Build a URL Shortener: Admin Panel — RBAC & User Management

// prisma/schema.prisma
 
enum Role {
  USER
  ADMIN
  SUPER_ADMIN
}
 
model User {
  id            String    @id @default(uuid())
  email         String    @unique
  passwordHash  String
  name          String?
  role          Role      @default(USER)
  apiKey        String?   @unique
  suspendedAt   DateTime?
  suspendedBy   String?
  suspendReason String?
  createdAt     DateTime  @default(now())
  updatedAt     DateTime  @updatedAt
  urls          Url[]
  refreshTokens RefreshToken[]
 
  @@map("users")
}

npx prisma migrate dev --name add-rbac-fields

-- CreateEnum
CREATE TYPE "Role" AS ENUM ('USER', 'ADMIN', 'SUPER_ADMIN');
 
-- AlterTable
ALTER TABLE "users"
  ADD COLUMN "role" "Role" NOT NULL DEFAULT 'USER',
  ADD COLUMN "suspendedAt" TIMESTAMP(3),
  ADD COLUMN "suspendedBy" TEXT,
  ADD COLUMN "suspendReason" TEXT;

npx prisma generate

// src/middleware/rbac.ts
import { Request, Response, NextFunction } from 'express';
import { Role } from '@prisma/client';
import { AppError } from '../utils/errors';
 
/**
 * Factory middleware giới hạn access cho specific roles.
 * Phải dùng SAU requireAuth middleware.
 */
export function requireRole(...allowedRoles: Role[]) {
  return (req: Request, _res: Response, next: NextFunction) => {
    const user = req.user;
 
    if (!user) {
      throw new AppError('Authentication required', 401);
    }
 
    // Check suspension trước role — suspended admins không được access gì cả
    if (user.suspendedAt) {
      throw new AppError(
        'Your account has been suspended. Contact support for assistance.',
        403
      );
    }
 
    if (!allowedRoles.includes(user.role as Role)) {
      throw new AppError(
        'You do not have permission to perform this action',
        403
      );
    }
 
    next();
  };
}
 
// ── Convenience helpers ──────────────────────────
// Đọc rõ ràng trong route definitions
 
/** Yêu cầu ADMIN hoặc SUPER_ADMIN role */
export const requireAdmin = requireRole(Role.ADMIN, Role.SUPER_ADMIN);
 
/** Chỉ SUPER_ADMIN role */
export const requireSuperAdmin = requireRole(Role.SUPER_ADMIN);

// Ai authenticated đều access được
router.get('/my-urls', requireAuth, getMyUrls);
 
// Chỉ admins mới access được
router.get('/admin/users', requireAuth, requireAdmin, listUsers);
 
// Chỉ super admins mới access được
router.patch('/admin/users/:id/role', requireAuth, requireSuperAdmin, updateRole);

// src/types/express.d.ts
import { Role } from '@prisma/client';
 
declare global {
  namespace Express {
    interface Request {
      user?: {
        id: string;
        email: string;
        role: Role;
        suspendedAt: Date | null;
      };
    }
  }
}

// src/services/auth.service.ts
import { Role } from '@prisma/client';
import jwt from 'jsonwebtoken';
import { config } from '../config';
 
interface TokenPayload {
  userId: string;
  email: string;
  role: Role;
}
 
export function generateAccessToken(user: {
  id: string;
  email: string;
  role: Role;
}): string {
  const payload: TokenPayload = {
    userId: user.id,
    email: user.email,
    role: user.role,
  };
 
  return jwt.sign(payload, config.jwt.accessSecret, {
    expiresIn: config.jwt.accessExpiresIn,
  });
}
 
export function generateRefreshToken(user: {
  id: string;
  email: string;
  role: Role;
}): string {
  return jwt.sign(
    { userId: user.id, email: user.email, role: user.role },
    config.jwt.refreshSecret,
    { expiresIn: config.jwt.refreshExpiresIn }
  );
}

// src/middleware/auth.ts
import { Request, Response, NextFunction } from 'express';
import jwt from 'jsonwebtoken';
import { config } from '../config';
import { AppError } from '../utils/errors';
import { prisma } from '../lib/prisma';
 
interface JwtPayload {
  userId: string;
  email: string;
  role: string;
}
 
export async function requireAuth(
  req: Request,
  _res: Response,
  next: NextFunction
) {
  const authHeader = req.headers.authorization;
 
  if (!authHeader?.startsWith('Bearer ')) {
    throw new AppError('Access token required', 401);
  }
 
  const token = authHeader.split(' ')[1];
 
  try {
    const payload = jwt.verify(token, config.jwt.accessSecret) as JwtPayload;
 
    // Fetch fresh user data để check suspension status
    // Ngăn suspended users dùng tokens cũ
    const user = await prisma.user.findUnique({
      where: { id: payload.userId },
      select: {
        id: true,
        email: true,
        role: true,
        suspendedAt: true,
      },
    });
 
    if (!user) {
      throw new AppError('User not found', 401);
    }
 
    if (user.suspendedAt) {
      throw new AppError(
        'Your account has been suspended. Contact support for assistance.',
        403
      );
    }
 
    req.user = user;
    next();
  } catch (error) {
    if (error instanceof AppError) throw error;
    throw new AppError('Invalid or expired access token', 401);
  }
}

// src/routes/admin.ts
import { Router } from 'express';
import { requireAuth } from '../middleware/auth';
import { requireAdmin, requireSuperAdmin } from '../middleware/rbac';
import * as adminController from '../controllers/admin.controller';
import { validate } from '../middleware/validate';
import {
  listUsersSchema,
  updateRoleSchema,
  suspendUserSchema,
} from '../validators/admin.validators';
 
const router = Router();
 
// Tất cả admin routes yêu cầu authentication + admin role
router.use(requireAuth, requireAdmin);
 
// User management
router.get('/users', validate(listUsersSchema), adminController.listUsers);
router.get('/users/:id', adminController.getUserDetails);
router.patch(
  '/users/:id/role',
  requireSuperAdmin,
  validate(updateRoleSchema),
  adminController.updateUserRole
);
router.post(
  '/users/:id/suspend',
  validate(suspendUserSchema),
  adminController.suspendUser
);
router.post('/users/:id/reactivate', adminController.reactivateUser);
 
export default router;

// src/app.ts (thêm vào route setup hiện tại)
import adminRoutes from './routes/admin';
 
// ... existing routes ...
app.use('/api/admin', adminRoutes);

// src/validators/admin.validators.ts
import { z } from 'zod';
import { Role } from '@prisma/client';
 
export const listUsersSchema = z.object({
  query: z.object({
    page: z.coerce.number().int().positive().default(1),
    limit: z.coerce.number().int().min(1).max(100).default(20),
    search: z.string().optional(),
    role: z.nativeEnum(Role).optional(),
    status: z.enum(['active', 'suspended']).optional(),
    sortBy: z.enum(['createdAt', 'email', 'name', 'role']).default('createdAt'),
    sortOrder: z.enum(['asc', 'desc']).default('desc'),
  }),
});
 
export const updateRoleSchema = z.object({
  body: z.object({
    role: z.nativeEnum(Role, {
      errorMap: () => ({
        message: 'Role must be USER, ADMIN, or SUPER_ADMIN',
      }),
    }),
  }),
});
 
export const suspendUserSchema = z.object({
  body: z.object({
    reason: z
      .string()
      .min(10, 'Suspension reason must be at least 10 characters')
      .max(500, 'Suspension reason must be at most 500 characters'),
  }),
});

// src/controllers/admin.controller.ts
import { Request, Response } from 'express';
import { prisma } from '../lib/prisma';
import { Role } from '@prisma/client';
import { AppError } from '../utils/errors';
 
/**
 * GET /api/admin/users
 * List all users với pagination, search và filters.
 */
export async function listUsers(req: Request, res: Response) {
  const {
    page = 1,
    limit = 20,
    search,
    role,
    status,
    sortBy = 'createdAt',
    sortOrder = 'desc',
  } = req.query as {
    page?: number;
    limit?: number;
    search?: string;
    role?: Role;
    status?: 'active' | 'suspended';
    sortBy?: string;
    sortOrder?: 'asc' | 'desc';
  };
 
  // Build filter conditions
  const where: Record<string, unknown> = {};
 
  if (search) {
    where.OR = [
      { email: { contains: search, mode: 'insensitive' } },
      { name: { contains: search, mode: 'insensitive' } },
    ];
  }
 
  if (role) {
    where.role = role;
  }
 
  if (status === 'active') {
    where.suspendedAt = null;
  } else if (status === 'suspended') {
    where.suspendedAt = { not: null };
  }
 
  // Chạy count và find song song
  const [total, users] = await Promise.all([
    prisma.user.count({ where }),
    prisma.user.findMany({
      where,
      select: {
        id: true,
        email: true,
        name: true,
        role: true,
        suspendedAt: true,
        suspendReason: true,
        createdAt: true,
        updatedAt: true,
        _count: {
          select: { urls: true },
        },
      },
      orderBy: { [sortBy]: sortOrder },
      skip: (page - 1) * limit,
      take: limit,
    }),
  ]);
 
  const totalPages = Math.ceil(total / limit);
 
  res.json({
    data: users.map((user) => ({
      ...user,
      urlCount: user._count.urls,
      _count: undefined,
    })),
    pagination: {
      page,
      limit,
      total,
      totalPages,
      hasNext: page < totalPages,
      hasPrev: page > 1,
    },
  });
}

/**
 * GET /api/admin/users/:id
 * Xem chi tiết user profile bao gồm URL stats.
 */
export async function getUserDetails(req: Request, res: Response) {
  const { id } = req.params;
 
  const user = await prisma.user.findUnique({
    where: { id },
    select: {
      id: true,
      email: true,
      name: true,
      role: true,
      suspendedAt: true,
      suspendedBy: true,
      suspendReason: true,
      createdAt: true,
      updatedAt: true,
      _count: {
        select: {
          urls: true,
          refreshTokens: true,
        },
      },
      urls: {
        select: {
          id: true,
          shortCode: true,
          originalUrl: true,
          clicks: true,
          createdAt: true,
          expiresAt: true,
        },
        orderBy: { createdAt: 'desc' },
        take: 10, // 10 URLs gần nhất
      },
    },
  });
 
  if (!user) {
    throw new AppError('User not found', 404);
  }
 
  // Aggregate URL stats
  const urlStats = await prisma.url.aggregate({
    where: { userId: id },
    _sum: { clicks: true },
    _count: { id: true },
    _max: { createdAt: true },
  });
 
  res.json({
    data: {
      ...user,
      urlCount: user._count.urls,
      activeSessions: user._count.refreshTokens,
      stats: {
        totalUrls: urlStats._count.id,
        totalClicks: urlStats._sum.clicks ?? 0,
        lastUrlCreated: urlStats._max.createdAt,
      },
      recentUrls: user.urls,
      _count: undefined,
    },
  });
}

/**
 * PATCH /api/admin/users/:id/role
 * Promote hoặc demote user. Chỉ SUPER_ADMIN.
 */
export async function updateUserRole(req: Request, res: Response) {
  const { id } = req.params;
  const { role } = req.body as { role: Role };
  const currentUser = req.user!;
 
  // Ngăn self-demotion (tránh tự lock mình ra)
  if (id === currentUser.id) {
    throw new AppError(
      'You cannot change your own role. Ask another super admin.',
      400
    );
  }
 
  // Verify target user tồn tại
  const targetUser = await prisma.user.findUnique({
    where: { id },
    select: { id: true, email: true, role: true },
  });
 
  if (!targetUser) {
    throw new AppError('User not found', 404);
  }
 
  // Ngăn demote SUPER_ADMIN khác
  if (targetUser.role === Role.SUPER_ADMIN && role !== Role.SUPER_ADMIN) {
    throw new AppError(
      'Cannot demote a SUPER_ADMIN. They must be demoted by direct database access.',
      403
    );
  }
 
  const updatedUser = await prisma.user.update({
    where: { id },
    data: { role },
    select: {
      id: true,
      email: true,
      name: true,
      role: true,
      updatedAt: true,
    },
  });
 
  // Log role change (foundation cho audit log)
  console.log(
    JSON.stringify({
      event: 'admin.role_change',
      adminId: currentUser.id,
      adminEmail: currentUser.email,
      targetUserId: id,
      targetEmail: targetUser.email,
      previousRole: targetUser.role,
      newRole: role,
      timestamp: new Date().toISOString(),
    })
  );
 
  res.json({
    message: `User role updated to ${role}`,
    data: updatedUser,
  });
}

/**
 * POST /api/admin/users/:id/suspend
 * Suspend user account kèm lý do.
 */
export async function suspendUser(req: Request, res: Response) {
  const { id } = req.params;
  const { reason } = req.body as { reason: string };
  const currentUser = req.user!;
 
  // Ngăn self-suspension
  if (id === currentUser.id) {
    throw new AppError('You cannot suspend your own account', 400);
  }
 
  const targetUser = await prisma.user.findUnique({
    where: { id },
    select: { id: true, email: true, role: true, suspendedAt: true },
  });
 
  if (!targetUser) {
    throw new AppError('User not found', 404);
  }
 
  if (targetUser.suspendedAt) {
    throw new AppError('User is already suspended', 400);
  }
 
  // Admins không thể suspend admin khác — chỉ SUPER_ADMIN mới được
  if (
    targetUser.role === Role.ADMIN ||
    targetUser.role === Role.SUPER_ADMIN
  ) {
    if (currentUser.role !== Role.SUPER_ADMIN) {
      throw new AppError(
        'Only SUPER_ADMIN can suspend admin accounts',
        403
      );
    }
  }
 
  // Không thể suspend SUPER_ADMIN
  if (targetUser.role === Role.SUPER_ADMIN) {
    throw new AppError('Cannot suspend a SUPER_ADMIN account', 403);
  }
 
  const updatedUser = await prisma.user.update({
    where: { id },
    data: {
      suspendedAt: new Date(),
      suspendedBy: currentUser.id,
      suspendReason: reason,
    },
    select: {
      id: true,
      email: true,
      name: true,
      role: true,
      suspendedAt: true,
      suspendReason: true,
    },
  });
 
  // Invalidate tất cả refresh tokens của user bị suspended
  await prisma.refreshToken.deleteMany({
    where: { userId: id },
  });
 
  // Log suspension
  console.log(
    JSON.stringify({
      event: 'admin.user_suspended',
      adminId: currentUser.id,
      adminEmail: currentUser.email,
      targetUserId: id,
      targetEmail: targetUser.email,
      reason,
      timestamp: new Date().toISOString(),
    })
  );
 
  res.json({
    message: 'User account suspended',
    data: updatedUser,
  });
}

/**
 * POST /api/admin/users/:id/reactivate
 * Reactivate account đã bị suspended.
 */
export async function reactivateUser(req: Request, res: Response) {
  const { id } = req.params;
  const currentUser = req.user!;
 
  const targetUser = await prisma.user.findUnique({
    where: { id },
    select: { id: true, email: true, suspendedAt: true },
  });
 
  if (!targetUser) {
    throw new AppError('User not found', 404);
  }
 
  if (!targetUser.suspendedAt) {
    throw new AppError('User is not suspended', 400);
  }
 
  const updatedUser = await prisma.user.update({
    where: { id },
    data: {
      suspendedAt: null,
      suspendedBy: null,
      suspendReason: null,
    },
    select: {
      id: true,
      email: true,
      name: true,
      role: true,
      suspendedAt: true,
    },
  });
 
  // Log reactivation
  console.log(
    JSON.stringify({
      event: 'admin.user_reactivated',
      adminId: currentUser.id,
      adminEmail: currentUser.email,
      targetUserId: id,
      targetEmail: targetUser.email,
      timestamp: new Date().toISOString(),
    })
  );
 
  res.json({
    message: 'User account reactivated',
    data: updatedUser,
  });
}

// src/services/auth.service.ts (update login function)
export async function login(email: string, password: string) {
  const user = await prisma.user.findUnique({
    where: { email },
    select: {
      id: true,
      email: true,
      passwordHash: true,
      role: true,
      suspendedAt: true,
      suspendReason: true,
    },
  });
 
  if (!user) {
    throw new AppError('Invalid email or password', 401);
  }
 
  // Check suspension TRƯỚC khi verify password
  // Ngăn timing attacks có thể tiết lộ account tồn tại
  if (user.suspendedAt) {
    throw new AppError(
      `Account suspended: ${user.suspendReason || 'Contact support for details'}`,
      403
    );
  }
 
  const isValid = await bcrypt.compare(password, user.passwordHash);
  if (!isValid) {
    throw new AppError('Invalid email or password', 401);
  }
 
  const accessToken = generateAccessToken(user);
  const refreshToken = generateRefreshToken(user);
 
  // Lưu refresh token vào database
  await prisma.refreshToken.create({
    data: {
      token: refreshToken,
      userId: user.id,
      expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), // 7 ngày
    },
  });
 
  return { accessToken, refreshToken, user };
}

// src/services/auth.service.ts (update refresh function)
export async function refreshAccessToken(refreshToken: string) {
  const stored = await prisma.refreshToken.findUnique({
    where: { token: refreshToken },
    include: {
      user: {
        select: {
          id: true,
          email: true,
          role: true,
          suspendedAt: true,
        },
      },
    },
  });
 
  if (!stored || stored.expiresAt < new Date()) {
    throw new AppError('Invalid or expired refresh token', 401);
  }
 
  if (stored.user.suspendedAt) {
    // Xóa refresh token — họ không nên retry được
    await prisma.refreshToken.delete({ where: { id: stored.id } });
    throw new AppError('Account suspended', 403);
  }
 
  const newAccessToken = generateAccessToken(stored.user);
  return { accessToken: newAccessToken };
}

// src/services/url.service.ts (thêm check ở đầu createUrl)
export async function createUrl(
  userId: string,
  originalUrl: string,
  customAlias?: string,
  expiresAt?: Date
) {
  // Defense in depth — auth middleware nên catch cái này,
  // nhưng chúng ta double-check ở đây
  const user = await prisma.user.findUnique({
    where: { id: userId },
    select: { suspendedAt: true },
  });
 
  if (user?.suspendedAt) {
    throw new AppError('Account suspended — cannot create URLs', 403);
  }
 
  // ... phần còn lại của URL creation logic
}

// prisma/seed.ts
import { PrismaClient, Role } from '@prisma/client';
import bcrypt from 'bcrypt';
 
const prisma = new PrismaClient();
 
async function main() {
  const adminEmail = process.env.ADMIN_EMAIL;
  const adminPassword = process.env.ADMIN_PASSWORD;
 
  if (!adminEmail || !adminPassword) {
    console.error('ADMIN_EMAIL and ADMIN_PASSWORD environment variables required');
    process.exit(1);
  }
 
  if (adminPassword.length < 12) {
    console.error('Admin password must be at least 12 characters');
    process.exit(1);
  }
 
  const hashedPassword = await bcrypt.hash(adminPassword, 12);
 
  const admin = await prisma.user.upsert({
    where: { email: adminEmail },
    update: {
      role: Role.SUPER_ADMIN,
    },
    create: {
      email: adminEmail,
      passwordHash: hashedPassword,
      name: 'Super Admin',
      role: Role.SUPER_ADMIN,
    },
  });
 
  console.log(`Super admin seeded: ${admin.email} (${admin.id})`);
}
 
main()
  .catch((error) => {
    console.error('Seed failed:', error);
    process.exit(1);
  })
  .finally(() => prisma.$disconnect());

// package.json (thêm vào phần prisma)
{
  "prisma": {
    "seed": "ts-node --compiler-options {\"module\":\"CommonJS\"} prisma/seed.ts"
  }
}

# Set admin credentials
export ADMIN_EMAIL="[email protected]"
export ADMIN_PASSWORD="super-secure-password-here"
 
# Chạy seed
npx prisma db seed

// scripts/promote-admin.ts
import { PrismaClient, Role } from '@prisma/client';
 
const prisma = new PrismaClient();
 
async function main() {
  const email = process.argv[2];
 
  if (!email) {
    console.error('Usage: npx ts-node scripts/promote-admin.ts <email>');
    process.exit(1);
  }
 
  const user = await prisma.user.update({
    where: { email },
    data: { role: Role.SUPER_ADMIN },
  });
 
  console.log(`Promoted ${user.email} to SUPER_ADMIN`);
}
 
main()
  .catch(console.error)
  .finally(() => prisma.$disconnect());

npx ts-node scripts/promote-admin.ts [email protected]

# List tất cả users (trang 1, 20 mỗi trang)
curl -H "Authorization: Bearer $TOKEN" \
  http://localhost:3000/api/admin/users
 
# Search users theo email
curl -H "Authorization: Bearer $TOKEN" \
  "http://localhost:3000/api/admin/users?search=john&role=USER"
 
# Xem chi tiết user
curl -H "Authorization: Bearer $TOKEN" \
  http://localhost:3000/api/admin/users/abc-123-def
 
# Promote user thành ADMIN
curl -X PATCH \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"role": "ADMIN"}' \
  http://localhost:3000/api/admin/users/abc-123-def/role
 
# Suspend user
curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"reason": "Spamming malicious redirect URLs"}' \
  http://localhost:3000/api/admin/users/abc-123-def/suspend
 
# Reactivate user
curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  http://localhost:3000/api/admin/users/abc-123-def/reactivate

// src/controllers/user.controller.ts
export async function updateProfile(req: Request, res: Response) {
  const { name } = req.body;
 
  // CHỈ cho phép update name — không bao giờ role,
  // email changes đi qua verification flow riêng
  const user = await prisma.user.update({
    where: { id: req.user!.id },
    data: { name },
    select: { id: true, email: true, name: true, role: true },
  });
 
  res.json({ data: user });
}

// Đã implement trong updateUserRole và suspendUser ở trên:
if (id === currentUser.id) {
  throw new AppError('You cannot change your own role', 400);
}

// src/middleware/rateLimit.ts
import rateLimit from 'express-rate-limit';
 
export const adminRateLimit = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 phút
  max: 100, // 100 requests mỗi 15 phút
  message: {
    error: 'Too many admin requests, please try again later',
  },
  standardHeaders: true,
  legacyHeaders: false,
});

// src/routes/admin.ts
import { adminRateLimit } from '../middleware/rateLimit';
 
router.use(requireAuth, requireAdmin, adminRateLimit);

// Pattern dùng xuyên suốt controllers:
console.log(
  JSON.stringify({
    event: 'admin.user_suspended',
    adminId: currentUser.id,
    adminEmail: currentUser.email,
    targetUserId: id,
    reason,
    timestamp: new Date().toISOString(),
  })
);

// ❌ Đừng làm thế này — role checking rải rác khắp controllers
export async function listUsers(req: Request, res: Response) {
  if (req.user?.role !== 'ADMIN' && req.user?.role !== 'SUPER_ADMIN') {
    return res.status(403).json({ error: 'Forbidden' });
  }
  // ... phần còn lại
}
 
export async function suspendUser(req: Request, res: Response) {
  if (req.user?.role !== 'ADMIN' && req.user?.role !== 'SUPER_ADMIN') {
    return res.status(403).json({ error: 'Forbidden' });
  }
  // ... phần còn lại
}

// ✅ Role checking trong middleware, controllers chỉ lo business logic
router.use(requireAuth, requireAdmin);
 
router.get('/users', adminController.listUsers);
router.post('/users/:id/suspend', adminController.suspendUser);

// ❌ Suspended user vẫn login được và lấy tokens mới!
export async function login(email: string, password: string) {
  const user = await prisma.user.findUnique({ where: { email } });
  // Không check suspension ở đây — user lấy được valid token
  return { token: generateAccessToken(user) };
}

// ✅ Check suspension ở login, token refresh VÀ middleware
export async function login(email: string, password: string) {
  const user = await prisma.user.findUnique({ where: { email } });
 
  if (user?.suspendedAt) {
    throw new AppError('Account suspended', 403);
  }
 
  // ... verify password, generate tokens
}

// ❌ Admin suspend chính mình, giờ không ai unsuspend được
export async function suspendUser(req: Request, res: Response) {
  const { id } = req.params;
  await prisma.user.update({
    where: { id },
    data: { suspendedAt: new Date() },
  });
}

// ✅ Ngăn self-suspension
export async function suspendUser(req: Request, res: Response) {
  const { id } = req.params;
 
  if (id === req.user!.id) {
    throw new AppError('You cannot suspend your own account', 400);
  }
 
  await prisma.user.update({
    where: { id },
    data: { suspendedAt: new Date() },
  });
}

// ❌ Password hash lẫn trong response!
const user = await prisma.user.findUnique({ where: { id } });
res.json({ data: user });

// ✅ Explicitly select safe fields
const user = await prisma.user.findUnique({
  where: { id },
  select: {
    id: true,
    email: true,
    name: true,
    role: true,
    createdAt: true,
    // Không passwordHash, không apiKey
  },
});
res.json({ data: user });

// src/__tests__/admin.test.ts
import { describe, it, expect, beforeAll, beforeEach } from 'vitest';
import request from 'supertest';
import { app } from '../app';
import { prisma } from '../lib/prisma';
import { Role } from '@prisma/client';
import bcrypt from 'bcrypt';
 
// Helper tạo users với specific roles
async function createUser(overrides: Partial<{
  email: string;
  role: Role;
  suspended: boolean;
}> = {}) {
  const email = overrides.email ?? `user-${Date.now()}@test.com`;
  const user = await prisma.user.create({
    data: {
      email,
      passwordHash: await bcrypt.hash('password123', 10),
      name: 'Test User',
      role: overrides.role ?? Role.USER,
      suspendedAt: overrides.suspended ? new Date() : null,
      suspendReason: overrides.suspended ? 'Test suspension' : null,
    },
  });
  return user;
}
 
// Helper lấy auth token cho user
async function getToken(email: string): Promise<string> {
  const res = await request(app)
    .post('/api/auth/login')
    .send({ email, password: 'password123' });
  return res.body.accessToken;
}
 
describe('Admin API', () => {
  let superAdmin: { id: string; email: string };
  let admin: { id: string; email: string };
  let regularUser: { id: string; email: string };
  let superAdminToken: string;
  let adminToken: string;
  let userToken: string;
 
  beforeAll(async () => {
    // Dọn dẹp
    await prisma.user.deleteMany({});
 
    // Tạo test users
    superAdmin = await createUser({
      email: '[email protected]',
      role: Role.SUPER_ADMIN,
    });
    admin = await createUser({
      email: '[email protected]',
      role: Role.ADMIN,
    });
    regularUser = await createUser({
      email: '[email protected]',
      role: Role.USER,
    });
 
    // Lấy tokens
    superAdminToken = await getToken('[email protected]');
    adminToken = await getToken('[email protected]');
    userToken = await getToken('[email protected]');
  });

  describe('Authorization', () => {
    it('should reject unauthenticated requests', async () => {
      const res = await request(app).get('/api/admin/users');
      expect(res.status).toBe(401);
    });
 
    it('should reject regular users', async () => {
      const res = await request(app)
        .get('/api/admin/users')
        .set('Authorization', `Bearer ${userToken}`);
      expect(res.status).toBe(403);
      expect(res.body.error).toContain('permission');
    });
 
    it('should allow admin access', async () => {
      const res = await request(app)
        .get('/api/admin/users')
        .set('Authorization', `Bearer ${adminToken}`);
      expect(res.status).toBe(200);
      expect(res.body.data).toBeDefined();
    });
 
    it('should allow super admin access', async () => {
      const res = await request(app)
        .get('/api/admin/users')
        .set('Authorization', `Bearer ${superAdminToken}`);
      expect(res.status).toBe(200);
    });
  });

  describe('PATCH /api/admin/users/:id/role', () => {
    it('should reject role changes from regular admin', async () => {
      const res = await request(app)
        .patch(`/api/admin/users/${regularUser.id}/role`)
        .set('Authorization', `Bearer ${adminToken}`)
        .send({ role: 'ADMIN' });
      expect(res.status).toBe(403);
    });
 
    it('should allow super admin to promote user', async () => {
      const newUser = await createUser({ email: '[email protected]' });
      const res = await request(app)
        .patch(`/api/admin/users/${newUser.id}/role`)
        .set('Authorization', `Bearer ${superAdminToken}`)
        .send({ role: 'ADMIN' });
      expect(res.status).toBe(200);
      expect(res.body.data.role).toBe('ADMIN');
    });
 
    it('should prevent self-demotion', async () => {
      const res = await request(app)
        .patch(`/api/admin/users/${superAdmin.id}/role`)
        .set('Authorization', `Bearer ${superAdminToken}`)
        .send({ role: 'USER' });
      expect(res.status).toBe(400);
      expect(res.body.error).toContain('own role');
    });
 
    it('should reject invalid role values', async () => {
      const res = await request(app)
        .patch(`/api/admin/users/${regularUser.id}/role`)
        .set('Authorization', `Bearer ${superAdminToken}`)
        .send({ role: 'MEGADMIN' });
      expect(res.status).toBe(400);
    });
  });

  describe('POST /api/admin/users/:id/suspend', () => {
    it('should suspend a user with reason', async () => {
      const target = await createUser({ email: '[email protected]' });
      const res = await request(app)
        .post(`/api/admin/users/${target.id}/suspend`)
        .set('Authorization', `Bearer ${adminToken}`)
        .send({ reason: 'Posting spam links repeatedly' });
 
      expect(res.status).toBe(200);
      expect(res.body.data.suspendedAt).toBeDefined();
      expect(res.body.data.suspendReason).toBe('Posting spam links repeatedly');
    });
 
    it('should prevent self-suspension', async () => {
      const res = await request(app)
        .post(`/api/admin/users/${admin.id}/suspend`)
        .set('Authorization', `Bearer ${adminToken}`)
        .send({ reason: 'Testing self-suspension' });
      expect(res.status).toBe(400);
    });
 
    it('should require suspension reason', async () => {
      const target = await createUser({ email: '[email protected]' });
      const res = await request(app)
        .post(`/api/admin/users/${target.id}/suspend`)
        .set('Authorization', `Bearer ${adminToken}`)
        .send({});
      expect(res.status).toBe(400);
    });
 
    it('should block login for suspended user', async () => {
      const target = await createUser({ email: '[email protected]' });
 
      // Suspend user
      await request(app)
        .post(`/api/admin/users/${target.id}/suspend`)
        .set('Authorization', `Bearer ${adminToken}`)
        .send({ reason: 'Abusive behavior detected' });
 
      // Thử login
      const loginRes = await request(app)
        .post('/api/auth/login')
        .send({ email: '[email protected]', password: 'password123' });
 
      expect(loginRes.status).toBe(403);
      expect(loginRes.body.error).toContain('suspended');
    });
  });

  describe('GET /api/admin/users', () => {
    it('should paginate results', async () => {
      const res = await request(app)
        .get('/api/admin/users?page=1&limit=2')
        .set('Authorization', `Bearer ${adminToken}`);
 
      expect(res.status).toBe(200);
      expect(res.body.data.length).toBeLessThanOrEqual(2);
      expect(res.body.pagination).toMatchObject({
        page: 1,
        limit: 2,
        hasNext: expect.any(Boolean),
        hasPrev: false,
      });
    });
 
    it('should search by email', async () => {
      const res = await request(app)
        .get('/api/admin/users?search=super@test')
        .set('Authorization', `Bearer ${adminToken}`);
 
      expect(res.status).toBe(200);
      expect(res.body.data.length).toBeGreaterThanOrEqual(1);
      expect(res.body.data[0].email).toContain('super@test');
    });
 
    it('should filter by role', async () => {
      const res = await request(app)
        .get('/api/admin/users?role=ADMIN')
        .set('Authorization', `Bearer ${adminToken}`);
 
      expect(res.status).toBe(200);
      res.body.data.forEach((user: { role: string }) => {
        expect(user.role).toBe('ADMIN');
      });
    });
 
    it('should filter by suspension status', async () => {
      const res = await request(app)
        .get('/api/admin/users?status=suspended')
        .set('Authorization', `Bearer ${adminToken}`);
 
      expect(res.status).toBe(200);
      res.body.data.forEach((user: { suspendedAt: string | null }) => {
        expect(user.suspendedAt).not.toBeNull();
      });
    });
  });

  describe('POST /api/admin/users/:id/reactivate', () => {
    it('should reactivate a suspended user', async () => {
      const target = await createUser({
        email: '[email protected]',
        suspended: true,
      });
 
      const res = await request(app)
        .post(`/api/admin/users/${target.id}/reactivate`)
        .set('Authorization', `Bearer ${adminToken}`);
 
      expect(res.status).toBe(200);
      expect(res.body.data.suspendedAt).toBeNull();
    });
 
    it('should reject reactivation of active user', async () => {
      const target = await createUser({ email: '[email protected]' });
 
      const res = await request(app)
        .post(`/api/admin/users/${target.id}/reactivate`)
        .set('Authorization', `Bearer ${adminToken}`);
 
      expect(res.status).toBe(400);
      expect(res.body.error).toContain('not suspended');
    });
  });
});

npx vitest run src/__tests__/admin.test.ts