_acquire(db_project_id, db_user_id, &pool).await?;

    Ok(web::Json(LockAcquireResponse {
        success: true,
        is_own_lock: true,
        locked_by: None,
        locked_at: None,
        expires_at: None,
        expired: None,
    }))
}

/// Get moderation lock status.  
#[utoipa::path(
	context_path = "/moderation",
	tag = "moderation",
    responses(
        (status = OK, body = LockStatusResponse),
        (status = NOT_FOUND, description = "Project not found")
    )
)]
#[get("/lock/{project_id}")]
pub async fn get_lock_status(
    req: HttpRequest,
    pool: web::Data<PgPool>,
    redis: web::Data<RedisPool>,
    session_queue: web::Data<AuthQueue>,
    path: web::Path<(String,)>,
) -> Result<web::Json<LockStatusResponse>, ApiError> {
    let user = check_is_moderator_from_headers(
        &req,
        &**pool,
        &redis,
        &session_queue,
        Scopes::PROJECT_READ,
    )
    .await?;

    let project_id_str = path.into_inner().0;
    let project =
        database::models::DBProject::get(&project_id_str, &**pool, &redis)
            .await?
            .ok_or(ApiError::NotFound)?;

    let db_project_id = project.inner.id;
    let db_user_id = database::models::DBUserId::from(user.id);

    match DBModerationLock::get_with_user(db_project_id, &pool).await? {
        Some(lock) => {
            let is_own_lock = lock.moderator_id == db_user_id;
            Ok(web::Json(LockStatusResponse {
                locked: true,
                is_own_lock,
                locked_by: Some(LockedByUser {
                    id: UserId::from(lock.moderator_id).to_string(),
                    username: lock.moderator_username,
                    avatar_url: lock.moderator_avatar_url,
                }),
                locked_at: Some(lock.locked_at),
                expires_at: Some(lock.expires_at),
                expired: Some(lock.expired),
            }))
        }
        None => Ok(web::Json(LockStatusResponse {
            locked: false,
            is_own_lock: false,
            locked_by: None,
            locked_at: None,
            expires_at: None,
            expired: None,
        })),
    }
}

/// Release a moderation lock.  
#[utoipa::path(
	context_path = "/moderation",
	tag = "moderation",
    responses(
        (status = OK, body = LockReleaseResponse),
        (status = NOT_FOUND, description = "Project not found")
    )
)]
#[delete("/lock/{project_id}")]
pub async fn release_lock(
    req: HttpRequest,
    pool: web::Data<PgPool>,
    redis: web::Data<RedisPool>,
    session_queue: web::Data<AuthQueue>,
    path: web::Path<(String,)>,
) -> Result<web::Json<LockReleaseResponse>, ApiError> {
    let user = check_is_moderator_from_headers(
        &req,
        &**pool,
        &redis,
        &session_queue,
        Scopes::PROJECT_WRITE,
    )
    .await?;

    let project_id_str = path.into_inner().0;
    let project =
        database::models::DBProject::get(&project_id_str, &**pool, &redis)
            .await?
            .ok_or(ApiError::NotFound)?;

    let db_project_id = project.inner.id;
    let db_user_id = database::models::DBUserId::from(user.id);

    let released =
        DBModerationLock::release(db_project_id, db_user_id, &pool).await?;

    let _ = DBModerationLock::cleanup_expired(&pool).await;

    Ok(web::Json(LockReleaseResponse { success: released }))
}

/// Release a moderation lock by beacon.  
///
/// For use with `navigator.sendBeacon`, which cannot set `Authorization` or send `DELETE`.
/// The body must be `text/plain` containing the same token value as the `Authorization` header
/// (optional `Bearer ` prefix). This avoids a CORS preflight compared to `application/json`.
#[utoipa::path(
	context_path = "/moderation",
	tag = "moderation",
    request_body(
        content = String,
        description = "Token value (same as Authorization header)",
        content_type = "text/plain"
    ),
    responses(
        (status = OK, body = LockReleaseResponse),
        (status = NOT_FOUND, description = "Project not found")
    )
)]
#[post("/lock/{project_id}/release")]
pub async fn release_lock_beacon(
    req: HttpRequest,
    pool: web::Data<PgPool>,
    redis: web::Data<RedisPool>,
    session_queue: web::Data<AuthQueue>,
    path: web::Path<(String,)>,
    body: String,
) -> Result<web::Json<LockReleaseResponse>, ApiError> {
    let token = body.trim();
    if token.is_empty() {
        return Err(ApiError::InvalidInput(
            "missing token in request body".to_string(),
        ));
    }
    let token = token.strip_prefix("Bearer ").unwrap_or(token).trim();

    let (scopes, user) = get_user_from_bearer_token(
        &req,
        Some(token),
        &**pool,
        &redis,
        &session_queue,
        false,
    )
    .await?;

    if !scopes.contains(Scopes::PROJECT_WRITE) {
        return Err(ApiError::CustomAuthentication(
            "token is missing required scopes".to_string(),
        ));
    }
    if !user.role.is_mod() {
        return Err(ApiError::CustomAuthentication(
            "only moderators may release moderation locks".to_string(),
        ));
    }

    let project_id_str = path.into_inner().0;
    let project =
        database::models::DBProject::get(&project_id_str, &**pool, &redis)
            .await?
            .ok_or(ApiError::NotFound)?;

    let db_project_id = project.inner.id;
    let db_user_id = database::models::DBUserId::from(user.id);

    let released =
        DBModerationLock::release(db_project_id, db_user_id, &pool).await?;

    let _ = DBModerationLock::cleanup_expired(&pool).await;

    Ok(web::Json(LockReleaseResponse { success: released }))
}

/// Delete all moderation locks.  
#[utoipa::path(
	context_path = "/moderation",
	tag = "moderation",
    responses(
        (status = OK, body = DeleteAllLocksResponse),
        (status = UNAUTHORIZED, description = "Not an admin")
    )
)]
#[delete("/locks")]
pub async fn delete_all_locks(
    req: HttpRequest,
    pool: web::Data<PgPool>,
    redis: web::Data<RedisPool>,
    session_queue: web::Data<AuthQueue>,
) -> Result<web::Json<DeleteAllLocksResponse>, ApiError> {
    let user = get_user_from_headers(
        &req,
        &**pool,
        &redis,
        &session_queue,
        Scopes::PROJECT_WRITE,
    )
    .await?
    .1;

    if !user.role.is_admin() {
        return Err(ApiError::CustomAuthentication(
            "You must be an admin to delete all locks".to_string(),
        ));
    }

    let deleted_count = DBModerationLock::delete_all(&pool).await?;

    Ok(web::Json(DeleteAllLocksResponse { deleted_count }))
}