1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
import { z } from 'zod';
import { hashPassword } from '@/lib/password';
import { parseRequest } from '@/lib/request';
import { badRequest, json, ok, unauthorized } from '@/lib/response';
import { userRoleParam } from '@/lib/schema';
import { canDeleteUser, canUpdateUser, canViewUser } from '@/permissions';
import { deleteUser, getUser, getUserByUsername, updateUser } from '@/queries/prisma';
export async function GET(request: Request, { params }: { params: Promise<{ userId: string }> }) {
const { auth, error } = await parseRequest(request);
if (error) {
return error();
}
const { userId } = await params;
if (!(await canViewUser(auth, userId))) {
return unauthorized();
}
const user = await getUser(userId);
return json(user);
}
export async function POST(request: Request, { params }: { params: Promise<{ userId: string }> }) {
const schema = z.object({
username: z.string().max(255).optional(),
password: z.string().max(255).optional(),
role: userRoleParam.optional(),
});
const { auth, body, error } = await parseRequest(request, schema);
if (error) {
return error();
}
const { userId } = await params;
if (!(await canUpdateUser(auth, userId))) {
return unauthorized();
}
const { username, password, role } = body;
const user = await getUser(userId);
const data: any = {};
if (password) {
data.password = hashPassword(password);
}
// Only admin can change these fields
if (role && auth.user.isAdmin) {
data.role = role;
}
if (username && auth.user.isAdmin) {
data.username = username;
}
// Check when username changes
if (data.username && user.username !== data.username) {
const user = await getUserByUsername(username);
if (user) {
return badRequest({ message: 'User already exists' });
}
}
const updated = await updateUser(userId, data);
return json(updated);
}
export async function DELETE(
request: Request,
{ params }: { params: Promise<{ userId: string }> },
) {
const { auth, error } = await parseRequest(request);
if (error) {
return error();
}
const { userId } = await params;
if (!(await canDeleteUser(auth))) {
return unauthorized();
}
if (userId === auth.user.id) {
return badRequest({ message: 'You cannot delete yourself.' });
}
await deleteUser(userId);
return ok();
}
|