feat(users): add bulk user actions APIs and improve table selection UX

- add bulk delete, reset usage, revoke subscription, and set owner APIs
- wire frontend bulk actions, dialogs, and translations
- add advanced search apply loading and selection checkbox preference
- improve selected row styling and selection performance

Author: x0sina

app/db/crud/user.py

@@ -960,6 +960,16 @@ async def bulk_reset_user_data_usage(db: AsyncSession, users: list[User]) -> lis
     return users
 
 
+def _build_revoked_proxy_settings(db_user: User) -> dict:
+    proxy_settings = ProxyTable()
+    proxy_settings.vless.flow = db_user.proxy_settings.get("vless", {}).get("flow", "")
+    proxy_settings.shadowsocks.method = db_user.proxy_settings.get("shadowsocks", {}).get(
+        "method", "chacha20-ietf-poly1305"
+    )
+    proxy_settings.wireguard.peer_ips = db_user.proxy_settings.get("wireguard", {}).get("peer_ips", []) or []
+    return proxy_settings.dict()
+
+
 async def reset_user_by_next(db: AsyncSession, db_user: User) -> User:
     """
     Resets the data usage of a user based on next user.
@@ -1034,18 +1044,34 @@ async def revoke_user_sub(db: AsyncSession, db_user: User) -> User:
         User: The updated user object.
     """
     db_user.sub_revoked_at = datetime.now(timezone.utc)
-    proxy_settings = ProxyTable()
-    proxy_settings.vless.flow = db_user.proxy_settings.get("vless", {}).get("flow", "")
-    proxy_settings.shadowsocks.method = db_user.proxy_settings.get("shadowsocks", {}).get(
-        "method", "chacha20-ietf-poly1305"
-    )
-    proxy_settings.wireguard.peer_ips = db_user.proxy_settings.get("wireguard", {}).get("peer_ips", []) or []
-    db_user.proxy_settings = proxy_settings.dict()
+    db_user.proxy_settings = _build_revoked_proxy_settings(db_user)
     await db.commit()
     await refresh_and_load_user(db, db_user)
     return db_user
 
 
+async def bulk_revoke_user_sub(db: AsyncSession, users: list[User]) -> list[User]:
+    """
+    Revoke subscriptions for multiple users in a single transaction.
+
+    Args:
+        db (AsyncSession): Database session.
+        users (list[User]): Users whose subscriptions should be revoked.
+
+    Returns:
+        list[User]: The refreshed users.
+    """
+    revoked_at = datetime.now(timezone.utc)
+    for user in users:
+        user.sub_revoked_at = revoked_at
+        user.proxy_settings = _build_revoked_proxy_settings(user)
+
+    await db.commit()
+    for user in users:
+        await refresh_and_load_user(db, user)
+    return users
+
+
 async def user_sub_update(db: AsyncSession, user_id: User, user_agent: str) -> User:
     """
     Updates the user's subscription details.
@@ -1282,6 +1308,27 @@ async def set_owner(db: AsyncSession, db_user: User, admin: Admin) -> User:
     return db_user
 
 
+async def bulk_set_owner(db: AsyncSession, users: list[User], admin: Admin) -> list[User]:
+    """
+    Set the same owner for multiple users in a single transaction.
+
+    Args:
+        db (AsyncSession): Database session.
+        users (list[User]): Users to update.
+        admin (Admin): Admin that should become the owner.
+
+    Returns:
+        list[User]: The refreshed users.
+    """
+    for user in users:
+        user.admin = admin
+
+    await db.commit()
+    for user in users:
+        await refresh_and_load_user(db, user)
+    return users
+
+
 async def start_users_expire(db: AsyncSession, users: list[User]) -> list[User]:
     """
     Starts the expiration timer for a user.

app/models/user.py

@@ -190,6 +190,29 @@ class RemoveUsersResponse(BaseModel):
     count: int
 
 
+class BulkUsersActionResponse(BaseModel):
+    users: list[str]
+    count: int
+
+
+class BulkUsersSelection(BaseModel):
+    ids: set[int] = Field(default_factory=set)
+
+    @field_validator("ids", mode="after")
+    @classmethod
+    def ids_validator(cls, v):
+        return ListValidator.not_null_list(v, "user")
+
+
+class BulkUsersSetOwner(BulkUsersSelection):
+    admin_username: str
+
+    @field_validator("admin_username", check_fields=False)
+    @classmethod
+    def validate_admin_username(cls, v):
+        return UserValidator.validate_username(v)
+
+
 class ModifyUserByTemplate(BaseModel):
     user_template_id: int
     note: str | None = Field(max_length=500, default=None)

app/operation/user.py

@@ -24,6 +24,9 @@
 from app.db.crud.user import (
     UsersSortingOptions,
     UsersSortingOptionsSimple,
+    bulk_reset_user_data_usage,
+    bulk_revoke_user_sub,
+    bulk_set_owner,
     create_user,
     create_users_bulk,
     get_all_users_usages,
@@ -49,9 +52,12 @@
 from app.models.user import (
     BulkOperationDryRunResponse,
     BulkUser,
+    BulkUsersActionResponse,
     BulkUsersCreateResponse,
     BulkUsersFromTemplate,
     BulkUsersProxy,
+    BulkUsersSelection,
+    BulkUsersSetOwner,
     BulkWireGuardPeerIPs,
     CreateUserFromTemplate,
     ModifyUserByTemplate,
@@ -350,6 +356,52 @@ async def remove_user(self, db: AsyncSession, username: str, admin: AdminDetails
         logger.info(f'User "{db_user.username}" with id "{db_user.id}" deleted by admin "{admin.username}"')
         return {}
 
+    async def _get_validated_users_by_ids(
+        self,
+        db: AsyncSession,
+        user_ids: list[int] | set[int],
+        admin: AdminDetails,
+        *,
+        load_admin: bool = True,
+        load_next_plan: bool = True,
+        load_usage_logs: bool = True,
+        load_groups: bool = True,
+    ) -> list[User]:
+        users: list[User] = []
+        for user_id in user_ids:
+            users.append(
+                await self.get_validated_user_by_id(
+                    db,
+                    user_id,
+                    admin,
+                    load_admin=load_admin,
+                    load_next_plan=load_next_plan,
+                    load_usage_logs=load_usage_logs,
+                    load_groups=load_groups,
+                )
+            )
+        return users
+
+    @staticmethod
+    def _build_bulk_action_response(users: list[User | UserNotificationResponse]) -> BulkUsersActionResponse:
+        usernames = [user.username for user in users]
+        return BulkUsersActionResponse(users=usernames, count=len(usernames))
+
+    async def bulk_remove_users(
+        self, db: AsyncSession, bulk_users: BulkUsersSelection, admin: AdminDetails
+    ) -> RemoveUsersResponse:
+        db_users = await self._get_validated_users_by_ids(db, bulk_users.ids, admin)
+        users = [await self.validate_user(db_user, include_subscription_url=False) for db_user in db_users]
+
+        await remove_users(db, db_users)
+
+        for user in users:
+            await sync_remove_user(user)
+            asyncio.create_task(notification.remove_user(user, admin))
+            logger.info(f'User "{user.username}" with id "{user.id}" deleted by admin "{admin.username}"')
+
+        return RemoveUsersResponse(users=[user.username for user in users], count=len(users))
+
     async def _reset_user_data_usage(
         self,
         db: AsyncSession,
@@ -377,6 +429,24 @@ async def reset_user_data_usage(self, db: AsyncSession, username: str, admin: Ad
 
         return await self._reset_user_data_usage(db, db_user, admin)
 
+    async def bulk_reset_user_data_usage(
+        self, db: AsyncSession, bulk_users: BulkUsersSelection, admin: AdminDetails
+    ) -> BulkUsersActionResponse:
+        db_users = await self._get_validated_users_by_ids(db, bulk_users.ids, admin, load_usage_logs=False)
+        old_statuses = {user.id: user.status for user in db_users}
+
+        db_users = await bulk_reset_user_data_usage(db, db_users)
+        await sync_users(db_users)
+
+        users = [await self.validate_user(db_user) for db_user in db_users]
+        for user in users:
+            if user.status != old_statuses[user.id]:
+                asyncio.create_task(notification.user_status_change(user, admin))
+            asyncio.create_task(notification.reset_user_data_usage(user, admin))
+            logger.info(f'User "{user.username}" usage was reset by admin "{admin.username}"')
+
+        return self._build_bulk_action_response(users)
+
     async def revoke_user_sub(self, db: AsyncSession, username: str, admin: AdminDetails) -> UserResponse:
         db_user = await self.get_validated_user(db, username, admin)
 
@@ -389,6 +459,21 @@ async def revoke_user_sub(self, db: AsyncSession, username: str, admin: AdminDet
 
         return user
 
+    async def bulk_revoke_user_sub(
+        self, db: AsyncSession, bulk_users: BulkUsersSelection, admin: AdminDetails
+    ) -> BulkUsersActionResponse:
+        db_users = await self._get_validated_users_by_ids(db, bulk_users.ids, admin, load_usage_logs=False)
+
+        db_users = await bulk_revoke_user_sub(db, db_users)
+        await sync_users(db_users)
+
+        users = [await self.validate_user(db_user) for db_user in db_users]
+        for user in users:
+            asyncio.create_task(notification.user_subscription_revoked(user, admin))
+            logger.info(f'User "{user.username}" subscription was revoked by admin "{admin.username}"')
+
+        return self._build_bulk_action_response(users)
+
     async def reset_users_data_usage(self, db: AsyncSession, admin: AdminDetails):
         """Reset all users data usage"""
         db_admin = await self.get_validated_admin(db, admin.username)
@@ -429,6 +514,19 @@ async def set_owner(
 
         return user
 
+    async def bulk_set_owner(
+        self, db: AsyncSession, bulk_users: BulkUsersSetOwner, admin: AdminDetails
+    ) -> BulkUsersActionResponse:
+        new_admin = await self.get_validated_admin(db, username=bulk_users.admin_username)
+        db_users = await self._get_validated_users_by_ids(db, bulk_users.ids, admin, load_usage_logs=False)
+
+        db_users = await bulk_set_owner(db, db_users, new_admin)
+        users = [await self.validate_user(db_user) for db_user in db_users]
+        for user in users:
+            logger.info(f'User "{user.username}" owner successfully set to "{new_admin.username}" by admin "{admin.username}"')
+
+        return self._build_bulk_action_response(users)
+
     async def get_user_usage(
         self,
         db: AsyncSession,

app/routers/user.py

@@ -9,9 +9,12 @@
 from app.models.stats import Period, UserUsageStatsList
 from app.models.user import (
     BulkUser,
+    BulkUsersActionResponse,
     BulkUsersCreateResponse,
     BulkUsersFromTemplate,
     BulkUsersProxy,
+    BulkUsersSelection,
+    BulkUsersSetOwner,
     BulkWireGuardPeerIPs,
     CreateUserFromTemplate,
     ModifyUserByTemplate,
@@ -349,6 +352,62 @@ async def delete_expired_users(
     )
 
 
+@router.post(
+    "s/bulk/delete",
+    response_model=RemoveUsersResponse,
+    responses={400: responses._400, 403: responses._403, 404: responses._404},
+)
+async def bulk_delete_users(
+    bulk_users: BulkUsersSelection,
+    db: AsyncSession = Depends(get_db),
+    admin: AdminDetails = Depends(get_current),
+):
+    """Delete selected users by ID."""
+    return await user_operator.bulk_remove_users(db, bulk_users, admin)
+
+
+@router.post(
+    "s/bulk/reset",
+    response_model=BulkUsersActionResponse,
+    responses={400: responses._400, 403: responses._403, 404: responses._404},
+)
+async def bulk_reset_users_data_usage(
+    bulk_users: BulkUsersSelection,
+    db: AsyncSession = Depends(get_db),
+    admin: AdminDetails = Depends(get_current),
+):
+    """Reset usage for selected users by ID."""
+    return await user_operator.bulk_reset_user_data_usage(db, bulk_users, admin)
+
+
+@router.post(
+    "s/bulk/revoke_sub",
+    response_model=BulkUsersActionResponse,
+    responses={400: responses._400, 403: responses._403, 404: responses._404},
+)
+async def bulk_revoke_users_subscription(
+    bulk_users: BulkUsersSelection,
+    db: AsyncSession = Depends(get_db),
+    admin: AdminDetails = Depends(get_current),
+):
+    """Revoke subscriptions for selected users by ID."""
+    return await user_operator.bulk_revoke_user_sub(db, bulk_users, admin)
+
+
+@router.put(
+    "s/bulk/set_owner",
+    response_model=BulkUsersActionResponse,
+    responses={400: responses._400, 403: responses._403, 404: responses._404},
+)
+async def bulk_set_owner(
+    bulk_users: BulkUsersSetOwner,
+    db: AsyncSession = Depends(get_db),
+    admin: AdminDetails = Depends(check_sudo_admin),
+):
+    """Set a new owner for selected users by ID."""
+    return await user_operator.bulk_set_owner(db, bulk_users, admin)
+
+
 @router.post("/from_template", status_code=status.HTTP_201_CREATED, response_model=UserResponse)
 async def create_user_from_template(
     new_template_user: CreateUserFromTemplate,

dashboard/public/statics/locales/en.json

@@ -1932,9 +1932,25 @@
     "selectAdmin": "Select new owner",
     "confirm": "Set Owner",
     "success": "User {{username}}'s owner changed to {{admin}} successfully.",
+    "bulkDescription": "Select a new owner for {{count}} selected users.",
+    "bulkSuccess": "Owner for {{count}} users changed to {{admin}} successfully.",
     "error": "Failed to change owner of user {{username}} to {{admin}}.",
     "loadError": "Failed to load admins."
   },
+  "bulkUserActions": {
+    "deleteTitle": "Delete Selected Users",
+    "deletePrompt": "Are you sure you want to delete {{count}} selected users? This action cannot be undone.",
+    "deleteSuccess": "{{count}} users deleted successfully.",
+    "deleteError": "Failed to delete selected users.",
+    "resetTitle": "Reset Selected Users Usage",
+    "resetPrompt": "Are you sure you want to reset usage for {{count}} selected users?",
+    "resetSuccess": "Usage reset for {{count}} users.",
+    "resetError": "Failed to reset usage for selected users.",
+    "revokeTitle": "Revoke Selected Users Subscription",
+    "revokePrompt": "Are you sure you want to revoke subscriptions for {{count}} selected users?",
+    "revokeSuccess": "Subscriptions revoked for {{count}} users.",
+    "revokeError": "Failed to revoke subscriptions for selected users."
+  },
   "bulk": {
     "title": "Bulk",
     "createUsers": "Create Users",
@@ -2096,6 +2112,7 @@
     "byUsername": "Username and Notes",
     "byProtocol": "Protocol Data",
     "showCreatedBy": "Show created by",
+    "showSelectionCheckbox": "Show selection checkbox",
     "byStatus": "Status",
     "byAdmin": "Admin",
     "byGroup": "Group",