john-okeefe
481adaa71e
- Add role-based restrictions to POST /api/auth/register endpoint - Only admins can create admin accounts if any admin already exists - First user automatically gets admin role regardless of request - Regular users can only create user accounts, not admin accounts - Unauthenticated users can only create first admin, not subsequent admins - Reorganize Bruno collection into logical subfolders (auth/, admin/, profile/) - Update documentation to reflect new registration restrictions and security rules BREAKING CHANGES: - /api/auth/register now enforces role-based creation restrictions - Bruno collection reorganized with subfolder structure
54 lines
1.4 KiB
Plaintext
54 lines
1.4 KiB
Plaintext
meta {
|
|
name: Delete User Account (Admin)
|
|
type: http
|
|
seq: 6
|
|
}
|
|
|
|
delete {
|
|
url: {{base_url}}/api/auth/account?user_id={{user_id}}
|
|
body: none
|
|
auth: inherit
|
|
}
|
|
|
|
settings {
|
|
encodeUrl: true
|
|
timeout: 0
|
|
}
|
|
|
|
docs {
|
|
## Delete User Account (Admin)
|
|
|
|
Allows administrators to delete any user account by specifying user_id parameter.
|
|
|
|
**Method:** DELETE
|
|
|
|
**Endpoint:** /api/auth/account?user_id={user_id}
|
|
|
|
**Authentication:** Required (Admin only)
|
|
|
|
**Query Parameters:**
|
|
- `user_id` (string, required for admin): UUID of the user account to delete
|
|
|
|
**Usage Examples:**
|
|
- **Self-deletion**: DELETE /api/auth/account (no user_id parameter)
|
|
- **Admin deletion**: DELETE /api/auth/account?user_id=550e8400-e29b-41d4-a716-446655440000
|
|
|
|
**Response:**
|
|
- `message` (string): Success message indicating which account was deleted
|
|
|
|
**Status Codes:**
|
|
- 200: Success
|
|
- 400: Bad Request (invalid user_id or attempting to delete last admin)
|
|
- 401: Unauthorized
|
|
- 403: Forbidden (admin access required for user_id parameter)
|
|
- 404: Not Found (user does not exist)
|
|
|
|
**Admin Protection Rules:**
|
|
- Regular users can only delete their own account (no user_id parameter allowed)
|
|
- Admins can delete any account including their own
|
|
- Cannot delete the last admin account in the system
|
|
- Admin role required to use user_id parameter
|
|
|
|
**Variables:**
|
|
- `user_id`: Set this to the UUID of the user you want to delete
|
|
} |