d9806e84e6
- Remove unused imports (users, and) from api-tokens model - Fix password_hash destructure lint error in user routes - Fix apiErrorResponse mock pattern in all 12 test files (use instanceof) - Remove stale eslint-disable directives from test files - Add eslint override for tests (no-explicit-any, no-require-imports) - Fix unused vars in settings and tokens tests - Fix unused tokenB in integration test Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
52 lines
1.5 KiB
TypeScript
52 lines
1.5 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { requireApiUser, requireApiAdmin, apiErrorResponse, ApiAuthError } from "@/src/lib/api-auth";
|
|
import { getUserById, updateUserProfile } from "@/src/lib/models/user";
|
|
|
|
function stripPasswordHash(user: Record<string, unknown>) {
|
|
const { password_hash: _, ...rest } = user;
|
|
void _;
|
|
return rest;
|
|
}
|
|
|
|
export async function GET(
|
|
request: NextRequest,
|
|
{ params }: { params: Promise<{ id: string }> }
|
|
) {
|
|
try {
|
|
const auth = await requireApiUser(request);
|
|
const { id } = await params;
|
|
const targetId = Number(id);
|
|
|
|
// Non-admins can only view themselves
|
|
if (auth.role !== "admin" && auth.userId !== targetId) {
|
|
throw new ApiAuthError("Forbidden", 403);
|
|
}
|
|
|
|
const user = await getUserById(targetId);
|
|
if (!user) {
|
|
return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
}
|
|
return NextResponse.json(stripPasswordHash(user as unknown as Record<string, unknown>));
|
|
} catch (error) {
|
|
return apiErrorResponse(error);
|
|
}
|
|
}
|
|
|
|
export async function PUT(
|
|
request: NextRequest,
|
|
{ params }: { params: Promise<{ id: string }> }
|
|
) {
|
|
try {
|
|
await requireApiAdmin(request);
|
|
const { id } = await params;
|
|
const body = await request.json();
|
|
const user = await updateUserProfile(Number(id), body);
|
|
if (!user) {
|
|
return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
}
|
|
return NextResponse.json(stripPasswordHash(user as unknown as Record<string, unknown>));
|
|
} catch (error) {
|
|
return apiErrorResponse(error);
|
|
}
|
|
}
|