mirror of
https://github.com/LaCasemate/fab-manager.git
synced 2024-12-01 12:24:28 +01:00
52 lines
1.6 KiB
Ruby
52 lines
1.6 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
# API Controller for resources of type User with role 'admin'.
|
|
class API::AdminsController < API::ApiController
|
|
before_action :authenticate_user!
|
|
|
|
def index
|
|
authorize :admin
|
|
@admins = User.includes(profile: [:user_avatar]).admins
|
|
end
|
|
|
|
def create
|
|
authorize :admin
|
|
generated_password = Devise.friendly_token.first(8)
|
|
@admin = User.new(admin_params.merge(password: generated_password))
|
|
@admin.send :set_slug
|
|
|
|
# we associate the admin group to prevent linking any other 'normal' group (which won't be deletable afterwards)
|
|
@admin.group = Group.find_by(slug: 'admins')
|
|
|
|
# if the authentication is made through an SSO, generate a migration token
|
|
@admin.generate_auth_migration_token unless AuthProvider.active.providable_type == DatabaseProvider.name
|
|
|
|
if @admin.save(validate: false)
|
|
@admin.send_confirmation_instructions
|
|
@admin.add_role(:admin)
|
|
@admin.remove_role(:member)
|
|
UsersMailer.delay.notify_user_account_created(@admin, generated_password)
|
|
render :create, status: :created
|
|
else
|
|
render json: @admin.errors.full_messages, status: :unprocessable_entity
|
|
end
|
|
end
|
|
|
|
def destroy
|
|
@admin = User.admins.find(params[:id])
|
|
if current_user.admin? && @admin != current_user
|
|
@admin.destroy
|
|
head :no_content
|
|
else
|
|
head :unauthorized
|
|
end
|
|
end
|
|
|
|
private
|
|
|
|
def admin_params
|
|
params.require(:admin).permit(:username, :email, profile_attributes: [:first_name, :last_name, :gender,
|
|
:birthday, :phone, address_attributes: [:address]])
|
|
end
|
|
end
|