56 lines
1.4 KiB
TypeScript
56 lines
1.4 KiB
TypeScript
|
import { Router } from 'express';
|
||
|
|
import { users } from '../db';
|
||
|
|
import { requireAuth } from '../middleware/requireAuth';
|
||
|
|
import { requireAdmin, requireSuperAdmin } from '../middleware/requireAdmin';
|
||
|
|
|
||
|
|
const router = Router();
|
||
|
|
|
||
|
|
// All admin routes require a valid JWT first
|
||
|
|
router.use( requireAuth );
|
||
|
|
|
||
|
|
// GET /api/admin/users — list all users (admin + superadmin)
|
||
|
|
router.get( '/users', requireAdmin, ( _req, res ) =>
|
||
|
|
{
|
||
|
|
const all = users.all().map( u => (
|
||
|
|
{
|
||
|
|
id: u.id,
|
||
|
|
email: u.email,
|
||
|
|
roles: u.roles,
|
||
|
|
createdAt: u.createdAt
|
||
|
|
} ) );
|
||
|
|
res.json( all );
|
||
|
|
} );
|
||
|
|
|
||
|
|
// PATCH /api/admin/users/:id/roles — set roles on a user (superadmin only)
|
||
|
|
router.patch( '/users/:id/roles', requireSuperAdmin, ( req, res ) =>
|
||
|
|
{
|
||
|
|
const { id } = req.params;
|
||
|
|
|
||
|
|
if ( id === req.auth!.userId )
|
||
|
|
{
|
||
|
|
res.status( 400 ).json( { error: 'Cannot change your own roles' } );
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
const target = users.findById( id );
|
||
|
|
if ( !target )
|
||
|
|
{
|
||
|
|
res.status( 404 ).json( { error: 'User not found' } );
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
const { roles } = req.body as { roles?: string[] };
|
||
|
|
if ( !Array.isArray( roles ) )
|
||
|
|
{
|
||
|
|
res.status( 400 ).json( { error: 'roles must be an array' } );
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Always keep 'user' as base role
|
||
|
|
const next = roles.includes( 'user' ) ? roles : [ ...roles, 'user' ];
|
||
|
|
users.update( id, { roles: next } );
|
||
|
|
res.json( { id, roles: next } );
|
||
|
|
} );
|
||
|
|
|
||
|
|
export default router;
|