multi-tenant relay und card-push to user

relay/inc/routes/admin.php

@@ -0,0 +1,98 @@
+<?php
+// Admin-only routes (session + is_admin):
+//   GET    /api/users
+//   POST   /api/users
+//   PATCH  /api/users/{id}
+//   DELETE /api/users/{id}
+//
+// Plus the tenant directory available to any logged-in user:
+//   GET    /api/tenants
+
+if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
+
+// $sessionTenant is set by routes/public.php earlier in the chain
+
+if ($route === '/api/users' && $method === 'GET') {
+    if (!$sessionTenant || !$sessionTenant['is_admin']) jsonResponse(['error' => 'admin only'], 403);
+    $rows = $db->query('SELECT id, username, is_admin, created_at FROM tenants ORDER BY id ASC')->fetchAll();
+    jsonResponse(['users' => $rows]);
+}
+
+if ($route === '/api/users' && $method === 'POST') {
+    if (!$sessionTenant || !$sessionTenant['is_admin']) jsonResponse(['error' => 'admin only'], 403);
+    $input = json_decode(file_get_contents('php://input'), true) ?: [];
+    $username = trim((string)($input['username'] ?? ''));
+    $password = (string)($input['password'] ?? '');
+    $isAdmin = !empty($input['is_admin']) ? 1 : 0;
+
+    if (!preg_match('/^[a-zA-Z0-9_-]{2,32}$/', $username)) {
+        jsonResponse(['error' => 'username must be 2-32 chars: letters, digits, _ or -'], 400);
+    }
+    if (strlen($password) < 4) jsonResponse(['error' => 'password must be at least 4 chars'], 400);
+    if (getTenantByUsername($db, $username)) jsonResponse(['error' => 'username already exists'], 409);
+
+    // No client secret — the new user sets that themselves after first login
+    // via the account view. password_hash is bcrypted; secret columns stay NULL.
+    // password_changed = 0 forces a password change on first login (the
+    // admin-supplied password is meant as a temporary credential).
+    // Admin-flagged users still need to change because the admin set it.
+    $db->prepare('INSERT INTO tenants (username, password_hash, is_admin, password_changed) VALUES (:u, :p, :a, 0)')
+        ->execute([
+            'u' => $username,
+            'p' => password_hash($password, PASSWORD_BCRYPT),
+            'a' => $isAdmin,
+        ]);
+    jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId()]);
+}
+
+if (preg_match('#^/api/users/(\d+)$#', $route, $m) && $method === 'PATCH') {
+    if (!$sessionTenant || !$sessionTenant['is_admin']) jsonResponse(['error' => 'admin only'], 403);
+    $id = (int)$m[1];
+    $target = getTenantById($db, $id);
+    if (!$target) jsonResponse(['error' => 'user not found'], 404);
+    $input = json_decode(file_get_contents('php://input'), true) ?: [];
+    $fields = []; $params = ['id' => $id];
+    if (!empty($input['password'])) {
+        if (strlen($input['password']) < 4) jsonResponse(['error' => 'password too short'], 400);
+        $fields[] = 'password_hash = :pw';
+        $params['pw'] = password_hash($input['password'], PASSWORD_BCRYPT);
+    }
+    if (array_key_exists('is_admin', $input)) {
+        if (!$input['is_admin'] && $target['is_admin'] && adminCount($db) <= 1) {
+            jsonResponse(['error' => 'cannot demote the last admin'], 400);
+        }
+        $fields[] = 'is_admin = :ad';
+        $params['ad'] = $input['is_admin'] ? 1 : 0;
+    }
+    // Note: client secret is set by the user themselves via /api/account/secret,
+    // not by the admin. Admins can only reset password and toggle admin flag.
+    if (!$fields) jsonResponse(['ok' => true]);
+    $db->prepare('UPDATE tenants SET ' . implode(', ', $fields) . ' WHERE id = :id')->execute($params);
+    jsonResponse(['ok' => true]);
+}
+
+if (preg_match('#^/api/users/(\d+)$#', $route, $m) && $method === 'DELETE') {
+    if (!$sessionTenant || !$sessionTenant['is_admin']) jsonResponse(['error' => 'admin only'], 403);
+    $id = (int)$m[1];
+    $target = getTenantById($db, $id);
+    if (!$target) jsonResponse(['error' => 'user not found'], 404);
+    if ($target['is_admin'] && adminCount($db) <= 1) {
+        jsonResponse(['error' => 'cannot delete the last admin'], 400);
+    }
+    if ($id === (int)$sessionTenant['id']) {
+        jsonResponse(['error' => 'cannot delete yourself'], 400);
+    }
+    $db->prepare('DELETE FROM tenants WHERE id = :id')->execute(['id' => $id]);
+    jsonResponse(['ok' => true]);
+}
+
+// ── Tenant directory (visible to all authenticated tenants) ──────
+// Accepts both UI session auth and client API headers, so hyprcrd
+// instances can fetch the list to populate their recipient picker.
+
+if ($route === '/api/tenants' && $method === 'GET') {
+    $authedTenant = $sessionTenant ?: authClient($db);
+    if (!$authedTenant) jsonResponse(['error' => 'unauthorized'], 401);
+    $rows = $db->query('SELECT id, username FROM tenants ORDER BY username ASC')->fetchAll();
+    jsonResponse(['tenants' => $rows, 'self' => $authedTenant['username']]);
+}