mirror of
https://gitlab.w-hs.de/an14051/backerup-website.git
synced 2026-07-27 17:35:29 +00:00
Anders Böttcher
0d58fafe4e
- Add user management API endpoints for listing and creating users. - Implement login and logout functionality with rate limiting. - Create UI components for login form, logout button, and animated elements. - Add session management with JWT and secure cookie handling. - Seed initial admin user if no users exist. - Introduce utility functions for password hashing and user authentication. - Set up proxy middleware for route protection and security headers. - Create a JSON file for user data storage. - Add links configuration for external resources.
56 lines
1.5 KiB
TypeScript
56 lines
1.5 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { deleteUser, updatePassword } from '@/lib/users'
|
|
import { getSession } from '@/lib/session'
|
|
|
|
export async function DELETE(
|
|
_request: Request,
|
|
{ params }: { params: Promise<{ id: string }> },
|
|
) {
|
|
const session = await getSession()
|
|
if (!session || session.role !== 'admin') {
|
|
return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
|
|
}
|
|
|
|
const { id } = await params
|
|
|
|
// Prevent admins from deleting themselves
|
|
if (id === session.userId) {
|
|
return NextResponse.json({ error: 'You cannot delete your own account' }, { status: 400 })
|
|
}
|
|
|
|
try {
|
|
await deleteUser(id)
|
|
return NextResponse.json({ ok: true })
|
|
} catch (e) {
|
|
return NextResponse.json({ error: (e as Error).message }, { status: 400 })
|
|
}
|
|
}
|
|
|
|
export async function PATCH(
|
|
request: Request,
|
|
{ params }: { params: Promise<{ id: string }> },
|
|
) {
|
|
const session = await getSession()
|
|
if (!session || session.role !== 'admin') {
|
|
return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
|
|
}
|
|
|
|
const { id } = await params
|
|
|
|
let body: { password?: string }
|
|
try {
|
|
body = (await request.json()) as { password?: string }
|
|
} catch {
|
|
return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })
|
|
}
|
|
|
|
const password = String(body.password ?? '')
|
|
|
|
try {
|
|
await updatePassword(id, password)
|
|
return NextResponse.json({ ok: true })
|
|
} catch (e) {
|
|
return NextResponse.json({ error: (e as Error).message }, { status: 400 })
|
|
}
|
|
}
|