bas/solelog
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(api): deactivate/reactivate users (ban + revoke sessions) with guards

Browse Source
This commit is contained in:
Bas van Rossem
2026-06-24 22:54:02 +02:00
parent 88b7773317
commit 40977f8abd
2 changed files with 133 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
apps/api/src/routes/admin-users.ts
View File

@@ -87,3 +87,36 @@ adminUsersRoutes.post('/api/admin/users/:id/role', async (c) => {
const [updated] = await db.select().from(user).where(eq(user.id, id));
return c.json(toListItem(updated));
});
adminUsersRoutes.post('/api/admin/users/:id/deactivate', async (c) => {
const id = c.req.param('id');
const caller = await getSessionUser(c);
const [target] = await db.select().from(user).where(eq(user.id, id));
if (!target) return c.json({ error: 'Gebruiker niet gevonden' }, 404);
if (id === caller?.id) return c.json({ error: 'Je kunt jezelf niet deactiveren.' }, 400);
if (target.role === 'admin' && (await activeAdminsExcluding(id)) === 0) {
return c.json({ error: 'Er moet minstens één actieve beheerder blijven.' }, 400);
}
await db
.update(user)
.set({ banned: true, banReason: null, banExpires: null })
.where(eq(user.id, id));
await db.delete(session).where(eq(session.userId, id)); // kill any live token
const [updated] = await db.select().from(user).where(eq(user.id, id));
return c.json(toListItem(updated));
});
adminUsersRoutes.post('/api/admin/users/:id/reactivate', async (c) => {
const id = c.req.param('id');
const [target] = await db.select().from(user).where(eq(user.id, id));
if (!target) return c.json({ error: 'Gebruiker niet gevonden' }, 404);
await db
.update(user)
.set({ banned: false, banReason: null, banExpires: null })
.where(eq(user.id, id));
const [updated] = await db.select().from(user).where(eq(user.id, id));
return c.json(toListItem(updated));
});