feat(admin): Server Action'larla kullanıcı yönetimi ve gerçek oturumlu sayfalar
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,250 @@
|
||||
"use server";
|
||||
|
||||
import { revalidatePath } from "next/cache";
|
||||
import { headers } from "next/headers";
|
||||
import { z } from "zod";
|
||||
import { tr } from "@/i18n/tr";
|
||||
import { fail, ok, type ActionResult } from "@/lib/action-result";
|
||||
import { getAuth } from "@/lib/auth";
|
||||
import { authErrorCode } from "@/lib/auth-errors";
|
||||
import { getActionUser } from "@/lib/dal";
|
||||
import { storedEmail } from "@/shared/account-email";
|
||||
import { systemRoleSchema, type SystemRole } from "@/shared/schemas/common";
|
||||
import {
|
||||
banUserSchema,
|
||||
setPasswordSchema,
|
||||
userCreateSchema,
|
||||
userUpdateSchema,
|
||||
} from "@/shared/schemas/user";
|
||||
import { checkAdminAction, type AdminAction, type GuardViolation } from "./guards";
|
||||
|
||||
/**
|
||||
* Admin kullanıcı yönetimi Server Action'ları.
|
||||
* Sıra: yetki (sunucuda) → zod doğrulama → iş kuralları (guards) → Better Auth admin API → revalidate.
|
||||
*/
|
||||
|
||||
const t = tr.adminUsers;
|
||||
const PATH = "/admin/kullanicilar";
|
||||
const userIdSchema = z.string().min(1).max(64);
|
||||
|
||||
const guardMessage = (v: GuardViolation) => (v === "self" ? t.guards.self : t.guards.lastAdmin);
|
||||
|
||||
/** Bilinen Better Auth hata kodlarını kullanıcıya gösterilecek alan hatalarına çevirir. */
|
||||
function mapAuthError(error: unknown): ActionResult<never> {
|
||||
const code = authErrorCode(error);
|
||||
switch (code) {
|
||||
case "USERNAME_IS_ALREADY_TAKEN":
|
||||
return fail(t.errors.checkFields, { username: t.errors.usernameTaken });
|
||||
case "USER_ALREADY_EXISTS":
|
||||
case "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL":
|
||||
return fail(t.errors.checkFields, { email: t.errors.emailTaken });
|
||||
case "INVALID_USERNAME":
|
||||
case "USERNAME_TOO_SHORT":
|
||||
case "USERNAME_TOO_LONG":
|
||||
return fail(t.errors.checkFields, { username: tr.validation.usernameFormat });
|
||||
case "INVALID_EMAIL":
|
||||
return fail(t.errors.checkFields, { email: tr.validation.email });
|
||||
case "PASSWORD_TOO_SHORT":
|
||||
case "PASSWORD_TOO_LONG":
|
||||
return fail(t.errors.checkFields, { password: tr.validation.passwordMin });
|
||||
case "YOU_CANNOT_BAN_YOURSELF":
|
||||
case "YOU_CANNOT_REMOVE_YOURSELF":
|
||||
return fail(t.guards.self);
|
||||
default:
|
||||
// İç detay kullanıcıya sızdırılmaz; sunucuda loglanır.
|
||||
console.error("[admin-users] beklenmeyen hata", code ?? error);
|
||||
return fail(tr.common.genericError);
|
||||
}
|
||||
}
|
||||
|
||||
/** Fiziksel kontrol: oturumdaki kullanıcı admin mi? Değilse işlem yapılmaz. */
|
||||
async function adminContext() {
|
||||
const actor = await getActionUser("admin");
|
||||
if (!actor) return null;
|
||||
return { actor, headers: await headers(), api: getAuth().api };
|
||||
}
|
||||
|
||||
type Ctx = NonNullable<Awaited<ReturnType<typeof adminContext>>>;
|
||||
|
||||
async function loadTarget(ctx: Ctx, userId: string) {
|
||||
try {
|
||||
const user = await ctx.api.getUser({ headers: ctx.headers, query: { id: userId } });
|
||||
return user
|
||||
? {
|
||||
id: user.id,
|
||||
role: (user.role === "admin" ? "admin" : "user") as SystemRole,
|
||||
name: user.name,
|
||||
}
|
||||
: null;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
async function countAdmins(ctx: Ctx): Promise<number> {
|
||||
const result = await ctx.api.listUsers({
|
||||
headers: ctx.headers,
|
||||
query: { filterField: "role", filterOperator: "eq", filterValue: "admin", limit: 1 },
|
||||
});
|
||||
return result.total;
|
||||
}
|
||||
|
||||
async function guard(ctx: Ctx, action: AdminAction, target: { id: string; role: SystemRole }) {
|
||||
const adminCount = target.role === "admin" ? await countAdmins(ctx) : Number.POSITIVE_INFINITY;
|
||||
return checkAdminAction(action, { actorId: ctx.actor.id, target, adminCount });
|
||||
}
|
||||
|
||||
// --- Action'lar ---
|
||||
|
||||
export async function createUserAction(input: unknown): Promise<ActionResult> {
|
||||
const ctx = await adminContext();
|
||||
if (!ctx) return fail(tr.common.unauthorized);
|
||||
const parsed = userCreateSchema.safeParse(input);
|
||||
if (!parsed.success) return fail(t.errors.checkFields);
|
||||
const v = parsed.data;
|
||||
try {
|
||||
await ctx.api.createUser({
|
||||
headers: ctx.headers,
|
||||
body: {
|
||||
name: v.name,
|
||||
email: storedEmail(v.username, v.email),
|
||||
password: v.password,
|
||||
role: v.role,
|
||||
data: { username: v.username },
|
||||
},
|
||||
});
|
||||
} catch (error) {
|
||||
return mapAuthError(error);
|
||||
}
|
||||
revalidatePath(PATH);
|
||||
return ok(undefined);
|
||||
}
|
||||
|
||||
export async function updateUserAction(userId: unknown, input: unknown): Promise<ActionResult> {
|
||||
const ctx = await adminContext();
|
||||
if (!ctx) return fail(tr.common.unauthorized);
|
||||
const id = userIdSchema.safeParse(userId);
|
||||
const parsed = userUpdateSchema.safeParse(input);
|
||||
if (!id.success || !parsed.success) return fail(t.errors.checkFields);
|
||||
const target = await loadTarget(ctx, id.data);
|
||||
if (!target) return fail(tr.common.notFound);
|
||||
const v = parsed.data;
|
||||
|
||||
if (v.role !== target.role) {
|
||||
const violation = await guard(ctx, { type: "setRole", role: v.role }, target);
|
||||
if (violation) return fail(guardMessage(violation), { role: guardMessage(violation) });
|
||||
}
|
||||
try {
|
||||
await ctx.api.adminUpdateUser({
|
||||
headers: ctx.headers,
|
||||
body: {
|
||||
userId: target.id,
|
||||
data: { name: v.name, username: v.username, email: storedEmail(v.username, v.email) },
|
||||
},
|
||||
});
|
||||
if (v.role !== target.role) {
|
||||
await ctx.api.setRole({ headers: ctx.headers, body: { userId: target.id, role: v.role } });
|
||||
}
|
||||
} catch (error) {
|
||||
return mapAuthError(error);
|
||||
}
|
||||
revalidatePath(PATH);
|
||||
return ok(undefined);
|
||||
}
|
||||
|
||||
export async function setRoleAction(userId: unknown, role: unknown): Promise<ActionResult> {
|
||||
const ctx = await adminContext();
|
||||
if (!ctx) return fail(tr.common.unauthorized);
|
||||
const id = userIdSchema.safeParse(userId);
|
||||
const r = systemRoleSchema.safeParse(role);
|
||||
if (!id.success || !r.success) return fail(tr.common.genericError);
|
||||
const target = await loadTarget(ctx, id.data);
|
||||
if (!target) return fail(tr.common.notFound);
|
||||
const violation = await guard(ctx, { type: "setRole", role: r.data }, target);
|
||||
if (violation) return fail(guardMessage(violation));
|
||||
try {
|
||||
await ctx.api.setRole({ headers: ctx.headers, body: { userId: target.id, role: r.data } });
|
||||
} catch (error) {
|
||||
return mapAuthError(error);
|
||||
}
|
||||
revalidatePath(PATH);
|
||||
return ok(undefined);
|
||||
}
|
||||
|
||||
export async function setPasswordAction(userId: unknown, input: unknown): Promise<ActionResult> {
|
||||
const ctx = await adminContext();
|
||||
if (!ctx) return fail(tr.common.unauthorized);
|
||||
const id = userIdSchema.safeParse(userId);
|
||||
const parsed = setPasswordSchema.safeParse(input);
|
||||
if (!id.success || !parsed.success) return fail(t.errors.checkFields);
|
||||
const target = await loadTarget(ctx, id.data);
|
||||
if (!target) return fail(tr.common.notFound);
|
||||
try {
|
||||
await ctx.api.setUserPassword({
|
||||
headers: ctx.headers,
|
||||
body: { userId: target.id, newPassword: parsed.data.password },
|
||||
});
|
||||
// Başka bir kullanıcının şifresi sıfırlandıysa açık oturumlarını kapat.
|
||||
if (target.id !== ctx.actor.id) {
|
||||
await ctx.api.revokeUserSessions({ headers: ctx.headers, body: { userId: target.id } });
|
||||
}
|
||||
} catch (error) {
|
||||
return mapAuthError(error);
|
||||
}
|
||||
return ok(undefined);
|
||||
}
|
||||
|
||||
export async function banUserAction(userId: unknown, input: unknown): Promise<ActionResult> {
|
||||
const ctx = await adminContext();
|
||||
if (!ctx) return fail(tr.common.unauthorized);
|
||||
const id = userIdSchema.safeParse(userId);
|
||||
const parsed = banUserSchema.safeParse(input);
|
||||
if (!id.success || !parsed.success) return fail(t.errors.checkFields);
|
||||
const target = await loadTarget(ctx, id.data);
|
||||
if (!target) return fail(tr.common.notFound);
|
||||
const violation = await guard(ctx, { type: "ban" }, target);
|
||||
if (violation) return fail(guardMessage(violation));
|
||||
try {
|
||||
// banUser açık oturumları da sonlandırır.
|
||||
await ctx.api.banUser({
|
||||
headers: ctx.headers,
|
||||
body: { userId: target.id, banReason: parsed.data.reason },
|
||||
});
|
||||
} catch (error) {
|
||||
return mapAuthError(error);
|
||||
}
|
||||
revalidatePath(PATH);
|
||||
return ok(undefined);
|
||||
}
|
||||
|
||||
export async function unbanUserAction(userId: unknown): Promise<ActionResult> {
|
||||
const ctx = await adminContext();
|
||||
if (!ctx) return fail(tr.common.unauthorized);
|
||||
const id = userIdSchema.safeParse(userId);
|
||||
if (!id.success) return fail(tr.common.genericError);
|
||||
try {
|
||||
await ctx.api.unbanUser({ headers: ctx.headers, body: { userId: id.data } });
|
||||
} catch (error) {
|
||||
return mapAuthError(error);
|
||||
}
|
||||
revalidatePath(PATH);
|
||||
return ok(undefined);
|
||||
}
|
||||
|
||||
export async function removeUserAction(userId: unknown): Promise<ActionResult> {
|
||||
const ctx = await adminContext();
|
||||
if (!ctx) return fail(tr.common.unauthorized);
|
||||
const id = userIdSchema.safeParse(userId);
|
||||
if (!id.success) return fail(tr.common.genericError);
|
||||
const target = await loadTarget(ctx, id.data);
|
||||
if (!target) return fail(tr.common.notFound);
|
||||
const violation = await guard(ctx, { type: "delete" }, target);
|
||||
if (violation) return fail(guardMessage(violation));
|
||||
try {
|
||||
await ctx.api.removeUser({ headers: ctx.headers, body: { userId: target.id } });
|
||||
} catch (error) {
|
||||
return mapAuthError(error);
|
||||
}
|
||||
revalidatePath(PATH);
|
||||
return ok(undefined);
|
||||
}
|
||||
Reference in New Issue
Block a user