john-okeefe
481adaa71e
- Add role-based restrictions to POST /api/auth/register endpoint - Only admins can create admin accounts if any admin already exists - First user automatically gets admin role regardless of request - Regular users can only create user accounts, not admin accounts - Unauthenticated users can only create first admin, not subsequent admins - Reorganize Bruno collection into logical subfolders (auth/, admin/, profile/) - Update documentation to reflect new registration restrictions and security rules BREAKING CHANGES: - /api/auth/register now enforces role-based creation restrictions - Bruno collection reorganized with subfolder structure
81 lines
2.1 KiB
Plaintext
81 lines
2.1 KiB
Plaintext
meta {
|
|
name: Register Admin User
|
|
type: http
|
|
seq: 4
|
|
}
|
|
|
|
post {
|
|
url: {{base_url}}/api/auth/register
|
|
body: json
|
|
auth: inherit
|
|
}
|
|
|
|
body:json {
|
|
{
|
|
"email": "admin@example.com",
|
|
"username": "admin",
|
|
"password": "admin123",
|
|
"first_name": "Admin",
|
|
"last_name": "User",
|
|
"role": "admin"
|
|
}
|
|
}
|
|
|
|
script:post-response {
|
|
function onResponse(res) {
|
|
let data = res.getBody();
|
|
return bru.setEnvVar("token", data.token, { persist: true });
|
|
}
|
|
onResponse(res);
|
|
}
|
|
|
|
settings {
|
|
encodeUrl: true
|
|
timeout: 0
|
|
}
|
|
|
|
docs {
|
|
## Register Admin User
|
|
|
|
Creates a new admin user account with role-based restrictions.
|
|
|
|
**Method:** POST
|
|
|
|
**Endpoint:** /api/auth/register
|
|
|
|
**Request Body:**
|
|
- `email` (string): Email address
|
|
- `username` (string): Username
|
|
- `password` (string): Password
|
|
- `first_name` (string, optional): First name
|
|
- `last_name` (string, optional): Last name
|
|
- `role` (string): Must be "admin"
|
|
|
|
**Response:**
|
|
- `token` (string): JWT token with admin role
|
|
- `user` (object): User details
|
|
- `id` (string): User ID
|
|
- `email` (string): Email
|
|
- `username` (string): Username
|
|
- `theme` (string): User theme preference
|
|
- `first_name` (string, optional): First name
|
|
- `last_name` (string, optional): Last name
|
|
- `role` (string): User role ("admin")
|
|
|
|
**Status Codes:**
|
|
- 201: Created
|
|
- 400: Invalid input data
|
|
- 403: Forbidden - admin creation restrictions apply
|
|
- 409: User exists
|
|
|
|
**Role Restrictions:**
|
|
- **First User**: Anyone can create first admin (auto-assigned)
|
|
- **Existing Admins Present**: Only authenticated admins can create new admin accounts
|
|
- **Unauthenticated Users**: Cannot create admin accounts if any admin exists
|
|
- **Security**: Requires admin authentication for subsequent admin creation
|
|
|
|
**Usage Notes:**
|
|
- Use this request only when specifically creating admin accounts
|
|
- For regular user creation, use "Register User" request
|
|
- Admin token will have elevated privileges for administrative operations
|
|
} |