Spaces:
Running
Running
| ; | |
| var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) { | |
| if (k2 === undefined) k2 = k; | |
| var desc = Object.getOwnPropertyDescriptor(m, k); | |
| if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) { | |
| desc = { enumerable: true, get: function() { return m[k]; } }; | |
| } | |
| Object.defineProperty(o, k2, desc); | |
| }) : (function(o, m, k, k2) { | |
| if (k2 === undefined) k2 = k; | |
| o[k2] = m[k]; | |
| })); | |
| var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) { | |
| Object.defineProperty(o, "default", { enumerable: true, value: v }); | |
| }) : function(o, v) { | |
| o["default"] = v; | |
| }); | |
| var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) { | |
| var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d; | |
| if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc); | |
| else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r; | |
| return c > 3 && r && Object.defineProperty(target, key, r), r; | |
| }; | |
| var __importStar = (this && this.__importStar) || (function () { | |
| var ownKeys = function(o) { | |
| ownKeys = Object.getOwnPropertyNames || function (o) { | |
| var ar = []; | |
| for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k; | |
| return ar; | |
| }; | |
| return ownKeys(o); | |
| }; | |
| return function (mod) { | |
| if (mod && mod.__esModule) return mod; | |
| var result = {}; | |
| if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]); | |
| __setModuleDefault(result, mod); | |
| return result; | |
| }; | |
| })(); | |
| var __metadata = (this && this.__metadata) || function (k, v) { | |
| if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v); | |
| }; | |
| var AdminUsersService_1; | |
| Object.defineProperty(exports, "__esModule", { value: true }); | |
| exports.AdminUsersService = void 0; | |
| const common_1 = require("@nestjs/common"); | |
| const prisma_service_1 = require("../prisma/prisma.service"); | |
| const audit_service_1 = require("../audit/audit.service"); | |
| const crypto = __importStar(require("crypto")); | |
| const shared_types_1 = require("@micprotocol/shared-types"); | |
| const admin_permission_decorator_1 = require("../common/decorators/admin-permission.decorator"); | |
| let AdminUsersService = AdminUsersService_1 = class AdminUsersService { | |
| prisma; | |
| audit; | |
| logger = new common_1.Logger(AdminUsersService_1.name); | |
| constructor(prisma, audit) { | |
| this.prisma = prisma; | |
| this.audit = audit; | |
| } | |
| async listUsers(input = {}) { | |
| const limit = Math.min(Math.max(input.limit ?? 50, 1), 200); | |
| const where = { | |
| ...(input.search | |
| ? { | |
| OR: [ | |
| { email: { contains: input.search, mode: "insensitive" } }, | |
| { name: { contains: input.search, mode: "insensitive" } }, | |
| ], | |
| } | |
| : {}), | |
| ...(input.role ? { adminRole: input.role } : {}), | |
| ...(input.suspended !== undefined | |
| ? { suspendedAt: input.suspended ? { not: null } : { equals: null } } | |
| : {}), | |
| }; | |
| const [total, items] = await Promise.all([ | |
| this.prisma.user.count({ where }), | |
| this.prisma.user.findMany({ | |
| where, | |
| orderBy: { createdAt: "desc" }, | |
| take: limit + 1, | |
| ...(input.cursor ? { skip: 1, cursor: { id: input.cursor } } : {}), | |
| select: { | |
| id: true, | |
| name: true, | |
| email: true, | |
| isAdmin: true, | |
| adminRole: true, | |
| suspendedAt: true, | |
| suspendedReason: true, | |
| lastLoginAt: true, | |
| createdAt: true, | |
| _count: { select: { memberships: true } }, | |
| }, | |
| }), | |
| ]); | |
| const hasMore = items.length > limit; | |
| const page = hasMore ? items.slice(0, limit) : items; | |
| return { | |
| items: page.map((u) => ({ | |
| id: u.id, | |
| name: u.name, | |
| email: u.email, | |
| isAdmin: u.isAdmin, | |
| adminRole: u.adminRole ?? null, | |
| suspended: !!u.suspendedAt, | |
| suspendedAt: u.suspendedAt, | |
| lastLoginAt: u.lastLoginAt, | |
| createdAt: u.createdAt, | |
| workspaceCount: u._count.memberships, | |
| })), | |
| total, | |
| nextCursor: hasMore ? page[page.length - 1]?.id ?? null : null, | |
| }; | |
| } | |
| async getUser(userId) { | |
| const user = await this.prisma.user.findUnique({ | |
| where: { id: userId }, | |
| select: { | |
| id: true, | |
| name: true, | |
| email: true, | |
| emailVerified: true, | |
| isAdmin: true, | |
| adminRole: true, | |
| adminPermissions: true, | |
| suspendedAt: true, | |
| suspendedReason: true, | |
| suspendedBy: true, | |
| lastLoginAt: true, | |
| createdAt: true, | |
| updatedAt: true, | |
| _count: { select: { memberships: true } }, | |
| }, | |
| }); | |
| if (!user) | |
| throw new common_1.NotFoundException(`User ${userId} not found`); | |
| return user; | |
| } | |
| async suspendUser(userId, reason, actorUserId) { | |
| const user = await this.prisma.user.findUnique({ | |
| where: { id: userId }, | |
| select: { id: true, email: true, suspendedAt: true }, | |
| }); | |
| if (!user) | |
| throw new common_1.NotFoundException(`User ${userId} not found`); | |
| if (user.suspendedAt) | |
| throw new common_1.BadRequestException("User is already suspended"); | |
| const suspendedAt = new Date(); | |
| const updated = await this.prisma.user.update({ | |
| where: { id: userId }, | |
| data: { suspendedAt, suspendedReason: reason ?? null, suspendedBy: actorUserId }, | |
| }); | |
| await this.audit.log({ | |
| userId: actorUserId, | |
| action: "admin.users.suspend", | |
| entityType: "User", | |
| entityId: userId, | |
| metadata: { | |
| reason, | |
| before: { suspendedAt: null }, | |
| after: { suspendedAt, suspendedReason: reason }, | |
| }, | |
| }); | |
| return updated; | |
| } | |
| async reactivateUser(userId, actorUserId) { | |
| const user = await this.prisma.user.findUnique({ | |
| where: { id: userId }, | |
| select: { id: true, email: true, suspendedAt: true }, | |
| }); | |
| if (!user) | |
| throw new common_1.NotFoundException(`User ${userId} not found`); | |
| if (!user.suspendedAt) | |
| throw new common_1.BadRequestException("User is not suspended"); | |
| const updated = await this.prisma.user.update({ | |
| where: { id: userId }, | |
| data: { suspendedAt: null, suspendedReason: null, suspendedBy: null }, | |
| }); | |
| await this.audit.log({ | |
| userId: actorUserId, | |
| action: "admin.users.reactivate", | |
| entityType: "User", | |
| entityId: userId, | |
| metadata: { | |
| before: { suspendedAt: user.suspendedAt }, | |
| after: { suspendedAt: null }, | |
| }, | |
| }); | |
| return updated; | |
| } | |
| async revokeSessions(userId, actorUserId, exceptToken) { | |
| const user = await this.prisma.user.findUnique({ | |
| where: { id: userId }, | |
| select: { id: true }, | |
| }); | |
| if (!user) | |
| throw new common_1.NotFoundException(`User ${userId} not found`); | |
| await this.prisma.session.deleteMany({ | |
| where: { userId, ...(exceptToken ? { token: { not: exceptToken } } : {}) }, | |
| }); | |
| await this.audit.log({ | |
| userId: actorUserId, | |
| action: "admin.users.revoke_sessions", | |
| entityType: "User", | |
| entityId: userId, | |
| metadata: { exceptToken: !!exceptToken }, | |
| }); | |
| return { revoked: true }; | |
| } | |
| async impersonate(userId, actorUserId, reason, ttlMinutes = 60) { | |
| const target = await this.prisma.user.findUnique({ | |
| where: { id: userId }, | |
| select: { id: true, email: true, suspendedAt: true }, | |
| }); | |
| if (!target) | |
| throw new common_1.NotFoundException(`User ${userId} not found`); | |
| if (target.suspendedAt) | |
| throw new common_1.BadRequestException("Cannot impersonate a suspended user"); | |
| const token = crypto.randomBytes(24).toString("hex"); | |
| const expiresAt = new Date(Date.now() + ttlMinutes * 60_000); | |
| await this.audit.log({ | |
| userId: actorUserId, | |
| action: "admin.users.impersonate", | |
| entityType: "User", | |
| entityId: userId, | |
| metadata: { | |
| reason, | |
| expiresAt: expiresAt.toISOString(), | |
| impersonatedAs: userId, | |
| }, | |
| }); | |
| return { token, expiresAt, impersonateUserId: userId }; | |
| } | |
| async grantAdmin(userId, role, permissions, actorUserId) { | |
| const user = await this.prisma.user.findUnique({ | |
| where: { id: userId }, | |
| select: { id: true, email: true, adminRole: true }, | |
| }); | |
| if (!user) | |
| throw new common_1.NotFoundException(`User ${userId} not found`); | |
| const updated = await this.prisma.user.update({ | |
| where: { id: userId }, | |
| data: { | |
| adminRole: role, | |
| adminPermissions: permissions ?? {}, | |
| isAdmin: true, | |
| }, | |
| }); | |
| await this.audit.log({ | |
| userId: actorUserId, | |
| action: "admin.users.grant_admin", | |
| entityType: "User", | |
| entityId: userId, | |
| metadata: { | |
| before: { adminRole: user.adminRole }, | |
| after: { adminRole: role, permissions }, | |
| }, | |
| }); | |
| return updated; | |
| } | |
| async revokeAdmin(userId, actorUserId) { | |
| const user = await this.prisma.user.findUnique({ | |
| where: { id: userId }, | |
| select: { id: true, email: true, adminRole: true, isAdmin: true }, | |
| }); | |
| if (!user) | |
| throw new common_1.NotFoundException(`User ${userId} not found`); | |
| const updated = await this.prisma.user.update({ | |
| where: { id: userId }, | |
| data: { adminRole: null, adminPermissions: {}, isAdmin: false }, | |
| }); | |
| await this.audit.log({ | |
| userId: actorUserId, | |
| action: "admin.users.revoke_admin", | |
| entityType: "User", | |
| entityId: userId, | |
| metadata: { | |
| before: { adminRole: user.adminRole, isAdmin: user.isAdmin }, | |
| after: { adminRole: null, isAdmin: false }, | |
| }, | |
| }); | |
| return updated; | |
| } | |
| async deleteUser(userId, actorUserId, anonymize = true) { | |
| const user = await this.prisma.user.findUnique({ | |
| where: { id: userId }, | |
| select: { id: true, email: true, isAdmin: true }, | |
| }); | |
| if (!user) | |
| throw new common_1.NotFoundException(`User ${userId} not found`); | |
| if (user.isAdmin) | |
| throw new common_1.BadRequestException("Refusing to delete an admin user; revoke admin first"); | |
| if (anonymize) { | |
| await this.prisma.user.update({ | |
| where: { id: userId }, | |
| data: { | |
| email: `deleted_${userId}@example.invalid`, | |
| name: "Deleted User", | |
| image: null, | |
| passwordHash: null, | |
| isAdmin: false, | |
| adminRole: null, | |
| adminPermissions: {}, | |
| suspendedAt: null, | |
| isActive: false, | |
| }, | |
| }); | |
| } | |
| else { | |
| await this.prisma.user.delete({ where: { id: userId } }); | |
| } | |
| await this.audit.log({ | |
| userId: actorUserId, | |
| action: "admin.users.delete", | |
| entityType: "User", | |
| entityId: userId, | |
| metadata: { anonymize, email: user.email }, | |
| }); | |
| return { deleted: userId, anonymized: anonymize }; | |
| } | |
| async addUserNote(userId, body, actorUserId) { | |
| const user = await this.prisma.user.findUnique({ | |
| where: { id: userId }, | |
| select: { id: true }, | |
| }); | |
| if (!user) | |
| throw new common_1.NotFoundException(`User ${userId} not found`); | |
| const note = await this.prisma.adminNote.create({ | |
| data: { entityType: "User", entityId: userId, body, createdById: actorUserId }, | |
| }); | |
| await this.audit.log({ | |
| userId: actorUserId, | |
| action: "admin.users.notes", | |
| entityType: "User", | |
| entityId: userId, | |
| metadata: { noteId: note.id }, | |
| }); | |
| return note; | |
| } | |
| }; | |
| exports.AdminUsersService = AdminUsersService; | |
| __decorate([ | |
| (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_SUSPEND), | |
| __metadata("design:type", Function), | |
| __metadata("design:paramtypes", [String, Object, String]), | |
| __metadata("design:returntype", Promise) | |
| ], AdminUsersService.prototype, "suspendUser", null); | |
| __decorate([ | |
| (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_SUSPEND), | |
| __metadata("design:type", Function), | |
| __metadata("design:paramtypes", [String, String]), | |
| __metadata("design:returntype", Promise) | |
| ], AdminUsersService.prototype, "reactivateUser", null); | |
| __decorate([ | |
| (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_REVOKE_SESSIONS), | |
| __metadata("design:type", Function), | |
| __metadata("design:paramtypes", [String, String, String]), | |
| __metadata("design:returntype", Promise) | |
| ], AdminUsersService.prototype, "revokeSessions", null); | |
| __decorate([ | |
| (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_IMPERSONATE), | |
| __metadata("design:type", Function), | |
| __metadata("design:paramtypes", [String, String, String, Object]), | |
| __metadata("design:returntype", Promise) | |
| ], AdminUsersService.prototype, "impersonate", null); | |
| __decorate([ | |
| (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_GRANT_ADMIN), | |
| __metadata("design:type", Function), | |
| __metadata("design:paramtypes", [String, String, Object, String]), | |
| __metadata("design:returntype", Promise) | |
| ], AdminUsersService.prototype, "grantAdmin", null); | |
| __decorate([ | |
| (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_GRANT_ADMIN), | |
| __metadata("design:type", Function), | |
| __metadata("design:paramtypes", [String, String]), | |
| __metadata("design:returntype", Promise) | |
| ], AdminUsersService.prototype, "revokeAdmin", null); | |
| __decorate([ | |
| (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_DELETE), | |
| __metadata("design:type", Function), | |
| __metadata("design:paramtypes", [String, String, Object]), | |
| __metadata("design:returntype", Promise) | |
| ], AdminUsersService.prototype, "deleteUser", null); | |
| __decorate([ | |
| (0, admin_permission_decorator_1.requireAdminPermission)(shared_types_1.AdminPermission.USERS_NOTES), | |
| __metadata("design:type", Function), | |
| __metadata("design:paramtypes", [String, String, String]), | |
| __metadata("design:returntype", Promise) | |
| ], AdminUsersService.prototype, "addUserNote", null); | |
| exports.AdminUsersService = AdminUsersService = AdminUsersService_1 = __decorate([ | |
| (0, common_1.Injectable)(), | |
| __metadata("design:paramtypes", [prisma_service_1.PrismaService, | |
| audit_service_1.AuditService]) | |
| ], AdminUsersService); | |
| //# sourceMappingURL=admin-users.service.js.map |