harden admin api authorization and add authz regression tests

apps/admin/src/app/api/users/__tests__/delete-authz.test.ts

@@ -0,0 +1,109 @@
+/**
+ * @jest-environment node
+ */
+
+import { NextRequest } from "next/server";
+import { DELETE } from "../route";
+
+jest.mock("@clerk/nextjs/server", () => ({
+  auth: jest.fn(),
+  clerkClient: jest.fn(),
+}));
+
+jest.mock("@/lib/database/index", () => ({
+  getDatabase: jest.fn(),
+}));
+
+jest.mock("@/lib/sync-user", () => ({
+  ensureUserSynced: jest.fn(),
+}));
+
+jest.mock("@fitai/database", () => ({
+  db: {
+    all: jest.fn(),
+    get: jest.fn(),
+    run: jest.fn(),
+  },
+  sql: jest.fn((strings: TemplateStringsArray) => strings.join("")),
+}));
+
+jest.mock("@/lib/logger", () => ({
+  info: jest.fn(),
+  warn: jest.fn(),
+  error: jest.fn(),
+  debug: jest.fn(),
+}));
+
+describe("DELETE /api/users authz", () => {
+  const mockAuth = require("@clerk/nextjs/server").auth as jest.Mock;
+  const mockGetDatabase = require("@/lib/database/index")
+    .getDatabase as jest.Mock;
+  const mockEnsureUserSynced = require("@/lib/sync-user")
+    .ensureUserSynced as jest.Mock;
+
+  const mockDb = {
+    getUserById: jest.fn(),
+    deleteUser: jest.fn(),
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockGetDatabase.mockResolvedValue(mockDb);
+  });
+
+  it("blocks self deletion", async () => {
+    mockAuth.mockResolvedValue({ userId: "admin_1" });
+    mockEnsureUserSynced.mockResolvedValue({
+      id: "admin_1",
+      role: "admin",
+      gymId: "gym_a",
+    });
+
+    const request = new NextRequest("http://localhost/api/users?id=admin_1", {
+      method: "DELETE",
+    });
+
+    const response = await DELETE(request);
+    expect(response.status).toBe(403);
+    expect(mockDb.deleteUser).not.toHaveBeenCalled();
+  });
+
+  it("blocks cross-gym deletion for admin", async () => {
+    mockAuth.mockResolvedValue({ userId: "admin_1" });
+    mockEnsureUserSynced.mockResolvedValue({
+      id: "admin_1",
+      role: "admin",
+      gymId: "gym_a",
+    });
+    mockDb.getUserById.mockResolvedValue({ id: "user_2", gymId: "gym_b" });
+
+    const request = new NextRequest("http://localhost/api/users?id=user_2", {
+      method: "DELETE",
+    });
+
+    const response = await DELETE(request);
+    expect(response.status).toBe(403);
+    expect(mockDb.deleteUser).not.toHaveBeenCalled();
+  });
+
+  it("allows superAdmin cross-gym deletion", async () => {
+    mockAuth.mockResolvedValue({ userId: "super_1" });
+    mockEnsureUserSynced.mockResolvedValue({
+      id: "super_1",
+      role: "superAdmin",
+      gymId: null,
+    });
+    mockDb.getUserById.mockResolvedValue({ id: "user_2", gymId: "gym_b" });
+
+    const request = new NextRequest("http://localhost/api/users?id=user_2", {
+      method: "DELETE",
+    });
+
+    const response = await DELETE(request);
+    const payload = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(payload.success).toBe(true);
+    expect(mockDb.deleteUser).toHaveBeenCalledWith("user_2");
+  });
+});

apps/admin/src/app/api/users/route.ts

@@ -580,26 +580,76 @@ export async function PUT(request: NextRequest) {
 
 export async function DELETE(request: NextRequest) {
   try {
+    const { userId: clerkUserId } = await auth();
+    if (!clerkUserId) {
+      return unauthorizedResponse();
+    }
+
     const db = await getDatabase();
+    const currentUser = await ensureUserSynced(clerkUserId, db);
+
+    if (!currentUser) {
+      return forbiddenResponse("Current user not found");
+    }
+
+    const canDeleteUsers =
+      currentUser.role === "admin" || currentUser.role === "superAdmin";
+
+    if (!canDeleteUsers) {
+      return forbiddenResponse("Only admins can delete users");
+    }
+
     const { searchParams } = new URL(request.url);
     const id = searchParams.get("id");
     const body = await request.json().catch(() => ({}));
     const { ids } = body;
 
+    const targetIds: string[] = Array.isArray(ids)
+      ? ids.filter(
+          (userId: unknown): userId is string => typeof userId === "string",
+        )
+      : id
+        ? [id]
+        : [];
+
+    if (targetIds.length === 0) {
+      return badRequestResponse("User ID or IDs array required");
+    }
+
+    if (targetIds.includes(clerkUserId)) {
+      return forbiddenResponse("Cannot delete your own account");
+    }
+
+    const targetUsers = await Promise.all(
+      targetIds.map((targetId) => db.getUserById(targetId)),
+    );
+
+    const missingTargets = targetUsers.filter((user) => !user).length;
+    if (missingTargets > 0) {
+      return notFoundResponse("One or more users were not found");
+    }
+
+    if (currentUser.role !== "superAdmin") {
+      if (!currentUser.gymId) {
+        return forbiddenResponse("No gym assigned to current user");
+      }
+
+      const hasCrossGymTarget = targetUsers.some(
+        (targetUser) => targetUser && targetUser.gymId !== currentUser.gymId,
+      );
+
+      if (hasCrossGymTarget) {
+        return forbiddenResponse("Cannot delete users from other gyms");
+      }
+    }
+
     if (ids && Array.isArray(ids)) {
       // Bulk delete
       await Promise.all(ids.map((userId: string) => db.deleteUser(userId)));
       return successResponse({ deleted: ids.length });
-    } else if (id) {
-      // Single delete
-      const user = await db.getUserById(id);
-      if (!user) {
-        return notFoundResponse("User not found");
-      }
-      await db.deleteUser(id);
-      return successResponse({ deleted: 1 });
     } else {
-      return badRequestResponse("User ID or IDs array required");
+      await db.deleteUser(id as string);
+      return successResponse({ deleted: 1 });
     }
   } catch (error) {
     log.error("Failed to delete user(s)", error);