Rollen Chunk 7: Benutzerverwaltung und Sicherung strikt Admin-only

src/app/api/users/[id]/route.ts

@@ -0,0 +1,83 @@
+import { NextResponse } from "next/server";
+import { guardRole, requireSessionUserId } from "@/lib/auth";
+import { errorResponse } from "@/lib/http";
+import { countAdmins, getUserRole, setUserRole, deleteUserAccount } from "@/lib/repository";
+import { getDb, initializeDatabase } from "@/lib/db";
+
+export async function PUT(
+  request: Request,
+  context: { params: Promise<{ id: string }> },
+) {
+  const denied = await guardRole(request, ["admin"]);
+  if (denied) {
+    return denied;
+  }
+  const { id } = await context.params;
+  let body: { role?: unknown };
+  try {
+    body = await request.json();
+  } catch {
+    return errorResponse(400, "invalidBody", "Request body must be JSON.");
+  }
+  if (body.role !== "benutzer" && body.role !== "teamleiter" && body.role !== "admin") {
+    return errorResponse(
+      400,
+      "invalidRole",
+      "role muss benutzer, teamleiter oder admin sein.",
+    );
+  }
+  const db = getDb();
+  initializeDatabase(db);
+  const selfId = await requireSessionUserId(request);
+  if (selfId === null) {
+    return errorResponse(401, "unauthorized", "Bitte zuerst anmelden.");
+  }
+  const previous = getUserRole(db, id);
+  if (previous === "admin" && body.role !== "admin" && countAdmins(db) <= 1) {
+    return errorResponse(
+      409,
+      "lastAdmin",
+      "Der letzte Admin kann nicht herabgestuft werden.",
+    );
+  }
+  if (!setUserRole(db, id, body.role)) {
+    return errorResponse(404, "notFound", "Kein Benutzer mit dieser ID.");
+  }
+  void selfId;
+  return NextResponse.json({ user: { id, role: body.role } });
+}
+
+export async function DELETE(
+  request: Request,
+  context: { params: Promise<{ id: string }> },
+) {
+  const denied = await guardRole(request, ["admin"]);
+  if (denied) {
+    return denied;
+  }
+  const { id } = await context.params;
+  const db = getDb();
+  initializeDatabase(db);
+  const selfId = await requireSessionUserId(request);
+  if (selfId === null) {
+    return errorResponse(401, "unauthorized", "Bitte zuerst anmelden.");
+  }
+  if (id === selfId) {
+    return errorResponse(
+      409,
+      "selfDelete",
+      "Das eigene Konto kann hier nicht gelöscht werden.",
+    );
+  }
+  if (getUserRole(db, id) === "admin" && countAdmins(db) <= 1) {
+    return errorResponse(
+      409,
+      "lastAdmin",
+      "Der letzte Admin kann nicht gelöscht werden.",
+    );
+  }
+  if (!deleteUserAccount(db, id)) {
+    return errorResponse(404, "notFound", "Kein Benutzer mit dieser ID.");
+  }
+  return NextResponse.json({ deleted: true });
+}