gorkem-bwl
82998a7795
## Changes - Add DELETE /api/v1/auth/users/:userId endpoint (admin + superadmin) - Add deleteUserById service method with role hierarchy enforcement - Superadmins can remove admins and regular users - Admins can only remove regular users - No one can remove superadmins, demo users, or themselves via this endpoint - Add "Remove user" button with confirmation dialog on edit user page - Allow admins to view user details and access the edit user page - Add i18n strings for remove user button and confirmation dialog ## Access control - superadmin -> can remove admin, user - admin -> can remove user only - admin cannot remove superadmin or other admins (enforced on both backend and frontend)
44 lines
1.8 KiB
TypeScript
Executable File
44 lines
1.8 KiB
TypeScript
Executable File
import { Router, RequestHandler } from "express";
|
|
import { isAllowed } from "../middleware/isAllowed.js";
|
|
import multer from "multer";
|
|
|
|
const upload = multer();
|
|
|
|
class AuthRoutes {
|
|
private router: Router;
|
|
private authController: any;
|
|
|
|
constructor(authController: any, verifyJWT: RequestHandler) {
|
|
this.router = Router();
|
|
this.authController = authController;
|
|
this.initRoutes(verifyJWT);
|
|
}
|
|
|
|
initRoutes(verifyJWT: RequestHandler) {
|
|
this.router.post("/register", upload.single("profileImage"), this.authController.registerUser);
|
|
this.router.post("/login", this.authController.loginUser);
|
|
|
|
this.router.post("/recovery/request", this.authController.requestRecovery);
|
|
this.router.post("/recovery/validate", this.authController.validateRecovery);
|
|
this.router.post("/recovery/reset/", this.authController.resetPassword);
|
|
|
|
this.router.get("/users/superadmin", this.authController.checkSuperadminExists);
|
|
|
|
this.router.get("/users", verifyJWT, isAllowed(["admin", "superadmin"]), this.authController.getAllUsers);
|
|
this.router.post("/users", verifyJWT, isAllowed(["superadmin"]), upload.single("profileImage"), this.authController.createUser);
|
|
this.router.get("/users/:userId", verifyJWT, isAllowed(["admin", "superadmin"]), this.authController.getUserById);
|
|
this.router.patch("/users/:userId", verifyJWT, isAllowed(["superadmin"]), this.authController.editUserById);
|
|
this.router.patch("/users/:userId/password", verifyJWT, isAllowed(["superadmin"]), this.authController.editUserPasswordById);
|
|
this.router.delete("/users/:userId", verifyJWT, isAllowed(["admin", "superadmin"]), this.authController.deleteUserById);
|
|
|
|
this.router.patch("/user", verifyJWT, upload.single("profileImage"), this.authController.editUser);
|
|
this.router.delete("/user", verifyJWT, this.authController.deleteUser);
|
|
}
|
|
|
|
getRouter() {
|
|
return this.router;
|
|
}
|
|
}
|
|
|
|
export default AuthRoutes;
|