fab-manager/app/controllers/api/admins_controller.rb

# frozen_string_literal: true

# API Controller for resources of type User with role 'admin'.
class API::AdminsController < API::ApiController
  before_action :authenticate_user!

  def index
    authorize :admin
    @admins = User.includes(profile: [:user_avatar]).admins
  end

  def create
    authorize :admin
    generated_password = Devise.friendly_token.first(8)
    @admin = User.new(admin_params.merge(password: generated_password))
    @admin.send :set_slug

    # we associate the admin group to prevent linking any other 'normal' group (which won't be deletable afterwards)
    @admin.group = Group.find_by(slug: 'admins')

    # if the authentication is made through an SSO, generate a migration token
    @admin.generate_auth_migration_token unless AuthProvider.active.providable_type == DatabaseProvider.name

    if @admin.save(validate: false)
      @admin.send_confirmation_instructions
      @admin.add_role(:admin)
      @admin.remove_role(:member)
      UsersMailer.delay.notify_user_account_created(@admin, generated_password)
      render :create, status: :created
    else
      render json: @admin.errors.full_messages, status: :unprocessable_entity
    end
  end

  def destroy
    @admin = User.admins.find(params[:id])
    if current_user.admin? && @admin != current_user
      @admin.destroy
      head :no_content
    else
      head :unauthorized
    end
  end

  private

  def admin_params
    params.require(:admin).permit(
      :username, :email,
      profile_attributes: %i[first_name last_name gender birthday phone],
      invoicing_profile_attributes: [address_attributes: [:address]]
    )
  end
end