58fd7fa5c6
- Added support for generating Android access tokens and managing refresh sessions in the auth endpoints. - Implemented new tests for login, logout, and refresh functionalities specific to Android clients. - Enhanced password reset logging with normalization and masking of email addresses. - Created a new diagnostics endpoint for password reset attempts, including filtering and summarizing logs. - Introduced a new utility for managing password reset logs with retention policies. - Added tests for password reset log utilities to ensure proper functionality and privacy compliance. - Updated WebAuthn configuration tests to validate origin handling for production and allowed origins.
55 lines
1.4 KiB
JavaScript
55 lines
1.4 KiB
JavaScript
import { getUserFromToken, readUsers, writeUsers, hasAnyRole, revokeRefreshSessionsForUser } from '../../../utils/auth.js'
|
|
import { writeAuditLog } from '../../../utils/audit-log.js'
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
try {
|
|
const token = getCookie(event, 'auth_token')
|
|
const currentUser = await getUserFromToken(token)
|
|
|
|
if (!currentUser || !hasAnyRole(currentUser, 'admin')) {
|
|
throw createError({
|
|
statusCode: 403,
|
|
message: 'Zugriff verweigert'
|
|
})
|
|
}
|
|
|
|
const body = await readBody(event)
|
|
const { userId } = body
|
|
|
|
if (userId === currentUser.id) {
|
|
throw createError({
|
|
statusCode: 400,
|
|
message: 'Sie können sich nicht selbst deaktivieren'
|
|
})
|
|
}
|
|
|
|
const users = await readUsers()
|
|
const user = users.find(u => u.id === userId)
|
|
|
|
if (!user) {
|
|
throw createError({
|
|
statusCode: 404,
|
|
message: 'Benutzer nicht gefunden'
|
|
})
|
|
}
|
|
|
|
user.active = false
|
|
const updatedUsers = users.map(u => u.id === userId ? user : u)
|
|
await writeUsers(updatedUsers)
|
|
await revokeRefreshSessionsForUser(userId, 'account_deactivated')
|
|
|
|
await writeAuditLog('cms.user.deactivated', {
|
|
actorUserId: currentUser.id,
|
|
targetUserId: userId
|
|
})
|
|
|
|
return {
|
|
success: true,
|
|
message: 'Benutzer wurde deaktiviert'
|
|
}
|
|
} catch (error) {
|
|
console.error('Fehler beim Deaktivieren:', error)
|
|
throw error
|
|
}
|
|
})
|