Initial commit: Kinship Directory application

src/app/api/admin/users/[id]/route.ts

@@ -0,0 +1,20 @@
+import { NextResponse } from "next/server";
+import { getSession } from "@/lib/auth";
+import { db, objectId } from "@/lib/db";
+import { isSameOrigin } from "@/lib/validation";
+
+export async function PUT(request: Request, context: { params: Promise<{ id: string }> }) {
+  if (!isSameOrigin(request)) return NextResponse.json({ error: "Invalid request origin." }, { status: 403 });
+  const session = await getSession();
+  if (!session || session.role !== "admin") return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  const { id } = await context.params;
+  if (id === session.id) return NextResponse.json({ error: "You cannot change your own administrator role." }, { status: 400 });
+  const userId = objectId(id); const organizationId = objectId(session.organizationId);
+  if (!userId || !organizationId) return NextResponse.json({ error: "Invalid user." }, { status: 400 });
+  const body = await request.json();
+  const role = body.role === "admin" ? "admin" : body.role === "member" ? "member" : null;
+  if (!role) return NextResponse.json({ error: "Invalid role." }, { status: 400 });
+  const result = await (await db()).collection("users").updateOne({ _id: userId, organizationId }, { $set: { role, updatedAt: new Date() } });
+  if (!result.matchedCount) return NextResponse.json({ error: "User not found." }, { status: 404 });
+  return NextResponse.json({ ok: true, role });
+}