feat: added button to promote user to admin if curuser is a superuser

Author: Plebbaroni

backend/server/src/handler/organisation.rs

@@ -13,7 +13,7 @@ use crate::models::auth::{AuthUser, OrganisationAdmin};
 use crate::models::campaign::{Campaign, NewCampaign};
 use crate::models::email_template::{EmailTemplate, NewEmailTemplate};
 use crate::models::error::ChaosError;
-use crate::models::organisation::{MemberToRemove, AdminUpdateList, NewOrganisation, Organisation, SlugCheck, MemberToInvite};
+use crate::models::organisation::{MemberToRemove, MemberRoleUpdate, AdminUpdateList, NewOrganisation, Organisation, SlugCheck, MemberToInvite};
 use crate::models::transaction::DBTransaction;
 use crate::service::auth::assert_is_super_user;
 use axum::extract::{Json, Path, State};
@@ -304,6 +304,19 @@ impl OrganisationHandler {
         Ok(AppMessage::OkMessage("Successfully updated organisation members"))
     }
 
+    /// Updates a single member's role (promote to Admin or demote to User). Superusers only.
+    pub async fn update_member(
+        mut transaction: DBTransaction<'_>,
+        Path(id): Path<i64>,
+        _super_user: SuperUser,
+        Json(request_body): Json<MemberRoleUpdate>,
+    ) -> Result<impl IntoResponse, ChaosError> {
+        Organisation::update_member_role(id, request_body.user_id, request_body.role, &mut transaction.tx).await?;
+
+        transaction.tx.commit().await?;
+        Ok(AppMessage::OkMessage("Successfully updated member role"))
+    }
+
     /// Removes an admin from an organisation.
     /// 
     /// This handler allows super users to remove admins.

backend/server/src/handler/user.rs

@@ -175,35 +175,4 @@ impl UserHandler {
         let is_superuser = matches!(user.role, UserRole::SuperUser);
         Ok((StatusCode::OK, Json(serde_json::json!({ "is_superuser": is_superuser }))))
     }
-
-    /// Updates a user's role.
-    ///
-    /// This endpoint is restricted to super users via the `SuperUser` extractor.
-    /// It allows promoting or demoting users between `User` and `SuperUser`.
-    ///
-    /// # Arguments
-    ///
-    /// * `user` - The authenticated caller, must be a super user
-    /// * `request_body.email` - Email of the user whose role is being changed
-    /// * `request_body` - The new role for the user
-    ///
-    /// # Returns
-    ///
-    /// * `Result<impl IntoResponse, ChaosError>` - Success message or error
-    pub async fn update_role(
-        mut transaction: DBTransaction<'_>,
-        _super_user: SuperUser,
-        Json(request_body): Json<UserRoleUpdate>,
-    ) -> Result<impl IntoResponse, ChaosError> {
-        // Look up the target user by email, then update their role.
-        let maybe_user =
-            User::find_by_email(request_body.email.to_lowercase(), &mut transaction.tx).await?;
-
-        let target_user = maybe_user.ok_or(ChaosError::BadRequest)?;
-
-        User::update_role(request_body.email, request_body.role, &mut transaction.tx).await?;
-
-        transaction.tx.commit().await?;
-        Ok(AppMessage::OkMessage("Updated user role"))
-    }
 }

backend/server/src/models/app.rs

@@ -13,7 +13,7 @@ use crate::handler::user::UserHandler;
 use crate::models::email::{ChaosEmail, EmailCredentials};
 use crate::models::error::ChaosError;
 use crate::models::storage::Storage;
-use axum::routing::{delete, get, patch, post};
+use axum::routing::{delete, get, patch, post, put};
 use axum::{Json, Router};
 use jsonwebtoken::{Algorithm, DecodingKey, EncodingKey, Header, Validation};
 use reqwest::Client as ReqwestClient;
@@ -205,7 +205,7 @@ pub async fn app() -> Result<(Router, AppState), ChaosError> {
         .route("/api/v1/dev/super_admin_login", get(DevLoginHandler::dev_super_admin_login))
         .route("/api/v1/dev/org_admin_login", get(DevLoginHandler::dev_org_admin_login))
         .route("/api/v1/dev/user_login", get(DevLoginHandler::dev_user_login))
-        .route("/api/v1/user", get(UserHandler::get)),
+        .route("/api/v1/user", get(UserHandler::get))
         .route("/api/v1/user/is_superuser", get(UserHandler::is_superuser))
         .route("/api/v1/user/name", patch(UserHandler::update_name))
         .route("/api/v1/user/pronouns", patch(UserHandler::update_pronouns))
@@ -264,6 +264,10 @@ pub async fn app() -> Result<(Router, AppState), ChaosError> {
             "/api/v1/organisation/:organisation_id/user",
             post(OrganisationHandler::invite_user).delete(OrganisationHandler::remove_user),
         )
+        .route(
+            "/api/v1/organisation/:organisation_id/member",
+            put(OrganisationHandler::update_member),
+        )
         .route(
             "/api/v1/organisation/:organisation_id/admins",
             get(OrganisationHandler::get_admins)
@@ -277,6 +281,10 @@ pub async fn app() -> Result<(Router, AppState), ChaosError> {
             "/api/v1/organisation/:organisation_id/users",
             get(OrganisationHandler::get_users)
         )
+        .route(
+            "/api/v1/organisation/:organisation_id/users",
+            put(OrganisationHandler::get_users)
+        )
         // Campaign Rating Categories
         .route(
             "/api/v1/campaign/:campaign_id/rating_category",

backend/server/src/models/organisation.rs

@@ -142,6 +142,14 @@ pub struct MemberToRemove {
     pub user_id: i64,
 }
 
+/// Data structure for updating a single member's role (promote or demote).
+#[derive(Deserialize)]
+pub struct MemberRoleUpdate {
+    #[serde(deserialize_with = "crate::models::serde_string::deserialize")]
+    pub user_id: i64,
+    pub role: OrganisationRole,
+}
+
 #[derive(Deserialize)]
 pub struct MemberToInvite {
     pub email: String,
@@ -625,6 +633,16 @@ impl Organisation {
         organisation_id: i64,
         admin_to_remove: i64,
         transaction: &mut Transaction<'_, Postgres>,
+    ) -> Result<(), ChaosError> {
+        Self::update_member_role(organisation_id, admin_to_remove, OrganisationRole::User, transaction).await
+    }
+
+    /// Updates a single member's role (promote to Admin or demote to User). The user must already be in the organisation.
+    pub async fn update_member_role(
+        organisation_id: i64,
+        user_id: i64,
+        role: OrganisationRole,
+        transaction: &mut Transaction<'_, Postgres>,
     ) -> Result<(), ChaosError> {
         let _ = sqlx::query!(
             "SELECT id FROM organisations WHERE id = $1",
@@ -637,9 +655,9 @@ impl Organisation {
             "
             UPDATE organisation_members SET role = $3 WHERE user_id = $1 AND organisation_id = $2
         ",
-            admin_to_remove,
+            user_id,
             organisation_id,
-            OrganisationRole::User as OrganisationRole
+            role as OrganisationRole
         )
         .execute(transaction.deref_mut())
         .await?;

backend/server/src/models/user.rs

@@ -304,31 +304,6 @@ impl User {
         Ok(())
     }
 
-    /// Updates a user's role.
-    ///
-    /// This is intended for administrative use only, and should be called from
-    /// handlers that have already verified the caller is a super user.
-    pub async fn update_role(
-        email: String,
-        role: UserRole,
-        transaction: &mut Transaction<'_, Postgres>,
-    ) -> Result<(), ChaosError> {
-        let _ = sqlx::query!(
-            r#"
-            UPDATE users
-            SET role = $1::user_role
-            WHERE email = $2
-            RETURNING email
-        "#,
-            role as UserRole,
-            email
-        )
-        .fetch_one(transaction.deref_mut())
-        .await?;
-
-        Ok(())
-    }
-
 
     /// Creates a User, This should only used for database seeding
     pub async fn create_user(

frontend-nextjs/src/app/[lang]/dashboard/organisation/[orgId]/members/columns.tsx

@@ -21,8 +21,41 @@ import { Button } from "@/components/ui/button";
 import { useState } from "react";
 import { AddMemberDialog } from "./members";
 
-export function getColumns(handleDeleteMember: (memberId: string) => Promise<void>, dict: any): ColumnDef<Member>[] {
-    return [
+function UpdateRoleButton({
+  member,
+  onUpdate,
+}: {
+  member: Member;
+  onUpdate: (memberId: string, newRole: "Admin" | "User") => Promise<void>;
+}) {
+  const [loading, setLoading] = useState(false);
+  const isAdmin = member.role === "Admin";
+
+  const handleClick = async () => {
+    setLoading(true);
+    await onUpdate(member.id, isAdmin ? "User" : "Admin");
+    setLoading(false);
+  };
+
+  return (
+    <Button
+      variant="outline"
+      size="sm"
+      disabled={loading}
+      onClick={handleClick}
+    >
+      {loading ? "..." : isAdmin ? "Remove admin" : "Make admin"}
+    </Button>
+  );
+}
+
+export function getColumns(
+    handleDeleteMember: (memberId: string) => Promise<void>,
+    handleUpdateMemberRole: (memberId: string, newRole: "Admin" | "User") => Promise<void>,
+    dict: any,
+    isSuperuser = false
+): ColumnDef<Member>[] {
+    const columns: ColumnDef<Member>[] = [
         {
             header: dict.common.name,
             accessorKey: "name",
@@ -35,7 +68,19 @@ export function getColumns(handleDeleteMember: (memberId: string) => Promise<voi
             header: dict.dashboard.members.role,
             accessorKey: "role",
         },
-        {
+    ];
+
+    if (isSuperuser) {
+        columns.push({
+            header: "Update",
+            id: "update",
+            cell: ({ row }: { row: Row<Member> }) => (
+                <UpdateRoleButton member={row.original} onUpdate={handleUpdateMemberRole} />
+            ),
+        });
+    }
+
+    columns.push({
             id: "actions",
             cell: ({ row }: { row: Row<Member> }) => {
                 const member = row.original;
@@ -81,6 +126,8 @@ export function getColumns(handleDeleteMember: (memberId: string) => Promise<voi
                     </div>
                 )
             },
-        },
-    ];
+        }
+    );
+
+    return columns;
 }

frontend-nextjs/src/app/[lang]/dashboard/organisation/[orgId]/members/members.tsx

@@ -15,16 +15,22 @@ import {
   DialogTrigger,
 } from "@/components/ui/dialog"
 import { getColumns } from "./columns";
-import { deleteOrganisationUser, getAllOrganisationMembers, inviteOrganisationUser } from "@/models/organisation";
+import { deleteOrganisationUser, getAllOrganisationMembers, inviteOrganisationUser, updateOrganisationMemberRole } from "@/models/organisation";
 import { DataTable } from "@/components/ui/data-table";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
+import { getIsSuperuser } from "@/models/user";
 import { useState } from "react";
 import { ApiError } from "@/lib/api";
 
 export default function OrganisationMembers({ orgId, dict }: { orgId: string, dict: any }) {
   const queryClient = useQueryClient();
 
+  const { data: isSuperuserData } = useQuery({
+    queryKey: ["is_superuser"],
+    queryFn: () => getIsSuperuser(),
+  });
+
   let { data: members } = useQuery({
     queryKey: [`${orgId}-members`],
     queryFn: () => getAllOrganisationMembers(orgId),
@@ -37,7 +43,13 @@ export default function OrganisationMembers({ orgId, dict }: { orgId: string, di
     await queryClient.invalidateQueries({ queryKey: [`${orgId}-members`] });
   }
 
-  const userColumns = getColumns(handleDeleteMember, dict);
+  const handleUpdateMemberRole = async (memberId: string, newRole: "Admin" | "User") => {
+    await updateOrganisationMemberRole(orgId, memberId, newRole);
+    await queryClient.invalidateQueries({ queryKey: [`${orgId}-members`] });
+  }
+
+  const isSuperuser = isSuperuserData?.is_superuser ?? false;
+  const userColumns = getColumns(handleDeleteMember, handleUpdateMemberRole, dict, isSuperuser);
 
   return (
     <div className="flex flex-col gap-3">

frontend-nextjs/src/app/[lang]/dashboard/organisation/[orgId]/members/page.tsx

@@ -12,7 +12,7 @@ export default async function OrganisationMembersPage({ params }: { params: Prom
 
   await queryClient.prefetchQuery({
     queryKey: ["is_superuser"],
-    queryFn: getIsSuperuser,
+    queryFn: () => getIsSuperuser(),
   });
 
   await queryClient.prefetchQuery({

frontend-nextjs/src/models/organisation.ts

@@ -56,6 +56,24 @@ export async function getOrganisationAdmins(orgId: string): Promise<Member[]> {
     return await apiRequest<Member[]>(`/api/v1/organisation/${orgId}/admins`);
 }
 
+export async function updateOrganisationAdmins(orgId: string, memberIds: string[]): Promise<AppMessage> {
+    return await apiRequest<AppMessage>(`/api/v1/organisation/${orgId}/admins`, {
+        method: "PUT",
+        body: { members: memberIds.map((id) => Number(id)) },
+    });
+}
+
+export async function updateOrganisationMemberRole(
+    orgId: string,
+    userId: string,
+    role: OrganisationRole
+): Promise<AppMessage> {
+    return await apiRequest<AppMessage>(`/api/v1/organisation/${orgId}/member`, {
+        method: "PUT",
+        body: { user_id: Number(userId), role },
+    });
+}
+
 export async function getOrganisationUsers(orgId: string): Promise<Member[]> {
     return await apiRequest<Member[]>(`/api/v1/organisation/${orgId}/users`);
 }