Issue #5 and other related bug fixes and enhancements

[TrickkyRicky]

User Admin Page

Overview

Implemented user deletion functionality and enhanced security controls for admin user management

Changes Made

1. User Deletion Feature

• Created src/app/users/user-delete-dialog.tsx

  • Confirmation dialog using shadcn/ui Dialog component
  • Displays warnings about cascade deletes

• Enhanced src/app/users/users-grid.tsx

  • Added delete button column pinned to the right
  • Integrated deletion confirmation dialog
  • Refresh grid after successful deletion
  • Toast notifications for success/error states
  • Disabled delete button for current user

• Created src/app/users/api.ts

  • Extracted API calls into pure functions (fetchUsers, updateUser, deleteUser)
  • Separates API layer from UI logic

2. Security Enhancements

• Client-Side Protection

  • Role field is read-only for current user
  • Delete button disabled for current user
  • Uses user ID comparison instead of email for reliability

• Server-Side Protection (src/app/api/users/route.ts)

  • PATCH endpoint: Prevents users from changing their own role (403 error)
  • DELETE endpoint: Prevents users from deleting their own account (403 error)
  • Added proper validation and error messages

3. Authentication Updates

• Updated types/next-auth.d.ts

  • Added id field to Session user type
  • Enables ID-based comparisons for security checks

• Updated src/lib/auth.ts

  • Added session.user.id = user.id to session callback
  • Provides user ID to client for protection logic

4. Users API Test Cases

• Added Vitest to mock and run unit test cases
• Wrote test cases for the CRUD API users (with some AI help)

Files Changed

Created:

• src/app/users/user-delete-dialog.tsx
• src/app/users/api.ts
• src/app/api/users/route.test.ts

Modified:

• src/app/users/users-grid.tsx
• src/app/api/users/route.ts
• src/lib/auth.ts
• types/next-auth.d.ts

[iamsrijan724]

Looks good!

[mrysav]

Does this end up used anywhere? Not sure where eg documentId ends up being used again.

I see this was moved - disregard my comment!

[mrysav]

Looks good! I'll test it locally too before getting it to production.