fix: bound a bulk user action

Closes the half I left open when the last review pointed out that the honest bound for
a bulk action is on the caller's id list. Nothing upstream provided one: the ids arrive
straight off a JSON decode from the panel, /v1 and the post_users_bulk MCP tool. Each id
costs a row read, and a delete costs a webhook delivery per subscriber on a 512-slot
queue that drops when full — so an unbounded list quietly lost the very notifications it
generated, while holding the single DB connection for as long as it took. Capped at
1000, which no operator meets working through the panel.

The test is worth a note. The first version built a bare Manager and asserted "some
error", and it passed with the bound removed — the nil store was erroring on its own.
That is exactly the tautological-test trap the previous pass caught twice elsewhere, so
this one runs against a real store, checks an ordinary selection still goes through, and
asserts the specific error code. Mutation-checked: deleting the bound fails it.

Author: AppsGanin

internal/core/manager_users.go

@@ -198,6 +198,11 @@ func (m *Manager) SetUserLimits(ctx context.Context, id, dataLimit, expireAt int
 	return err
 }
 
+// maxBulkUsers caps one bulk action. High enough that no operator meets it working
+// through the panel, low enough that a single call cannot monopolise the one DB
+// connection or overrun the webhook queue.
+const maxBulkUsers = 1000
+
 // BulkUserAction applies one action to many users with a SINGLE config sync at the
 // end (instead of one per user), returning how many users were actually affected.
 // Actions: "enable", "disable", "delete", "reset" (traffic), "extend" (push expiry
@@ -207,6 +212,16 @@ func (m *Manager) BulkUserAction(ctx context.Context, ids []int64, action string
 	if len(ids) == 0 {
 		return 0, invalidCode("err.noUsersSelected", "не выбрано ни одного пользователя")
 	}
+	// A bound, because nothing upstream provides one: the id list arrives straight off a
+	// JSON decode from the panel, /v1 and the post_users_bulk MCP tool. Every id costs a
+	// row read, and a delete costs a webhook delivery per subscriber on a 512-slot queue
+	// that drops when full — so an unbounded list quietly loses the very notifications it
+	// generates, and holds the single DB connection for as long as it takes.
+	if len(ids) > maxBulkUsers {
+		return 0, invalidCode("err.tooManyUsersSelected",
+			"за один раз можно обработать не больше {{max}} пользователей",
+			map[string]any{"max": maxBulkUsers})
+	}
 	// Snapshot the users up front. The audit rows for a bulk DELETE can't look their
 	// names up afterwards; an id that isn't in the snapshot doesn't exist (so this
 	// doubles as the "which ids are real" filter); and the prior state is what tells a

internal/core/manager_users_test.go

@@ -0,0 +1,47 @@
+package core
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"testing"
+
+	"github.com/AppsGanin/rospanel/internal/store"
+)
+
+// A bulk action is reachable from the panel, /v1 and the post_users_bulk MCP tool, and
+// the id list arrives straight off a JSON decode with no bound anywhere upstream. Every
+// id costs a row read, and a delete costs a webhook delivery per subscriber on a queue
+// that drops when full — so an unbounded list silently loses the notifications it
+// generates while holding the single DB connection.
+func TestBulkUserActionIsBounded(t *testing.T) {
+	// A real store, because the point is that the BOUND refuses the call — with a bare
+	// Manager the nil store errors on its own and the test would pass either way. (It
+	// did, the first time I wrote it.)
+	st, err := store.Open(filepath.Join(t.TempDir(), "bulk.db"))
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	t.Cleanup(func() { st.Close() })
+	m := &Manager{store: st}
+
+	u, err := st.CreateUser("bulk-one", "uuid", "pw", "tok", 0, 0, 0)
+	if err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+
+	// An ordinary selection goes through: the bound must not refuse real work.
+	if _, err := m.BulkUserAction(context.Background(), []int64{u.ID}, "disable", 0); err != nil {
+		t.Fatalf("an ordinary bulk action was refused: %v", err)
+	}
+
+	ids := make([]int64, maxBulkUsers+1)
+	for i := range ids {
+		ids[i] = int64(i + 1)
+	}
+	_, err = m.BulkUserAction(context.Background(), ids, "disable", 0)
+	var ve *ValidationError
+	if !errors.As(err, &ve) || ve.Code != "err.tooManyUsersSelected" {
+		t.Errorf("%d ids were accepted (or refused for the wrong reason): %v", len(ids), err)
+	}
+}

internal/i18n/errcatalog_gen.go

@@ -405,6 +405,7 @@ const en: Dict = {
     loginCharset: "username: 3–32 characters, Latin letters, digits, dot, hyphen or underscore",
     nameRequired: "enter a name",
     noFailedToRetry: "there are no failed deliveries to retry",
+    tooManyUsersSelected: "at most {{max}} users can be processed in one call",
     noUsersSelected: "no users selected",
     nothingToSend: "nothing to send — add text or an attachment",
     nothingToUpdate: "nothing to update",

web/src/i18n/en.ts

@@ -408,6 +408,7 @@ const ru = {
     loginCharset: "логин: 3–32 символа, латиница, цифры, точка, дефис или подчёркивание",
     nameRequired: "укажите имя",
     noFailedToRetry: "нет неудачных отправок для повтора",
+    tooManyUsersSelected: "за один раз можно обработать не больше {{max}} пользователей",
     noUsersSelected: "не выбрано ни одного пользователя",
     nothingToSend: "нечего отправлять — добавьте текст или вложение",
     nothingToUpdate: "нечего обновлять",