Add admin notes and deletion tools for users

server/api/admin/users/[id]/index.delete.ts

@@ -0,0 +1,40 @@
+import { createError, defineEventHandler } from 'h3'
+import { requireAdmin } from '../../../../utils/auth'
+import { User } from '../../../../models/User'
+import { LearnProfile } from '../../../../models/LearnProfile'
+import { BridgeToken } from '../../../../models/BridgeToken'
+import { PasswordResetToken } from '../../../../models/PasswordResetToken'
+
+export default defineEventHandler(async (event) => {
+  const admin = await requireAdmin(event)
+
+  const params = event.context.params as { id?: string }
+  const userId = params?.id
+
+  if (!userId) {
+    throw createError({ statusCode: 400, statusMessage: 'Missing user ID' })
+  }
+
+  if (String(admin._id) === userId) {
+    throw createError({ statusCode: 400, statusMessage: 'You cannot delete your own account.' })
+  }
+
+  const user = await User.findById(userId)
+  if (!user) {
+    throw createError({ statusCode: 404, statusMessage: 'User not found' })
+  }
+
+  if (user.role !== 'user') {
+    throw createError({ statusCode: 400, statusMessage: 'Only regular user accounts can be deleted.' })
+  }
+
+  await Promise.all([
+    LearnProfile.deleteOne({ user: user._id }).catch(() => null),
+    BridgeToken.deleteMany({ user: user._id }).catch(() => null),
+    PasswordResetToken.deleteMany({ user: user._id }).catch(() => null),
+  ])
+
+  await user.deleteOne()
+
+  return { success: true }
+})

server/api/admin/users/[id]/notes.patch.ts

@@ -0,0 +1,39 @@
+import { createError, defineEventHandler, readBody } from 'h3'
+import { requireAdmin } from '../../../../utils/auth'
+import { User } from '../../../../models/User'
+
+interface UpdateNotesBody {
+  notes?: string
+}
+
+export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+
+  const params = event.context.params as { id?: string }
+  const userId = params?.id
+
+  if (!userId) {
+    throw createError({ statusCode: 400, statusMessage: 'Missing user ID' })
+  }
+
+  const body = await readBody<UpdateNotesBody>(event).catch(() => ({}))
+  const rawNotes = typeof body.notes === 'string' ? body.notes.replace(/\r\n/g, '\n') : ''
+  const notes = rawNotes.trim()
+
+  if (notes.length > 2000) {
+    throw createError({ statusCode: 400, statusMessage: 'Notes are too long (max 2000 characters).' })
+  }
+
+  const user = await User.findById(userId)
+  if (!user) {
+    throw createError({ statusCode: 404, statusMessage: 'User not found' })
+  }
+
+  user.adminNotes = notes
+  await user.save()
+
+  return {
+    success: true,
+    notes: user.adminNotes || '',
+  }
+})