1.5 KiB
1.5 KiB
type, title, description, tags, timestamp
| type | title | description | tags | timestamp | |||
|---|---|---|---|---|---|---|---|
| api | Admin Endpoints | User management endpoints mounted under /api/v1/admin (admin role required). |
|
2026-07-21T18:28:00Z |
Endpoints
| Method | Path | Auth | Source |
|---|---|---|---|
GET |
/api/v1/admin/users |
Admin | backend/src/modules/admin/admin.controller.ts |
POST |
/api/v1/admin/users |
Admin | Same. |
PATCH |
/api/v1/admin/users/:id |
Admin | Same. |
DELETE |
/api/v1/admin/users/:id |
Admin | Same. |
Guard chain
JwtAuthGuard(global) validates the access token unless the handler is@Public(). Admin handlers are not.AdminGuard(backend/src/common/guards/admin.guard.ts) requiresreq.user.role === 'admin'.
Behavior
AdminServiceenforces the last-admin invariant (LAST_ADMIN/409) — the final admin row cannot be demoted or deleted.POST /api/v1/admin/userscreates a new user;PATCH /api/v1/admin/users/:idchanges role / status;DELETE /api/v1/admin/users/:idremoves the row.