jason
115 lines
3.7 KiB
TypeScript
115 lines
3.7 KiB
TypeScript
import { type NextRequest } from "next/server";
|
|
import { prisma } from "@/lib/prisma";
|
|
import { ok, errorResponse, requireRole, parseJson, ApiError } from "@/lib/api";
|
|
import { UpdateUserSchema } from "@/lib/schemas";
|
|
import { hashPassword, hashPin } from "@/lib/password";
|
|
import { audit } from "@/lib/audit";
|
|
import { clientIp } from "@/lib/request";
|
|
|
|
export async function PATCH(req: NextRequest, ctx: { params: Promise<{ id: string }> }) {
|
|
try {
|
|
const actor = await requireRole("admin");
|
|
const { id } = await ctx.params;
|
|
const body = await parseJson(req, UpdateUserSchema);
|
|
|
|
const user = await prisma.user.findUnique({ where: { id } });
|
|
if (!user) throw new ApiError(404, "not_found", "User not found");
|
|
|
|
const data: Record<string, unknown> = {};
|
|
if (body.name !== undefined) data.name = body.name;
|
|
if (body.active !== undefined) data.active = body.active;
|
|
|
|
if (user.role === "admin") {
|
|
if (body.email) {
|
|
const dup = await prisma.user.findFirst({
|
|
where: { email: body.email, id: { not: id } },
|
|
});
|
|
if (dup) throw new ApiError(409, "duplicate", "Email already in use");
|
|
data.email = body.email;
|
|
}
|
|
if (body.password) data.passwordHash = await hashPassword(body.password);
|
|
if (body.pin) {
|
|
throw new ApiError(400, "invalid_field", "Admins don't have PINs");
|
|
}
|
|
} else {
|
|
if (body.email || body.password) {
|
|
throw new ApiError(400, "invalid_field", "Operators use PIN, not email/password");
|
|
}
|
|
if (body.pin) {
|
|
data.pinHash = await hashPin(body.pin);
|
|
data.failedAttempts = 0;
|
|
data.lockedUntil = null;
|
|
}
|
|
if (body.name && body.name !== user.name) {
|
|
const dup = await prisma.user.findFirst({
|
|
where: { role: "operator", name: body.name, id: { not: id } },
|
|
});
|
|
if (dup) throw new ApiError(409, "duplicate", "Operator name already in use");
|
|
}
|
|
}
|
|
|
|
const updated = await prisma.user.update({
|
|
where: { id },
|
|
data,
|
|
select: { id: true, role: true, name: true, email: true, active: true },
|
|
});
|
|
|
|
await audit({
|
|
actorId: actor.id,
|
|
action: "update",
|
|
entity: "User",
|
|
entityId: id,
|
|
after: {
|
|
changed: Object.keys(data).filter((k) => k !== "passwordHash" && k !== "pinHash"),
|
|
secretsChanged: "passwordHash" in data || "pinHash" in data,
|
|
},
|
|
ipAddress: clientIp(req),
|
|
});
|
|
|
|
return ok({ user: updated });
|
|
} catch (err) {
|
|
return errorResponse(err);
|
|
}
|
|
}
|
|
|
|
export async function DELETE(req: NextRequest, ctx: { params: Promise<{ id: string }> }) {
|
|
try {
|
|
const actor = await requireRole("admin");
|
|
const { id } = await ctx.params;
|
|
|
|
if (id === actor.id) {
|
|
throw new ApiError(400, "self_delete", "You cannot delete your own account");
|
|
}
|
|
|
|
const user = await prisma.user.findUnique({ where: { id } });
|
|
if (!user) throw new ApiError(404, "not_found", "User not found");
|
|
|
|
if (user.role === "admin") {
|
|
const otherAdmins = await prisma.user.count({
|
|
where: { role: "admin", active: true, id: { not: id } },
|
|
});
|
|
if (otherAdmins === 0) {
|
|
throw new ApiError(400, "last_admin", "Cannot remove the last active admin");
|
|
}
|
|
}
|
|
|
|
// soft-delete: deactivate and remove all sessions
|
|
await prisma.$transaction([
|
|
prisma.session.deleteMany({ where: { userId: id } }),
|
|
prisma.user.update({ where: { id }, data: { active: false } }),
|
|
]);
|
|
|
|
await audit({
|
|
actorId: actor.id,
|
|
action: "deactivate",
|
|
entity: "User",
|
|
entityId: id,
|
|
ipAddress: clientIp(req),
|
|
});
|
|
|
|
return ok({ ok: true });
|
|
} catch (err) {
|
|
return errorResponse(err);
|
|
}
|
|
}
|