{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/users/[id]/index.ts"],"sourcesContent":["/**\n * User management detail endpoint\n *\n * GET /_emdash/api/admin/users/:id - Get user details\n * PUT /_emdash/api/admin/users/:id - Update user\n */\n\nimport { builtinRoleForLevel, Role } from \"@premium-cms/auth\";\nimport { createKyselyAdapter } from \"@premium-cms/auth/adapters/kysely\";\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError } from \"#api/error.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { userUpdateBody } from \"#api/schemas.js\";\nimport { invalidateAuthzCache } from \"#auth/authz.js\";\nimport { AuthzRepository } from \"#db/repositories/authz.js\";\nimport { withTransaction } from \"#db/transaction.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user: currentUser } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(currentUser, \"users:read\");\n\tif (denied) return denied;\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\tconst { id } = params;\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"User ID required\", 400);\n\t}\n\n\ttry {\n\t\tconst result = await adapter.getUserWithDetails(id);\n\n\t\tif (!result) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 404);\n\t\t}\n\n\t\t// Transform for JSON serialization\n\t\tconst item = {\n\t\t\tid: result.user.id,\n\t\t\temail: result.user.email,\n\t\t\tname: result.user.name,\n\t\t\tavatarUrl: result.user.avatarUrl,\n\t\t\trole: result.user.role,\n\t\t\troleId: result.user.roleId,\n\t\t\temailVerified: result.user.emailVerified,\n\t\t\tdisabled: result.user.disabled,\n\t\t\tcreatedAt: result.user.createdAt.toISOString(),\n\t\t\tupdatedAt: result.user.updatedAt.toISOString(),\n\t\t\tlastLogin: result.lastLogin?.toISOString() ?? null,\n\t\t\tcredentials: result.credentials.map((c) => ({\n\t\t\t\tid: c.id,\n\t\t\t\tname: c.name,\n\t\t\t\tdeviceType: c.deviceType,\n\t\t\t\tcreatedAt: c.createdAt.toISOString(),\n\t\t\t\tlastUsedAt: c.lastUsedAt.toISOString(),\n\t\t\t})),\n\t\t\toauthAccounts: result.oauthAccounts.map((a) => ({\n\t\t\t\tprovider: a.provider,\n\t\t\t\tcreatedAt: a.createdAt.toISOString(),\n\t\t\t})),\n\t\t};\n\n\t\treturn apiSuccess({ item });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get user details\", \"USER_DETAIL_ERROR\");\n\t}\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user: currentUser } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(currentUser, \"users:manage\");\n\tif (denied) return denied;\n\n\tconst adapter = createKyselyAdapter(emdash.db);\n\n\tconst { id } = params;\n\n\tif (!id) {\n\t\treturn apiError(\"MISSING_PARAM\", \"User ID required\", 400);\n\t}\n\n\ttry {\n\t\t// Get target user\n\t\tconst targetUser = await adapter.getUserById(id);\n\t\tif (!targetUser) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"User not found\", 404);\n\t\t}\n\n\t\tconst body = await parseBody(request, userUpdateBody);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Resolve the target role. `roleId` (id or slug) wins; the legacy\n\t\t// `role` level maps to the built-in role for that tier. Either way the\n\t\t// user's level column follows the role so pre-policy code keeps a floor.\n\t\tlet role = body.role;\n\t\tlet roleId: string | undefined;\n\t\tif (body.roleId !== undefined) {\n\t\t\tconst summary = await new AuthzRepository(emdash.db).getRole(body.roleId);\n\t\t\tif (!summary) return apiError(\"UNKNOWN_ROLE\", \"Role not found\", 400);\n\t\t\troleId = summary.id;\n\t\t\trole = summary.level as typeof role;\n\t\t} else if (role !== undefined) {\n\t\t\troleId = `role:${builtinRoleForLevel(role).slug}`;\n\t\t}\n\n\t\t// Prevent editing own role (security: prevents self-demotion/lockout)\n\t\tif (roleId !== undefined && id === currentUser!.id) {\n\t\t\treturn apiError(\"SELF_ROLE_CHANGE\", \"Cannot change your own role\", 400);\n\t\t}\n\n\t\t// Check email uniqueness if changing email\n\t\tif (body.email && body.email !== targetUser.email) {\n\t\t\tconst existing = await adapter.getUserByEmail(body.email);\n\t\t\tif (existing) {\n\t\t\t\treturn apiError(\"EMAIL_IN_USE\", \"Email already in use\", 409);\n\t\t\t}\n\t\t}\n\n\t\t// Wrap admin demotion guard + update in a transaction to prevent\n\t\t// two concurrent demotions from both passing the count check.\n\t\tconst isDemotingAdmin =\n\t\t\trole !== undefined && role < Role.ADMIN && targetUser.role === Role.ADMIN;\n\n\t\tconst lastAdminBlocked = await withTransaction(emdash.db, async (trx) => {\n\t\t\tconst trxAdapter = createKyselyAdapter(trx);\n\t\t\tif (isDemotingAdmin) {\n\t\t\t\tconst adminCount = await trxAdapter.countAdmins();\n\t\t\t\tif (adminCount <= 1) return true;\n\t\t\t}\n\t\t\tawait trxAdapter.updateUser(id, {\n\t\t\t\tname: body.name,\n\t\t\t\temail: body.email,\n\t\t\t\trole,\n\t\t\t\troleId,\n\t\t\t});\n\t\t\treturn false;\n\t\t});\n\t\tinvalidateAuthzCache();\n\n\t\tif (lastAdminBlocked) {\n\t\t\treturn apiError(\n\t\t\t\t\"LAST_ADMIN\",\n\t\t\t\t\"Cannot demote the last admin. Promote another user first.\",\n\t\t\t\t400,\n\t\t\t);\n\t\t}\n\n\t\t// Fetch updated user\n\t\tconst updated = await adapter.getUserById(id);\n\n\t\treturn apiSuccess({\n\t\t\titem: {\n\t\t\t\tid: updated!.id,\n\t\t\t\temail: updated!.email,\n\t\t\t\tname: updated!.name,\n\t\t\t\tavatarUrl: updated!.avatarUrl,\n\t\t\t\trole: updated!.role,\n\t\t\t\troleId: updated!.roleId,\n\t\t\t\temailVerified: updated!.emailVerified,\n\t\t\t\tdisabled: updated!.disabled,\n\t\t\t\tcreatedAt: updated!.createdAt.toISOString(),\n\t\t\t\tupdatedAt: updated!.updatedAt.toISOString(),\n\t\t\t},\n\t\t});\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to update user\", \"USER_UPDATE_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,MAAM,gBAAgB;AAEtC,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,aAAa,aAAa;AACrD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,oBAAoB,OAAO,GAAG;CAE9C,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,oBAAoB,IAAI;AAG1D,KAAI;EACH,MAAM,SAAS,MAAM,QAAQ,mBAAmB,GAAG;AAEnD,MAAI,CAAC,OACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;AA6BpD,SAAO,WAAW,EAAE,MAzBP;GACZ,IAAI,OAAO,KAAK;GAChB,OAAO,OAAO,KAAK;GACnB,MAAM,OAAO,KAAK;GAClB,WAAW,OAAO,KAAK;GACvB,MAAM,OAAO,KAAK;GAClB,QAAQ,OAAO,KAAK;GACpB,eAAe,OAAO,KAAK;GAC3B,UAAU,OAAO,KAAK;GACtB,WAAW,OAAO,KAAK,UAAU,aAAa;GAC9C,WAAW,OAAO,KAAK,UAAU,aAAa;GAC9C,WAAW,OAAO,WAAW,aAAa,IAAI;GAC9C,aAAa,OAAO,YAAY,KAAK,OAAO;IAC3C,IAAI,EAAE;IACN,MAAM,EAAE;IACR,YAAY,EAAE;IACd,WAAW,EAAE,UAAU,aAAa;IACpC,YAAY,EAAE,WAAW,aAAa;IACtC,EAAE;GACH,eAAe,OAAO,cAAc,KAAK,OAAO;IAC/C,UAAU,EAAE;IACZ,WAAW,EAAE,UAAU,aAAa;IACpC,EAAE;GACH,EAEyB,CAAC;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,8BAA8B,oBAAoB;;;AAI9E,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,MAAM,gBAAgB;AAEtC,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,aAAa,eAAe;AACvD,KAAI,OAAQ,QAAO;CAEnB,MAAM,UAAU,oBAAoB,OAAO,GAAG;CAE9C,MAAM,EAAE,OAAO;AAEf,KAAI,CAAC,GACJ,QAAO,SAAS,iBAAiB,oBAAoB,IAAI;AAG1D,KAAI;EAEH,MAAM,aAAa,MAAM,QAAQ,YAAY,GAAG;AAChD,MAAI,CAAC,WACJ,QAAO,SAAS,aAAa,kBAAkB,IAAI;EAGpD,MAAM,OAAO,MAAM,UAAU,SAAS,eAAe;AACrD,MAAI,aAAa,KAAK,CAAE,QAAO;EAK/B,IAAI,OAAO,KAAK;EAChB,IAAI;AACJ,MAAI,KAAK,WAAW,QAAW;GAC9B,MAAM,UAAU,MAAM,IAAI,gBAAgB,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO;AACzE,OAAI,CAAC,QAAS,QAAO,SAAS,gBAAgB,kBAAkB,IAAI;AACpE,YAAS,QAAQ;AACjB,UAAO,QAAQ;aACL,SAAS,OACnB,UAAS,QAAQ,oBAAoB,KAAK,CAAC;AAI5C,MAAI,WAAW,UAAa,OAAO,YAAa,GAC/C,QAAO,SAAS,oBAAoB,+BAA+B,IAAI;AAIxE,MAAI,KAAK,SAAS,KAAK,UAAU,WAAW,OAE3C;OADiB,MAAM,QAAQ,eAAe,KAAK,MAAM,CAExD,QAAO,SAAS,gBAAgB,wBAAwB,IAAI;;EAM9D,MAAM,kBACL,SAAS,UAAa,OAAO,KAAK,SAAS,WAAW,SAAS,KAAK;EAErE,MAAM,mBAAmB,MAAM,gBAAgB,OAAO,IAAI,OAAO,QAAQ;GACxE,MAAM,aAAa,oBAAoB,IAAI;AAC3C,OAAI,iBAEH;QADmB,MAAM,WAAW,aAAa,IAC/B,EAAG,QAAO;;AAE7B,SAAM,WAAW,WAAW,IAAI;IAC/B,MAAM,KAAK;IACX,OAAO,KAAK;IACZ;IACA;IACA,CAAC;AACF,UAAO;IACN;AACF,wBAAsB;AAEtB,MAAI,iBACH,QAAO,SACN,cACA,6DACA,IACA;EAIF,MAAM,UAAU,MAAM,QAAQ,YAAY,GAAG;AAE7C,SAAO,WAAW,EACjB,MAAM;GACL,IAAI,QAAS;GACb,OAAO,QAAS;GAChB,MAAM,QAAS;GACf,WAAW,QAAS;GACpB,MAAM,QAAS;GACf,QAAQ,QAAS;GACjB,eAAe,QAAS;GACxB,UAAU,QAAS;GACnB,WAAW,QAAS,UAAU,aAAa;GAC3C,WAAW,QAAS,UAAU,aAAa;GAC3C,EACD,CAAC;UACM,OAAO;AACf,SAAO,YAAY,OAAO,yBAAyB,oBAAoB"}