@unchainedshop/core-users 4.8.25 → 4.8.27

package/lib/module/configureUsersModule.js

@@ -27,6 +27,7 @@ const USER_EVENTS = [
     'USER_UPDATE_WEB3_ADDRESS',
     'USER_REMOVE',
 ];
+const ADMIN_ROLE = 'admin';
 export const removeConfidentialServiceHashes = (rawUser) => {
     const user = { ...rawUser };
     delete user?.services;
@@ -88,6 +89,14 @@ export const configureUsersModule = async (moduleInput) => {
     registerEvents(USER_EVENTS);
     const Users = await UsersCollection(db);
     const webAuthn = await configureUsersWebAuthnModule(moduleInput);
+    const assertAnotherActiveAdminExists = async (userId) => {
+        const user = await Users.findOne({ _id: userId, deleted: null });
+        if (!user?.roles?.includes(ADMIN_ROLE))
+            return;
+        const activeAdminCount = await Users.countDocuments({ deleted: null, roles: ADMIN_ROLE }, { limit: 2 });
+        if (activeAdminCount <= 1)
+            throw new Error('At least one active administrator is required. Assign another administrator before removing this account or revoking its admin role.', { cause: 'LAST_ADMIN' });
+    };
     return {
         webAuthn,
         async count(query) {
@@ -606,6 +615,7 @@ export const configureUsersModule = async (moduleInput) => {
             return user;
         },
         markDeleted: async (userId) => {
+            await assertAnotherActiveAdminExists(userId);
             await db.collection('sessions').deleteMany({
                 session: { $regex: `"user(Id)?":"${escapeRegexString(userId)}"` },
             });
@@ -635,6 +645,7 @@ export const configureUsersModule = async (moduleInput) => {
             return user;
         },
         deletePermanently: async ({ userId }) => {
+            await assertAnotherActiveAdminExists(userId);
             return Users.findOneAndDelete({ _id: userId });
         },
         updateProfile: async (userId, updatedData) => {
@@ -751,15 +762,14 @@ export const configureUsersModule = async (moduleInput) => {
             return updatedUser;
         },
         updateRoles: async (_id, roles) => {
-            const modifier = {
+            if (!roles.includes(ADMIN_ROLE))
+                await assertAnotherActiveAdminExists(_id);
+            const user = await Users.findOneAndUpdate(generateDbFilterById(_id), {
                 $set: {
                     updated: new Date(),
                     roles,
                 },
-            };
-            const user = await Users.findOneAndUpdate(generateDbFilterById(_id), modifier, {
-                returnDocument: 'after',
-            });
+            }, { returnDocument: 'after' });
             if (!user)
                 return null;
             await emit('USER_UPDATE_ROLE', {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@unchainedshop/core-users",
   "description": "User management module for the Unchained Engine with authentication support",
-  "version": "4.8.25",
+  "version": "4.8.27",
   "main": "lib/users-index.js",
   "types": "lib/users-index.d.ts",
   "type": "module",
@@ -36,10 +36,10 @@
   "homepage": "https://github.com/unchainedshop/unchained#readme",
   "dependencies": {
     "@passwordless-id/webauthn": "^2.3.1",
-    "@unchainedshop/events": "^4.8.12",
-    "@unchainedshop/logger": "^4.8.12",
-    "@unchainedshop/mongodb": "^4.8.12",
-    "@unchainedshop/utils": "^4.8.12",
+    "@unchainedshop/events": "^4.8.27",
+    "@unchainedshop/logger": "^4.8.27",
+    "@unchainedshop/mongodb": "^4.8.27",
+    "@unchainedshop/utils": "^4.8.27",
     "bcryptjs": "^3.0.2"
   },
   "peerDependencies": {