Feat admin rbac migration (#1)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/handlers/admin.go

@@ -69,29 +69,25 @@ func (h *AdminHandler) CreateUser(c *gin.Context) {
 		Username string `json:"username" binding:"required"`
 		Email    string `json:"email" binding:"required"`
 		Password string `json:"password" binding:"required,min=8"`
-		Role     string `json:"role"`
+		IsAdmin  bool   `json:"is_admin"`
 	}
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
+	ctx := c.Request.Context()
 	hash, _ := bcrypt.GenerateFromPassword([]byte(req.Password), bcryptCost)
-	role := models.UserRoleUser
-	if req.Role == models.UserRoleAdmin {
-		role = models.UserRoleAdmin
-	}
 
 	user := &models.User{
 		Username:     strings.ToLower(req.Username),
 		Email:        strings.ToLower(req.Email),
 		PasswordHash: string(hash),
-		Role:         role,
 		IsActive:     true,
-		Handle:       auth.UniqueHandle(c.Request.Context(), h.stores.Users, models.HandleFromName(req.Username)),
+		Handle:       auth.UniqueHandle(ctx, h.stores.Users, models.HandleFromName(req.Username)),
 	}
 
-	if err := h.stores.Users.Create(c.Request.Context(), user); err != nil {
+	if err := h.stores.Users.Create(ctx, user); err != nil {
 		if database.IsUniqueViolation(err) {
 			c.JSON(http.StatusConflict, gin.H{"error": "username or email already exists"})
 			return
@@ -100,46 +96,55 @@ func (h *AdminHandler) CreateUser(c *gin.Context) {
 		return
 	}
 
+	auth.EnsureEveryoneGroup(ctx, h.stores, user.ID)
+	if req.IsAdmin {
+		auth.AddToAdminsGroup(ctx, h.stores, user.ID)
+	}
+
 	h.auditLog(c, "user.create", "user", user.ID, nil)
 	c.JSON(http.StatusCreated, user)
 }
 
 func (h *AdminHandler) UpdateUserRole(c *gin.Context) {
 	id := c.Param("id")
+	ctx := c.Request.Context()
 	var req struct {
-		Role string `json:"role" binding:"required"`
+		IsAdmin bool `json:"is_admin"`
 	}
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
 
-	// Guard: prevent demoting the last admin
-	if req.Role != models.UserRoleAdmin {
-		user, err := h.stores.Users.GetByID(c.Request.Context(), id)
-		if err != nil || user == nil {
-			c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
-			return
-		}
-		if user.Role == models.UserRoleAdmin {
-			adminCount, _ := h.stores.Users.CountByRole(c.Request.Context(), models.UserRoleAdmin)
-			if adminCount <= 1 {
-				c.JSON(http.StatusConflict, gin.H{"error": "cannot demote the last admin"})
-				return
-			}
-		}
-	}
-
-	if err := h.stores.Users.Update(c.Request.Context(), id, map[string]interface{}{"role": req.Role}); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to update role"})
+	if _, err := h.stores.Users.GetByID(ctx, id); err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
 		return
 	}
 
-	h.auditLog(c, "user.role_change", "user", id, gin.H{"role": req.Role})
+	if !req.IsAdmin {
+		// Guard: prevent removing the last admin from Admins group.
+		members, _ := h.stores.Groups.ListMembers(ctx, auth.AdminsGroupID)
+		isMember := false
+		for _, m := range members {
+			if m.UserID == id {
+				isMember = true
+				break
+			}
+		}
+		if isMember && len(members) <= 1 {
+			c.JSON(http.StatusConflict, gin.H{"error": "cannot remove the last admin"})
+			return
+		}
+		auth.RemoveFromAdminsGroup(ctx, h.stores, id)
+	} else {
+		auth.AddToAdminsGroup(ctx, h.stores, id)
+	}
+
+	h.auditLog(c, "user.role_change", "user", id, gin.H{"is_admin": req.IsAdmin})
 	if h.onUserChanged != nil {
 		h.onUserChanged(id)
 	}
-	c.JSON(http.StatusOK, gin.H{"message": "role updated"})
+	c.JSON(http.StatusOK, gin.H{"message": "admin status updated"})
 }
 
 func (h *AdminHandler) ToggleUserActive(c *gin.Context) {
@@ -248,18 +253,22 @@ func (h *AdminHandler) DeleteUser(c *gin.Context) {
 	id := c.Param("id")
 
 	// Guard: prevent deleting the last admin
-	user, err := h.stores.Users.GetByID(c.Request.Context(), id)
-	if err != nil || user == nil {
+	if _, err := h.stores.Users.GetByID(c.Request.Context(), id); err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
 		return
 	}
-	if user.Role == models.UserRoleAdmin {
-		adminCount, _ := h.stores.Users.CountByRole(c.Request.Context(), models.UserRoleAdmin)
-		if adminCount <= 1 {
-			c.JSON(http.StatusConflict, gin.H{"error": "cannot delete the last admin"})
-			return
+	members, _ := h.stores.Groups.ListMembers(c.Request.Context(), auth.AdminsGroupID)
+	isAdmin := false
+	for _, m := range members {
+		if m.UserID == id {
+			isAdmin = true
+			break
 		}
 	}
+	if isAdmin && len(members) <= 1 {
+		c.JSON(http.StatusConflict, gin.H{"error": "cannot delete the last admin"})
+		return
+	}
 
 	// Destroy vault and personal BYOK keys before deleting the user row
 	h.destroyVault(c, id)