Changeset 0.28.4 (#190)

server/handlers/admin.go

@@ -22,16 +22,23 @@ import (
 )
 
 type AdminHandler struct {
-	stores   store.Stores
-	vault    *crypto.KeyResolver
-	uekCache *crypto.UEKCache
-	objStore storage.ObjectStore
+	stores        store.Stores
+	vault         *crypto.KeyResolver
+	uekCache      *crypto.UEKCache
+	objStore      storage.ObjectStore
+	onUserChanged func(userID string) // auth cache eviction callback
 }
 
 func NewAdminHandler(s store.Stores, vault *crypto.KeyResolver, uekCache *crypto.UEKCache, objStore storage.ObjectStore) *AdminHandler {
 	return &AdminHandler{stores: s, vault: vault, uekCache: uekCache, objStore: objStore}
 }
 
+// OnUserChanged registers a callback invoked when a user's role or
+// active status changes. Used to evict the auth middleware cache.
+func (h *AdminHandler) OnUserChanged(fn func(userID string)) {
+	h.onUserChanged = fn
+}
+
 // ── User Management ─────────────────────────
 
 func (h *AdminHandler) ListUsers(c *gin.Context) {
@@ -135,6 +142,9 @@ func (h *AdminHandler) UpdateUserRole(c *gin.Context) {
 	}
 
 	h.auditLog(c, "user.role_change", "user", id, gin.H{"role": req.Role})
+	if h.onUserChanged != nil {
+		h.onUserChanged(id)
+	}
 	c.JSON(http.StatusOK, gin.H{"message": "role updated"})
 }
 
@@ -154,6 +164,9 @@ func (h *AdminHandler) ToggleUserActive(c *gin.Context) {
 	}
 
 	h.auditLog(c, "user.active_change", "user", id, gin.H{"is_active": req.IsActive})
+	if h.onUserChanged != nil {
+		h.onUserChanged(id)
+	}
 	c.JSON(http.StatusOK, gin.H{"message": "user status updated"})
 }