mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-11 05:42:19 +00:00
Marc-André Bombeck
107db1bb55
There was no way for an admin to remove someone else's account; the
users list only offered the undo for a deletion the account itself or a
Guardian had asked for.
DELETE /api/admin/users/{id} takes the account's own deletion path,
now shared as requestAccountDeletion: with a grace window the account
is locked at once (credentials revoked, record untouched) and erased by
the purge job when the window ends, and the existing undo gives it back
until then; with ACCOUNT_DELETION_GRACE_DAYS=0 it is erased in the
request. The route is cookie-only behind requireAdmin and the
recent-proof gate, takes the typed DELETE_ACCOUNT confirmation, and
refuses the caller's own account, a managed profile (its Guardians
delete it), an account already pending deletion, the last admin who
can sign in and the last Guardian of a managed profile, the last three
decided under their locks inside the transaction. Both the admin and
the account get an audit row.
The users list says who asked for a pending deletion, now including an
admin, and flags managed profiles. Each other account's row carries a
delete button whose confirmation names the purge date, or says the
erasure is immediate when the server keeps no window.
68 lines
2.3 KiB
TypeScript
68 lines
2.3 KiB
TypeScript
import { prisma } from "@/lib/db";
|
|
import { apiHandler, requireAdmin } from "@/lib/api-handler";
|
|
import { apiSuccess } from "@/lib/api-response";
|
|
import { annotate } from "@/lib/logging/context";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
export const GET = apiHandler(async () => {
|
|
await requireAdmin();
|
|
annotate({ action: { name: "admin.users.list" } });
|
|
|
|
const users = await prisma.user.findMany({
|
|
select: {
|
|
id: true,
|
|
username: true,
|
|
email: true,
|
|
role: true,
|
|
createdAt: true,
|
|
mfaEnforced: true,
|
|
documentQuotaBytes: true,
|
|
deletionRequestedAt: true,
|
|
deletionPurgeAt: true,
|
|
deletionRequestedById: true,
|
|
managedProfileAt: true,
|
|
_count: { select: { passkeys: true } },
|
|
},
|
|
orderBy: { createdAt: "asc" },
|
|
});
|
|
|
|
return apiSuccess(
|
|
users.map((u) => ({
|
|
id: u.id,
|
|
username: u.username,
|
|
email: u.email,
|
|
role: u.role,
|
|
createdAt: u.createdAt,
|
|
// v1.23 — per-user "require a second factor" override. The effective
|
|
// requirement is the OR of this and the instance-wide policy.
|
|
mfaEnforced: u.mfaEnforced,
|
|
// Document vault — per-user storage-quota override. Null = the
|
|
// instance default applies. BigInt in Prisma, number on the wire
|
|
// (max override 1 TiB, comfortably inside Number's safe range).
|
|
documentQuotaBytes:
|
|
u.documentQuotaBytes === null ? null : Number(u.documentQuotaBytes),
|
|
passkeyCount: u._count.passkeys,
|
|
// A record somebody else runs. Its Guardians delete it, so the list
|
|
// offers no admin deletion on it.
|
|
managedProfile: u.managedProfileAt != null,
|
|
// An account pending deletion: when it was asked for, when the
|
|
// purge job erases it, and who asked: the account itself, a Guardian
|
|
// (a managed profile), or an admin. Null on every other account.
|
|
// The list offers "Undo deletion" on these rows until `purgeAt`.
|
|
deletion: u.deletionRequestedAt
|
|
? {
|
|
requestedAt: u.deletionRequestedAt,
|
|
purgeAt: u.deletionPurgeAt,
|
|
requestedBy:
|
|
u.deletionRequestedById === u.id
|
|
? ("self" as const)
|
|
: u.managedProfileAt != null
|
|
? ("guardian" as const)
|
|
: ("admin" as const),
|
|
}
|
|
: null,
|
|
})),
|
|
);
|
|
});
|