Admin User Management

curl "https://your-domain.vercel.app/api/admin/users?search=john&role=member&page=1&perPage=25" \
  -H "Authorization: Bearer YOUR_ADMIN_TOKEN"

{
  "error": "You cannot remove your own admin access."
}

{
  "error": "At least one admin user must remain."
}

{
  "error": "Concurrent admin change detected. At least one admin must remain."
}

if (targetIsAdmin && userType !== 'admin') {
  const postUpdateAdminCount = await getAdminCount(client)
  if (postUpdateAdminCount < 1) {
    // Rollback: revert to admin
    await client.auth.admin.updateUserById(userId, {
      app_metadata: { user_type: 'admin' }
    })
    return { error: 'Concurrent admin change detected. At least one admin must remain.' }
  }
}

{
  "success": true
}

{
  "error": "User email not found."
}

{
  "error": "Unsupported action."
}

{
  "success": true
}

{
  "error": "You cannot delete your own account from this panel."
}

{
  "error": "At least one admin user must remain."
}

{
  "error": "User not found."
}

import { useState, useEffect } from 'react'
import { useSupabaseClient } from '@/hooks/useSupabase'

export function UserManagement() {
  const [users, setUsers] = useState([])
  const [stats, setStats] = useState(null)
  const [loading, setLoading] = useState(true)
  const supabase = useSupabaseClient()
  
  const fetchUsers = async (page = 1, search = '') => {
    setLoading(true)
    
    const { data: { session } } = await supabase.auth.getSession()
    
    const params = new URLSearchParams({
      page: page.toString(),
      perPage: '25',
      search,
      role: 'all',
      confirmation: 'all'
    })
    
    const response = await fetch(`/api/admin/users?${params}`, {
      headers: {
        'Authorization': `Bearer ${session.access_token}`
      }
    })
    
    const data = await response.json()
    setUsers(data.users)
    setStats(data.stats)
    setLoading(false)
  }
  
  const promoteToAdmin = async (userId) => {
    const { data: { session } } = await supabase.auth.getSession()
    
    const response = await fetch('/api/admin/users', {
      method: 'PATCH',
      headers: {
        'Authorization': `Bearer ${session.access_token}`,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({ userId, userType: 'admin' })
    })
    
    if (response.ok) {
      await fetchUsers()
    } else {
      const { error } = await response.json()
      alert(error)
    }
  }
  
  const sendPasswordReset = async (userId) => {
    const { data: { session } } = await supabase.auth.getSession()
    
    const response = await fetch('/api/admin/users', {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${session.access_token}`,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        action: 'send_password_reset',
        userId
      })
    })
    
    if (response.ok) {
      alert('Password reset email sent')
    }
  }
  
  const deleteUser = async (userId) => {
    if (!confirm('Are you sure you want to delete this user?')) return
    
    const { data: { session } } = await supabase.auth.getSession()
    
    const response = await fetch(`/api/admin/users?userId=${userId}`, {
      method: 'DELETE',
      headers: {
        'Authorization': `Bearer ${session.access_token}`
      }
    })
    
    if (response.ok) {
      await fetchUsers()
    } else {
      const { error } = await response.json()
      alert(error)
    }
  }
  
  useEffect(() => {
    fetchUsers()
  }, [])
  
  if (loading) return <div>Loading...</div>
  
  return (
    <div>
      <h1>User Management</h1>
      
      {stats && (
        <div className="stats">
          <p>Total Users: {stats.totalUsers}</p>
          <p>Admins: {stats.adminUsers}</p>
          <p>Active (7d): {stats.recentlyActiveUsers7d}</p>
        </div>
      )}
      
      <table>
        <thead>
          <tr>
            <th>Email</th>
            <th>Role</th>
            <th>Last Sign In</th>
            <th>Actions</th>
          </tr>
        </thead>
        <tbody>
          {users.map(user => (
            <tr key={user.id}>
              <td>{user.email}</td>
              <td>{user.userType}</td>
              <td>{user.lastSignInAt ? new Date(user.lastSignInAt).toLocaleDateString() : 'Never'}</td>
              <td>
                {user.userType === 'member' && (
                  <button onClick={() => promoteToAdmin(user.id)}>Promote to Admin</button>
                )}
                <button onClick={() => sendPasswordReset(user.id)}>Reset Password</button>
                <button onClick={() => deleteUser(user.id)}>Delete</button>
              </td>
            </tr>
          ))}
        </tbody>
      </table>
    </div>
  )
}