feat(admin): add user role management with promotion feature

2026-07-30 23:13:38 +02:00
parent 370ba3406f
commit aa4632cab8
7 changed files with 348 additions and 2 deletions
@@ -0,0 +1,53 @@
+import { useValidatedBody, useValidatedParams, z, zh } from 'h3-zod';
+import prisma from '~~/lib/prisma';
+
+export default defineEventHandler(async (event) => {
+  const user = await requireUserSession(event);
+
+  if (user.user.role !== 'ADMIN') {
+    throw createError({
+      status: 403,
+      statusText: 'Not allowed!'
+    });
+  }
+
+  const { userId } = await useValidatedParams(
+    event,
+    z.object({
+      userId: zh.numAsString
+    })
+  );
+
+  const { role } = await useValidatedBody(
+    event,
+    z.object({
+      role: z.enum(['USER', 'CREATOR', 'ADMIN'])
+    })
+  );
+
+  if (userId === user.user.id) {
+    throw createError({
+      status: 400,
+      statusText: 'You cannot change your own role!'
+    });
+  }
+
+  const updated = await prisma.user.update({
+    where: {
+      id: userId,
+      deactivated: false,
+      deletedAt: null
+    },
+    data: {
+      role
+    },
+    select: {
+      id: true,
+      name: true,
+      email: true,
+      role: true
+    }
+  });
+
+  return { success: true, user: updated };
+});
@@ -0,0 +1,31 @@
+import prisma from '~~/lib/prisma';
+
+export default defineEventHandler(async (event) => {
+  const user = await requireUserSession(event);
+
+  if (user.user.role !== 'ADMIN') {
+    throw createError({
+      status: 403,
+      statusText: 'Not allowed!'
+    });
+  }
+
+  return prisma.user.findMany({
+    where: {
+      role: {
+        in: ['ADMIN', 'CREATOR']
+      },
+      deactivated: false,
+      deletedAt: null
+    },
+    select: {
+      id: true,
+      name: true,
+      email: true,
+      role: true
+    },
+    orderBy: {
+      createdAt: 'asc'
+    }
+  });
+});
@@ -0,0 +1,41 @@
+import { useValidatedQuery, z } from 'h3-zod';
+import prisma from '~~/lib/prisma';
+
+export default defineEventHandler(async (event) => {
+  const user = await requireUserSession(event);
+
+  if (user.user.role !== 'ADMIN') {
+    throw createError({
+      status: 403,
+      statusText: 'Not allowed!'
+    });
+  }
+
+  const { email } = await useValidatedQuery(
+    event,
+    z.object({
+      email: z.string().trim().default('')
+    })
+  );
+
+  return prisma.user.findMany({
+    where: {
+      role: 'USER',
+      deactivated: false,
+      deletedAt: null,
+      email: {
+        contains: email
+      }
+    },
+    select: {
+      id: true,
+      name: true,
+      email: true,
+      role: true
+    },
+    take: 10,
+    orderBy: {
+      createdAt: 'desc'
+    }
+  });
+});