@spfn/auth 0.2.0-beta.56 → 0.2.0-beta.57

package/dist/server.js

@@ -9248,6 +9248,7 @@ var oauthRouter = defineRouter4({
 });
 
 // src/server/routes/admin/index.ts
+init_repositories();
 init_esm();
 import { ForbiddenError as ForbiddenError4 } from "@spfn/core/errors";
 import { route as route5 } from "@spfn/core/route";
@@ -9257,7 +9258,7 @@ var listRoles = route5.get("/_auth/admin/roles").input({
       description: "Include inactive roles (default: false)"
     }))
   })
-}).use([authenticate, requireRole("superadmin")]).handler(async (c) => {
+}).use([authenticate, requireRole("admin", "superadmin")]).handler(async (c) => {
   const { query } = await c.data();
   const roles2 = await getAllRoles(query.includeInactive ?? false);
   return { roles: roles2 };
@@ -9315,9 +9316,10 @@ var updateUserRole = route5.patch("/_auth/admin/users/:userId/role").input({
   body: Type.Object({
     roleId: Type.Number({ description: "New role ID to assign" })
   })
-}).use([authenticate, requireRole("superadmin")]).handler(async (c) => {
+}).use([authenticate, requireRole("admin", "superadmin")]).handler(async (c) => {
   const { params, body } = await c.data();
   const auth = getAuth(c);
+  const callerRole = await getUserRole(auth.userId);
   if (params.userId === Number(auth.userId)) {
     throw new ForbiddenError4({ message: "Cannot change your own role" });
   }
@@ -9325,6 +9327,18 @@ var updateUserRole = route5.patch("/_auth/admin/users/:userId/role").input({
   if (targetRole === "superadmin") {
     throw new ForbiddenError4({ message: "Cannot modify superadmin role" });
   }
+  if (callerRole !== "superadmin") {
+    const newRole = await rolesRepository.findById(body.roleId);
+    if (newRole?.name === "superadmin") {
+      throw new ForbiddenError4({ message: "Only superadmin can assign superadmin role" });
+    }
+    if (newRole?.name === "admin") {
+      const canPromote = await hasPermission(auth.userId, "admin:promote");
+      if (!canPromote) {
+        throw new ForbiddenError4({ message: "admin:promote permission required to assign admin role" });
+      }
+    }
+  }
   await updateUserService(params.userId, { roleId: body.roleId });
   return { userId: params.userId, roleId: body.roleId };
 });