feat(users): gestione utenti /admin/users con guardie self/ultimo-admin

src/pages/api/admin/users/[id]/index.ts

@@ -0,0 +1,19 @@
+import type { APIRoute } from 'astro';
+import { getDb } from '../../../../../lib/db';
+import { getUserById, deleteUser, countAdmins } from '../../../../../lib/auth';
+export const prerender = false;
+
+const json = (status: number, body: object) =>
+  new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+
+export const DELETE: APIRoute = ({ params, locals }) => {
+  const id = Number(params.id);
+  const target = getUserById(getDb(), id);
+  if (!target) return json(404, { error: 'Utente inesistente.' });
+  if (id === locals.user!.id) return json(400, { error: 'Non puoi eliminare te stesso.' });
+  if (target.role === 'admin' && countAdmins(getDb()) <= 1) {
+    return json(400, { error: 'Deve restare almeno un admin.' });
+  }
+  deleteUser(getDb(), id);
+  return json(200, { ok: true });
+};

src/pages/api/admin/users/[id]/reset-password.ts

@@ -0,0 +1,16 @@
+import type { APIRoute } from 'astro';
+import { getDb } from '../../../../../lib/db';
+import { getUserById, updateUserPassword, hashPassword, randomPassword } from '../../../../../lib/auth';
+export const prerender = false;
+
+const json = (status: number, body: object) =>
+  new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+
+export const POST: APIRoute = ({ params }) => {
+  const id = Number(params.id);
+  if (!getUserById(getDb(), id)) return json(404, { error: 'Utente inesistente.' });
+  const password = randomPassword();
+  updateUserPassword(getDb(), id, hashPassword(password));
+  // La password in chiaro è restituita UNA sola volta: l'admin la copia e la consegna.
+  return json(200, { password });
+};

src/pages/api/admin/users/[id]/role.ts

@@ -0,0 +1,21 @@
+import type { APIRoute } from 'astro';
+import { getDb } from '../../../../../lib/db';
+import { getUserById, updateUserRole, countAdmins, isRole } from '../../../../../lib/auth';
+export const prerender = false;
+
+const json = (status: number, body: object) =>
+  new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+
+export const PUT: APIRoute = async ({ params, request }) => {
+  const id = Number(params.id);
+  const target = getUserById(getDb(), id);
+  if (!target) return json(404, { error: 'Utente inesistente.' });
+  let data: { role?: unknown };
+  try { data = await request.json(); } catch { return json(400, { error: 'Dati non validi.' }); }
+  if (!isRole(data.role)) return json(400, { error: 'Ruolo non valido.' });
+  if (target.role === 'admin' && data.role !== 'admin' && countAdmins(getDb()) <= 1) {
+    return json(400, { error: 'Deve restare almeno un admin.' });
+  }
+  updateUserRole(getDb(), id, data.role);
+  return json(200, { ok: true });
+};

src/pages/api/admin/users/index.ts

@@ -0,0 +1,26 @@
+import type { APIRoute } from 'astro';
+import { getDb } from '../../../../lib/db';
+import { createUser, listUsers, isRole } from '../../../../lib/auth';
+export const prerender = false;
+
+const json = (status: number, body: object) =>
+  new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+
+export const GET: APIRoute = () => json(200, { users: listUsers(getDb()) });
+
+export const POST: APIRoute = async ({ request }) => {
+  let data: { username?: unknown; password?: unknown; role?: unknown };
+  try { data = await request.json(); } catch { return json(400, { error: 'Dati non validi.' }); }
+  const username = String(data.username ?? '').trim();
+  const password = String(data.password ?? '');
+  if (username.length < 2) return json(400, { error: 'Nome utente troppo corto.' });
+  if (password.length < 8) return json(400, { error: 'Password troppo corta (min 8).' });
+  if (!isRole(data.role)) return json(400, { error: 'Ruolo non valido.' });
+  try {
+    const id = createUser(getDb(), username, password, data.role);
+    return json(201, { id });
+  } catch (err: any) {
+    if (String(err?.message).includes('UNIQUE')) return json(400, { error: 'Nome utente già esistente.' });
+    throw err;
+  }
+};