Module: User Management
├─ MANAGE_USERS          Create, update, delete users, ban/suspend

Module: Vendor Management
├─ MANAGE_VENDORS        Approve/reject vendors, manage status

Module: Product Management
├─ MANAGE_PRODUCTS       Approve products, edit, manage inventory
└─ MANAGE_CATEGORIES     Manage product categories

Module: Order Management
├─ MANAGE_ORDERS         View, update, cancel orders
└─ MANAGE_PRESCRIPTIONS  Verify prescriptions for orders

Module: Financial
├─ MANAGE_REFUNDS        Process refunds, handle disputes
└─ MANAGE_PAYOUTS        Process vendor payouts

Module: Promotions
└─ MANAGE_COUPONS        Create, edit, manage promotional codes

Module: Content & Compliance
├─ MANAGE_REVIEWS        Moderate product reviews
└─ MANAGE_SETTINGS       Change system settings & configs

Module: Analytics
└─ VIEW_ANALYTICS        Access platform analytics & reports

┌─────────────────────────────────────────────────────────────┐
│ 1. Super Admin Requests Admin Creation                      │
│    POST /api/admin/create                                   │
│    • Phone number                                           │
│    • Email address                                          │
│    • Basic information                                      │
│    • Permissions to assign                                  │
└────────────────┬────────────────────────────────────────────┘
                 │
                 ▼
┌─────────────────────────────────────────────────────────────┐
│ 2. Validation                                               │
│    • Phone format validation                                │
│    • Email format validation                                │
│    • Permissions enum validation                            │
└────────────────┬────────────────────────────────────────────┘
                 │
                 ▼
┌─────────────────────────────────────────────────────────────┐
│ 3. Check if User Exists                                     │
│    ├─ YES: User found (CUSTOMER/VENDOR role)                │
│    │   └─ Update existing user to ADMIN role                │
│    │      └─ Create or update AdminProfile                  │
│    │         └─ Assign permissions                          │
│    │                                                         │
│    └─ NO: User doesn't exist                                │
│       └─ Create new user with ADMIN role                    │
│          └─ Create AdminProfile                             │
│             └─ Assign permissions                           │
└────────────────┬────────────────────────────────────────────┘
                 │
                 ▼
┌─────────────────────────────────────────────────────────────┐
│ 4. Activity Logged                                          │
│    • Admin creation/update logged                           │
│    • Super admin ID recorded                                │
│    • Permissions logged                                     │
│    • Timestamp recorded                                     │
│    • Action: CREATE_ADMIN or UPDATE_USER_TO_ADMIN          │
└────────────────┬────────────────────────────────────────────┘
                 │
                 ▼
┌─────────────────────────────────────────────────────────────┐
│ 5. Admin Ready to Use                                       │
│    • Can login immediately                                  │
│    • Permissions active                                     │
│    • Dashboard access enabled                               │
│    • Status: ACTIVE                                         │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│ Super Admin Views All Admins                                │
│ GET /api/admin/all                                          │
│ Returns: List of all admins with current permissions        │
└────────────────┬────────────────────────────────────────────┘
                 │
        ┌────────┴──────────┐
        │                   │
        ▼                   ▼
    UPDATE          DEACTIVATE
    PERMISSIONS     / ACTIVATE
        │                   │
        ▼                   ▼
  PUT /api/admin      PUT /api/admin
  /:adminId/           /:adminId/
  permissions          status
        │                   │
        ▼                   ▼
  Permissions      Admin can login?
  Updated          NO - Deactivated
  Activity Logged  YES - Activated

📁 Backend Structure
├── src/
│   ├── modules/
│   │   └── admin/
│   │       ├── admin.controller.ts      (Request handling)
│   │       ├── admin.service.ts         (Business logic)
│   │       ├── admin.validation.ts      (Input validation)
│   │       └── admin.route.ts           (API routes)
│   │
│   ├── middleware/
│   │   ├── requireAuth.ts               (Authentication check)
│   │   ├── requireAdmin.ts              (Admin role check)
│   │   └── requirePermission.ts         (Permission check)
│   │
│   ├── db/
│   │   └── prismaClient.ts              (Database connection)
│   │
│   └── utils/
│       └── asyncHandler.ts              (Error handling wrapper)
│
├── prisma/
│   ├── schema.prisma                    (Database schema)
│   └── migrations/
│       └── [timestamp]_admin_system/
│           └── migration.sql
│
└── docs/
    └── ADMIN_MANAGEMENT.md              (This file)

Request
   │
   ▼
Router (admin.route.ts)
   │
   ├─ requireAuth middleware
   │  └─ Verify user is logged in
   │
   ├─ requireAdmin middleware
   │  └─ Verify user is ADMIN/SUPER_ADMIN with active profile
   │
   ├─ requirePermission middleware (if needed)
   │  └─ Verify user has specific permission
   │
   ▼
Controller (admin.controller.ts)
   │
   ├─ Input validation (Zod schema)
   │
   ▼
Service (admin.service.ts)
   │
   ├─ Database queries
   ├─ Business logic
   ├─ Transaction management
   ├─ Activity logging
   │
   ▼
Database (PostgreSQL)
   │
   ├─ User table
   ├─ AdminProfile table
   └─ AdminActivityLog table
   │
   ▼
Response to Client

{
  "phone": "9876543210",
  "countryCode": "91",
  "email": "admin@flickxir.com",
  "firstName": "John",
  "lastName": "Doe",
  "designation": "Vendor Manager",
  "department": "Operations",
  "permissions": ["MANAGE_VENDORS", "MANAGE_PRODUCTS", "MANAGE_ORDERS"]
}

{
  "ok": true,
  "message": "Admin created successfully",
  "admin": {
    "id": "cm3xyz789ghi012",
    "phone": "9876543210",
    "email": "admin@flickxir.com",
    "firstName": "John",
    "lastName": "Doe",
    "role": "ADMIN",
    "status": "ACTIVE"
  },
  "adminProfile": {
    "id": "cm7abc123def456",
    "designation": "Vendor Manager",
    "department": "Operations",
    "permissions": ["MANAGE_VENDORS", "MANAGE_PRODUCTS", "MANAGE_ORDERS"],
    "isActive": true,
    "createdAt": "2025-11-01T10:30:00Z"
  }
}

{
  "ok": false,
  "message": "Invalid phone number format",
  "status": 400
}

{
  "ok": true,
  "total": 5,
  "admins": [
    {
      "id": "cm3xyz789ghi012",
      "phone": "9876543210",
      "email": "admin@flickxir.com",
      "firstName": "John",
      "lastName": "Doe",
      "designation": "Vendor Manager",
      "department": "Operations",
      "permissions": ["MANAGE_VENDORS", "MANAGE_PRODUCTS", "MANAGE_ORDERS"],
      "isActive": true,
      "createdAt": "2025-11-01T10:30:00Z",
      "updatedAt": "2025-11-01T10:30:00Z"
    }
  ]
}

{
  "ok": true,
  "admin": {
    "id": "cm3xyz789ghi012",
    "phone": "9876543210",
    "email": "admin@flickxir.com",
    "firstName": "John",
    "lastName": "Doe",
    "role": "ADMIN",
    "status": "ACTIVE"
  },
  "adminProfile": {
    "id": "cm7abc123def456",
    "userId": "cm3xyz789ghi012",
    "designation": "Vendor Manager",
    "department": "Operations",
    "permissions": ["MANAGE_VENDORS", "MANAGE_PRODUCTS", "MANAGE_ORDERS"],
    "isActive": true,
    "createdAt": "2025-11-01T10:30:00Z"
  }
}

?phone=9876543210

{
  "ok": true,
  "admin": {
    "id": "cm3xyz789ghi012",
    "phone": "9876543210",
    "email": "admin@flickxir.com",
    "firstName": "John",
    "lastName": "Doe",
    "role": "ADMIN",
    "status": "ACTIVE"
  },
  "adminProfile": {
    "id": "cm7abc123def456",
    "userId": "cm3xyz789ghi012",
    "designation": "Vendor Manager",
    "department": "Operations",
    "permissions": ["MANAGE_VENDORS", "MANAGE_PRODUCTS", "MANAGE_ORDERS"],
    "isActive": true,
    "createdAt": "2025-11-01T10:30:00Z"
  }
}

{
  "ok": false,
  "message": "Admin not found",
  "status": 404
}

{
  "permissions": [
    "MANAGE_VENDORS",
    "MANAGE_PRODUCTS",
    "MANAGE_CATEGORIES",
    "MANAGE_ORDERS",
    "MANAGE_REFUNDS"
  ]
}

{
  "ok": true,
  "message": "Admin permissions updated successfully",
  "adminProfile": {
    "id": "cm7abc123def456",
    "permissions": [
      "MANAGE_VENDORS",
      "MANAGE_PRODUCTS",
      "MANAGE_CATEGORIES",
      "MANAGE_ORDERS",
      "MANAGE_REFUNDS"
    ]
  }
}

{
  "isActive": false
}

{
  "ok": true,
  "message": "Admin status updated successfully",
  "admin": {
    "id": "cm3xyz789ghi012",
    "email": "admin@flickxir.com",
    "isActive": false
  }
}

{
  "email": "newemail@flickxir.com",
  "firstName": "Jane",
  "lastName": "Smith",
  "designation": "Senior Vendor Manager",
  "department": "Vendor Management"
}

{
  "ok": true,
  "message": "Admin updated successfully",
  "admin": {
    "id": "cm3xyz789ghi012",
    "email": "newemail@flickxir.com",
    "firstName": "Jane",
    "lastName": "Smith"
  },
  "adminProfile": {
    "designation": "Senior Vendor Manager",
    "department": "Vendor Management"
  }
}

{
  "ok": true,
  "message": "Admin deleted successfully",
  "adminId": "cm3xyz789ghi012"
}

?limit=50&offset=0&adminId=cm3xyz789ghi012

{
  "ok": true,
  "total": 10,
  "logs": [
    {
      "id": "log123",
      "adminId": "superadmin456",
      "action": "CREATE_ADMIN",
      "module": "ADMIN",
      "entityId": "cm3xyz789ghi012",
      "description": "Created admin: John Doe",
      "ipAddress": "192.168.1.50",
      "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
      "metadata": {
        "email": "admin@flickxir.com",
        "permissions": ["MANAGE_VENDORS", "MANAGE_PRODUCTS"]
      },
      "createdAt": "2025-11-01T11:16:03Z"
    },
    {
      "id": "log124",
      "adminId": "superadmin456",
      "action": "UPDATE_ADMIN_PERMISSIONS",
      "module": "ADMIN",
      "entityId": "cm3xyz789ghi012",
      "description": "Updated permissions for: John Doe",
      "metadata": {
        "oldPermissions": ["MANAGE_VENDORS"],
        "newPermissions": ["MANAGE_VENDORS", "MANAGE_PRODUCTS"]
      },
      "createdAt": "2025-11-01T11:20:00Z"
    }
  ]
}

enum UserRole {
  CUSTOMER
  VENDOR
  ADMIN
  SUPER_ADMIN
}

enum UserStatus {
  ACTIVE
  SUSPENDED
  PENDING_VERIFICATION
  BANNED
}

model User {
  id              String      @id @default(cuid())
  phone           String      @unique
  countryCode     String      @default("91")
  email           String?     @unique
  firstName       String?
  lastName        String?
  role            UserRole    @default(CUSTOMER)
  status          UserStatus  @default(PENDING_VERIFICATION)
  phoneVerified   Boolean     @default(false)
  // ... other fields

  adminProfile    AdminProfile?
}

model AdminProfile {
  id            String            @id @default(cuid())
  userId        String            @unique
  designation   String?
  department    String?
  permissions   AdminPermission[]
  isActive      Boolean           @default(true)
  createdAt     DateTime          @default(now())
  updatedAt     DateTime          @updatedAt

  user          User              @relation(fields: [userId], references: [id], onDelete: Cascade)
  activityLogs  AdminActivityLog[]

  @@index([userId])
  @@index([isActive])
}

model AdminActivityLog {
  id          String    @id @default(cuid())
  adminId     String
  action      String    // Admin action type (see Action Types below)
  module      String    // ADMIN
  entityId    String?   // ID of the affected admin
  description String?
  ipAddress   String?
  userAgent   String?
  metadata    Json?
  createdAt   DateTime  @default(now())

  admin       AdminProfile @relation(fields: [adminId], references: [id], onDelete: Cascade)

  @@index([adminId])
  @@index([action])
  @@index([module])
  @@index([createdAt])
}

{
  "email": "admin@example.com",
  "phone": "9876543210",
  "permissions": ["MANAGE_USERS", "MANAGE_VENDORS"],
  "previousRole": "CUSTOMER"
}

import z from "zod";

export const createAdminSchema = z.object({
  phone: z.string().min(10).max(15).regex(/^\d+$/, "Phone must be numeric"),
  countryCode: z.string().default("91"),
  email: z.string().email("Invalid email format"),
  firstName: z.string().min(2).max(50),
  lastName: z.string().min(2).max(50),
  designation: z.string().min(3).max(100),
  department: z.string().min(3).max(100),
  permissions: z
    .array(
      z.enum([
        "MANAGE_USERS",
        "MANAGE_VENDORS",
        "MANAGE_PRODUCTS",
        "MANAGE_ORDERS",
        "MANAGE_PRESCRIPTIONS",
        "MANAGE_REFUNDS",
        "MANAGE_COUPONS",
        "MANAGE_CATEGORIES",
        "MANAGE_REVIEWS",
        "MANAGE_PAYOUTS",
        "VIEW_ANALYTICS",
        "MANAGE_SETTINGS",
      ])
    )
    .min(1, "At least one permission required")
    .max(12, "Cannot request more than 12 permissions"),
});

export const updatePermissionsSchema = z.object({
  permissions: z
    .array(
      z.enum([
        "MANAGE_USERS",
        "MANAGE_VENDORS",
        "MANAGE_PRODUCTS",
        "MANAGE_ORDERS",
        "MANAGE_PRESCRIPTIONS",
        "MANAGE_REFUNDS",
        "MANAGE_COUPONS",
        "MANAGE_CATEGORIES",
        "MANAGE_REVIEWS",
        "MANAGE_PAYOUTS",
        "VIEW_ANALYTICS",
        "MANAGE_SETTINGS",
      ])
    )
    .min(1, "At least one permission required")
    .max(12, "Cannot request more than 12 permissions"),
});

export const updateAdminStatusSchema = z.object({
  isActive: z.boolean(),
});

export const updateAdminDetailsSchema = z.object({
  email: z.string().email("Invalid email format").optional(),
  firstName: z.string().min(2).max(50).optional(),
  lastName: z.string().min(2).max(50).optional(),
  designation: z.string().min(3).max(100).optional(),
  department: z.string().min(3).max(100).optional(),
});

import prisma from "../../db/prismaClient.js";
import type { AdminPermission } from "@prisma/client";

interface CreateAdminInput {
  phone: string;
  countryCode: string;
  email: string;
  firstName: string;
  lastName: string;
  designation: string;
  department: string;
  permissions: AdminPermission[];
}

interface UpdatePermissionsInput {
  permissions: AdminPermission[];
}

interface UpdateAdminStatusInput {
  isActive: boolean;
}

interface UpdateAdminDetailsInput {
  email?: string;
  firstName?: string;
  lastName?: string;
  designation?: string;
  department?: string;
}

class AdminService {
  /**
   * Create admin instantly - Update profile if user exists, create if not
   * If user already exists (CUSTOMER/VENDOR), convert to ADMIN
   * If user doesn't exist, create new ADMIN user
   */
  static async createAdmin(
    data: CreateAdminInput,
    superAdminId: string,
    ipAddress: string,
    userAgent: string
  ) {
    // Check if user already exists by phone
    let existingUser = await prisma.user.findUnique({
      where: { phone: data.phone },
      include: { adminProfile: true },
    });

    // Atomic transaction - create or update user and admin profile
    const result = await prisma.$transaction(async (tx) => {
      let user;
      let adminProfile;
      let action = "CREATE_ADMIN";

      if (existingUser) {
        // User exists - update to ADMIN role and update/create admin profile
        user = await tx.user.update({
          where: { id: existingUser.id },
          data: {
            role: "ADMIN",
            status: "ACTIVE",
            phoneVerified: true,
            // Update other fields if provided
            ...(data.email && { email: data.email }),
            ...(data.firstName && { firstName: data.firstName }),
            ...(data.lastName && { lastName: data.lastName }),
          },
        });

        // Check if admin profile exists
        if (existingUser.adminProfile) {
          // Update existing admin profile
          adminProfile = await tx.adminProfile.update({
            where: { userId: user.id },
            data: {
              designation: data.designation,
              department: data.department,
              permissions: data.permissions,
              isActive: true,
            },
          });
        } else {
          // Create new admin profile for existing user
          adminProfile = await tx.adminProfile.create({
            data: {
              userId: user.id,
              designation: data.designation,
              department: data.department,
              permissions: data.permissions,
              isActive: true,
            },
          });
        }

        action = "UPDATE_USER_TO_ADMIN";
      } else {
        // User doesn't exist - create new user with ADMIN role
        user = await tx.user.create({
          data: {
            phone: data.phone,
            countryCode: data.countryCode,
            email: data.email,
            firstName: data.firstName,
            lastName: data.lastName,
            role: "ADMIN",
            status: "ACTIVE",
            phoneVerified: true, // Admins are pre-verified
          },
        });

        // Create admin profile
        adminProfile = await tx.adminProfile.create({
          data: {
            userId: user.id,
            designation: data.designation,
            department: data.department,
            permissions: data.permissions,
            isActive: true,
          },
        });
      }

      // Log activity
      const superAdminProfile = await tx.adminProfile.findUnique({
        where: { userId: superAdminId },
      });

      if (superAdminProfile) {
        await tx.adminActivityLog.create({
          data: {
            adminId: superAdminProfile.id,
            action: action,
            module: "ADMIN",
            entityId: user.id,
            description: `${
              action === "CREATE_ADMIN" ? "Created" : "Updated"
            } admin: ${user.firstName} ${user.lastName}`,
            ipAddress,
            userAgent,
            metadata: {
              email: user.email,
              phone: user.phone,
              permissions: data.permissions,
              previousRole: existingUser?.role || null,
            },
          },
        });
      }

      return { user, adminProfile };
    });

    return result;
  }

  /**
   * Get all admins with their profiles and permissions
   */
  static async getAllAdmins(limit: number = 100, offset: number = 0) {
    const [admins, total] = await Promise.all([
      prisma.user.findMany({
        where: { role: "ADMIN" },
        select: {
          id: true,
          phone: true,
          email: true,
          firstName: true,
          lastName: true,
          role: true,
          status: true,
          createdAt: true,
          adminProfile: {
            select: {
              id: true,
              designation: true,
              department: true,
              permissions: true,
              isActive: true,
              createdAt: true,
              updatedAt: true,
            },
          },
        },
        orderBy: { createdAt: "desc" },
        take: limit,
        skip: offset,
      }),
      prisma.user.count({
        where: { role: "ADMIN" },
      }),
    ]);

    return { admins, total };
  }

  /**
   * Get single admin by ID
   */
  static async getAdminById(adminId: string) {
    const admin = await prisma.user.findUnique({
      where: { id: adminId, role: "ADMIN" },
      select: {
        id: true,
        phone: true,
        email: true,
        firstName: true,
        lastName: true,
        role: true,
        status: true,
        createdAt: true,
        updatedAt: true,
        adminProfile: {
          select: {
            id: true,
            designation: true,
            department: true,
            permissions: true,
            isActive: true,
            createdAt: true,
            updatedAt: true,
          },
        },
      },
    });

    if (!admin) {
      throw {
        status: 404,
        message: "Admin not found",
      };
    }

    return admin;
  }

  /**
   * Update admin permissions - Immediate effect
   */
  static async updatePermissions(
    adminId: string,
    data: UpdatePermissionsInput,
    superAdminId: string,
    ipAddress: string,
    userAgent: string
  ) {
    // Verify admin exists
    const adminProfile = await prisma.adminProfile.findUnique({
      where: { userId: adminId },
      select: { id: true, permissions: true },
    });

    if (!adminProfile) {
      throw {
        status: 404,
        message: "Admin not found",
      };
    }

    const oldPermissions = adminProfile.permissions;

    // Update permissions
    const updated = await prisma.adminProfile.update({
      where: { userId: adminId },
      data: {
        permissions: data.permissions,
      },
      select: {
        id: true,
        permissions: true,
        user: {
          select: { firstName: true, lastName: true, email: true },
        },
      },
    });

    // Log activity
    const superAdminProfile = await prisma.adminProfile.findUnique({
      where: { userId: superAdminId },
    });

    if (superAdminProfile) {
      await prisma.adminActivityLog.create({
        data: {
          adminId: superAdminProfile.id,
          action: "UPDATE_ADMIN_PERMISSIONS",
          module: "ADMIN",
          entityId: adminId,
          description: `Updated permissions for: ${updated.user.firstName} ${updated.user.lastName}`,
          ipAddress,
          userAgent,
          metadata: {
            email: updated.user.email,
            oldPermissions,
            newPermissions: data.permissions,
          },
        },
      });
    }

    return updated;
  }

  /**
   * Toggle admin active/inactive status
   */
  static async toggleAdminStatus(
    adminId: string,
    isActive: boolean,
    superAdminId: string,
    ipAddress: string,
    userAgent: string
  ) {
    // Verify admin exists
    const adminProfile = await prisma.adminProfile.findUnique({
      where: { userId: adminId },
      select: { isActive: true },
    });

    if (!adminProfile) {
      throw {
        status: 404,
        message: "Admin not found",
      };
    }

    // Update status
    const updated = await prisma.adminProfile.update({
      where: { userId: adminId },
      data: { isActive },
      select: {
        isActive: true,
        user: {
          select: { firstName: true, lastName: true, email: true },
        },
      },
    });

    // Log activity
    const superAdminProfile = await prisma.adminProfile.findUnique({
      where: { userId: superAdminId },
    });

    if (superAdminProfile) {
      const action = isActive ? "ACTIVATE_ADMIN" : "DEACTIVATE_ADMIN";
      await prisma.adminActivityLog.create({
        data: {
          adminId: superAdminProfile.id,
          action,
          module: "ADMIN",
          entityId: adminId,
          description: `${isActive ? "Activated" : "Deactivated"} admin: ${
            updated.user.firstName
          } ${updated.user.lastName}`,
          ipAddress,
          userAgent,
          metadata: {
            email: updated.user.email,
            status: isActive ? "ACTIVE" : "INACTIVE",
          },
        },
      });
    }

    return updated;
  }

  /**
   * Update admin details (email, name, designation, department)
   */
  static async updateAdminDetails(
    adminId: string,
    data: UpdateAdminDetailsInput,
    superAdminId: string,
    ipAddress: string,
    userAgent: string
  ) {
    // Verify admin exists
    const existingAdmin = await prisma.user.findUnique({
      where: { id: adminId, role: "ADMIN" },
      select: { id: true, email: true, firstName: true, lastName: true },
    });

    if (!existingAdmin) {
      throw {
        status: 404,
        message: "Admin not found",
      };
    }

    // Check if email is being updated and if it's already taken
    if (data.email && data.email !== existingAdmin.email) {
      const emailExists = await prisma.user.findUnique({
        where: { email: data.email },
      });

      if (emailExists) {
        throw {
          status: 400,
          message: "Email already in use",
        };
      }
    }

    // Atomic transaction for user and profile updates
    const result = await prisma.$transaction(async (tx) => {
      // Update user details
      const updatedUser = await tx.user.update({
        where: { id: adminId },
        data: {
          ...(data.email && { email: data.email }),
          ...(data.firstName && { firstName: data.firstName }),
          ...(data.lastName && { lastName: data.lastName }),
        },
        select: {
          id: true,
          email: true,
          firstName: true,
          lastName: true,
        },
      });

      // Update admin profile details
      const updatedProfile = await tx.adminProfile.update({
        where: { userId: adminId },
        data: {
          ...(data.designation && { designation: data.designation }),
          ...(data.department && { department: data.department }),
        },
        select: {
          id: true,
          designation: true,
          department: true,
        },
      });

      // Log activity
      const superAdminProfile = await tx.adminProfile.findUnique({
        where: { userId: superAdminId },
      });

      if (superAdminProfile) {
        await tx.adminActivityLog.create({
          data: {
            adminId: superAdminProfile.id,
            action: "UPDATE_ADMIN_DETAILS",
            module: "ADMIN",
            entityId: adminId,
            description: `Updated details for: ${updatedUser.firstName} ${updatedUser.lastName}`,
            ipAddress,
            userAgent,
            metadata: {
              oldEmail: existingAdmin.email,
              newEmail: updatedUser.email,
              oldName: `${existingAdmin.firstName} ${existingAdmin.lastName}`,
              newName: `${updatedUser.firstName} ${updatedUser.lastName}`,
            },
          },
        });
      }

      return { user: updatedUser, profile: updatedProfile };
    });

    return result;
  }

  /**
   * Delete admin permanently
   */
  static async deleteAdmin(
    adminId: string,
    superAdminId: string,
    ipAddress: string,
    userAgent: string
  ) {
    // Verify admin exists
    const admin = await prisma.user.findUnique({
      where: { id: adminId, role: "ADMIN" },
      select: { id: true, email: true, firstName: true, lastName: true },
    });

    if (!admin) {
      throw {
        status: 404,
        message: "Admin not found",
      };
    }

    // Atomic transaction - get details before deletion for logging
    const superAdminProfile = await prisma.adminProfile.findUnique({
      where: { userId: superAdminId },
    });

    // Log deletion BEFORE deleting
    if (superAdminProfile) {
      await prisma.adminActivityLog.create({
        data: {
          adminId: superAdminProfile.id,
          action: "DELETE_ADMIN",
          module: "ADMIN",
          entityId: adminId,
          description: `Deleted admin: ${admin.firstName} ${admin.lastName}`,
          ipAddress,
          userAgent,
          metadata: {
            email: admin.email,
            deletedAt: new Date().toISOString(),
          },
        },
      });
    }

    // Delete user (cascades to AdminProfile and ActivityLogs)
    await prisma.user.delete({
      where: { id: adminId },
    });

    return { success: true, adminId };
  }

  /**
   * Get admin activity logs
   */
  static async getActivityLog(
    limit: number = 100,
    offset: number = 0,
    adminId?: string
  ) {
    const [logs, total] = await Promise.all([
      prisma.adminActivityLog.findMany({
        where: {
          ...(adminId && { entityId: adminId }),
          action: {
            in: [
              "CREATE_ADMIN",
              "UPDATE_ADMIN_PERMISSIONS",
              "UPDATE_ADMIN_DETAILS",
              "ACTIVATE_ADMIN",
              "DEACTIVATE_ADMIN",
              "DELETE_ADMIN",
            ],
          },
        },
        select: {
          id: true,
          adminId: true,
          action: true,
          module: true,
          entityId: true,
          description: true,
          ipAddress: true,
          userAgent: true,
          metadata: true,
          createdAt: true,
          admin: {
            select: {
              user: { select: { firstName: true, lastName: true } },
            },
          },
        },
        orderBy: { createdAt: "desc" },
        take: limit,
        skip: offset,
      }),
      prisma.adminActivityLog.count({
        where: {
          ...(adminId && { entityId: adminId }),
          action: {
            in: [
              "CREATE_ADMIN",
              "UPDATE_ADMIN_PERMISSIONS",
              "UPDATE_ADMIN_DETAILS",
              "ACTIVATE_ADMIN",
              "DEACTIVATE_ADMIN",
              "DELETE_ADMIN",
            ],
          },
        },
      }),
    ]);

    return { logs, total };
  }
}

export default AdminService;

import type { Request, Response } from "express";
import { asyncHandler } from "../../utils/asyncHandler.js";
import AdminService from "./admin.service.js";
import {
  createAdminSchema,
  updatePermissionsSchema,
  updateAdminStatusSchema,
  updateAdminDetailsSchema,
} from "./admin.validation.js";

class AdminController {
  /**
   * POST /api/admin/create
   * Create admin instantly (Super Admin only)
   */
  static createAdmin = asyncHandler(async (req: Request, res: Response) => {
    const parseResult = createAdminSchema.safeParse(req.body);
    if (!parseResult.success) {
      return res.status(400).json({
        ok: false,
        message: "Validation failed",
        errors: parseResult.error.flatten(),
      });
    }

    const { user, adminProfile } = await AdminService.createAdmin(
      parseResult.data,
      req.user!.id,
      req.ip || "",
      req.get("User-Agent") || ""
    );

    return res.status(201).json({
      ok: true,
      message: "Admin created successfully",
      admin: {
        id: user.id,
        phone: user.phone,
        email: user.email,
        firstName: user.firstName,
        lastName: user.lastName,
        role: user.role,
        status: user.status,
      },
      adminProfile: {
        id: adminProfile.id,
        designation: adminProfile.designation,
        department: adminProfile.department,
        permissions: adminProfile.permissions,
        isActive: adminProfile.isActive,
        createdAt: adminProfile.createdAt,
      },
    });
  });

  /**
   * GET /api/admin/all
   * Get all admins (Super Admin only)
   */
  static getAllAdmins = asyncHandler(async (req: Request, res: Response) => {
    const limit = Math.min(parseInt(req.query.limit as string) || 100, 500);
    const offset = Math.max(parseInt(req.query.offset as string) || 0, 0);

    const { admins, total } = await AdminService.getAllAdmins(limit, offset);

    return res.json({
      ok: true,
      total,
      limit,
      offset,
      admins: admins.map((admin) => ({
        id: admin.id,
        phone: admin.phone,
        email: admin.email,
        firstName: admin.firstName,
        lastName: admin.lastName,
        role: admin.role,
        status: admin.status,
        ...admin.adminProfile,
      })),
    });
  });

  /**
   * GET /api/admin/:adminId
   * Get single admin (Super Admin only)
   */
  static getAdminById = asyncHandler(async (req: Request, res: Response) => {
    const { adminId } = req.params;

    const admin = await AdminService.getAdminById(adminId);

    return res.json({
      ok: true,
      admin: {
        id: admin.id,
        phone: admin.phone,
        email: admin.email,
        firstName: admin.firstName,
        lastName: admin.lastName,
        role: admin.role,
        status: admin.status,
        createdAt: admin.createdAt,
        updatedAt: admin.updatedAt,
      },
      adminProfile: admin.adminProfile,
    });
  });

  /**
   * GET /api/admin/search/phone
   * Search admin by phone number (Super Admin only)
   */
  static searchByPhone = asyncHandler(async (req: Request, res: Response) => {
    const { phone } = req.query;

    if (!phone || typeof phone !== "string") {
      return res.status(400).json({
        ok: false,
        message: "Phone number is required",
      });
    }

    // Validate phone format (10-15 digits)
    if (!/^\d{10,15}$/.test(phone)) {
      return res.status(400).json({
        ok: false,
        message: "Invalid phone number format (10-15 digits required)",
      });
    }

    const admin = await prisma.user.findUnique({
      where: { phone, role: "ADMIN" },
      select: {
        id: true,
        phone: true,
        email: true,
        firstName: true,
        lastName: true,
        role: true,
        status: true,
        createdAt: true,
        updatedAt: true,
        adminProfile: {
          select: {
            id: true,
            designation: true,
            department: true,
            permissions: true,
            isActive: true,
            createdAt: true,
            updatedAt: true,
          },
        },
      },
    });

    if (!admin) {
      return res.status(404).json({
        ok: false,
        message: "Admin not found with this phone number",
      });
    }

    return res.json({
      ok: true,
      admin: {
        id: admin.id,
        phone: admin.phone,
        email: admin.email,
        firstName: admin.firstName,
        lastName: admin.lastName,
        role: admin.role,
        status: admin.status,
        createdAt: admin.createdAt,
        updatedAt: admin.updatedAt,
      },
      adminProfile: admin.adminProfile,
    });
  });
   * PUT /api/admin/:adminId/permissions
   * Update admin permissions (Super Admin only)
   */
  static updatePermissions = asyncHandler(
    async (req: Request, res: Response) => {
      const parseResult = updatePermissionsSchema.safeParse(req.body);
      if (!parseResult.success) {
        return res.status(400).json({
          ok: false,
          message: "Validation failed",
          errors: parseResult.error.flatten(),
        });
      }

      const { adminId } = req.params;

      const updated = await AdminService.updatePermissions(
        adminId,
        parseResult.data,
        req.user!.id,
        req.ip || "",
        req.get("User-Agent") || ""
      );

      return res.json({
        ok: true,
        message: "Admin permissions updated successfully",
        adminProfile: {
          id: updated.id,
          permissions: updated.permissions,
        },
      });
    }
  );

  /**
   * PUT /api/admin/:adminId/status
   * Toggle admin active/inactive (Super Admin only)
   */
  static toggleAdminStatus = asyncHandler(
    async (req: Request, res: Response) => {
      const parseResult = updateAdminStatusSchema.safeParse(req.body);
      if (!parseResult.success) {
        return res.status(400).json({
          ok: false,
          message: "Validation failed",
          errors: parseResult.error.flatten(),
        });
      }

      const { adminId } = req.params;

      const updated = await AdminService.toggleAdminStatus(
        adminId,
        parseResult.data.isActive,
        req.user!.id,
        req.ip || "",
        req.get("User-Agent") || ""
      );

      return res.json({
        ok: true,
        message: "Admin status updated successfully",
        admin: {
          isActive: updated.isActive,
          status: updated.isActive ? "ACTIVE" : "INACTIVE",
        },
      });
    }
  );

  /**
   * PUT /api/admin/:adminId
   * Update admin details (Super Admin only)
   */
  static updateAdminDetails = asyncHandler(
    async (req: Request, res: Response) => {
      const parseResult = updateAdminDetailsSchema.safeParse(req.body);
      if (!parseResult.success) {
        return res.status(400).json({
          ok: false,
          message: "Validation failed",
          errors: parseResult.error.flatten(),
        });
      }

      const { adminId } = req.params;

      const { user, profile } = await AdminService.updateAdminDetails(
        adminId,
        parseResult.data,
        req.user!.id,
        req.ip || "",
        req.get("User-Agent") || ""
      );

      return res.json({
        ok: true,
        message: "Admin updated successfully",
        admin: {
          id: user.id,
          email: user.email,
          firstName: user.firstName,
          lastName: user.lastName,
        },
        adminProfile: {
          id: profile.id,
          designation: profile.designation,
          department: profile.department,
        },
      });
    }
  );

  /**
   * DELETE /api/admin/:adminId
   * Delete admin (Super Admin only)
   */
  static deleteAdmin = asyncHandler(async (req: Request, res: Response) => {
    const { adminId } = req.params;

    await AdminService.deleteAdmin(
      adminId,
      req.user!.id,
      req.ip || "",
      req.get("User-Agent") || ""
    );

    return res.json({
      ok: true,
      message: "Admin deleted successfully",
      adminId,
    });
  });

  /**
   * GET /api/admin/activity
   * Get admin activity logs (Super Admin only)
   */
  static getActivityLog = asyncHandler(async (req: Request, res: Response) => {
    const limit = Math.min(parseInt(req.query.limit as string) || 100, 500);
    const offset = Math.max(parseInt(req.query.offset as string) || 0, 0);
    const adminId = req.query.adminId as string | undefined;

    const { logs, total } = await AdminService.getActivityLog(
      limit,
      offset,
      adminId
    );

    return res.json({
      ok: true,
      total,
      limit,
      offset,
      logs,
    });
  });
}

export default AdminController;

import type { Request, Response, NextFunction } from "express";
import prisma from "../db/prismaClient.js";

/**
 * Generic middleware to check if user is an admin (ADMIN or SUPER_ADMIN)
 * and their profile is active. Does NOT check specific permissions.
 * Use requirePermission() for permission-based checks.
 */
export async function requireAdmin(
  req: Request,
  res: Response,
  next: NextFunction
) {
  try {
    if (!req.user) {
      return res.status(401).json({
        ok: false,
        message: "Authentication required",
      });
    }

    // Check if user is admin or super admin
    if (!["ADMIN", "SUPER_ADMIN"].includes(req.user.role)) {
      return res.status(403).json({
        ok: false,
        message: "Admin access required",
      });
    }

    // Verify admin profile exists and is active
    const adminProfile = await prisma.adminProfile.findUnique({
      where: { userId: req.user.id },
    });

    if (!adminProfile || !adminProfile.isActive) {
      return res.status(403).json({
        ok: false,
        message: "Admin profile is inactive",
      });
    }

    // Attach admin profile to request for use in controller
    (req as any).adminProfile = adminProfile;

    next();
  } catch (error) {
    console.error("requireAdmin error:", error);
    return res.status(500).json({
      ok: false,
      message: "Internal server error",
    });
  }
}

import type { Request, Response, NextFunction } from "express";

/**
 * Middleware factory to check if user has specific permission(s)
 * Super admins bypass all permission checks automatically
 * Usage: router.post('/endpoint', requireAuth, requireAdmin, requirePermission('MANAGE_USERS'), controller)
 */
export function requirePermission(...permissions: string[]) {
  return (req: Request, res: Response, next: NextFunction) => {
    try {
      if (!req.user) {
        return res.status(401).json({
          ok: false,
          message: "Authentication required",
        });
      }

      // Super admin has all permissions implicitly
      if (req.user.role === "SUPER_ADMIN") {
        return next();
      }

      // Get admin profile from request (should be attached by requireAdmin middleware)
      const adminProfile = (req as any).adminProfile;

      if (!adminProfile) {
        return res.status(403).json({
          ok: false,
          message: "Admin profile not found",
        });
      }

      // Check if user has at least one of the required permissions
      const hasPermission = permissions.some((perm) =>
        adminProfile.permissions.includes(perm)
      );

      if (!hasPermission) {
        return res.status(403).json({
          ok: false,
          message: `Permission denied. Required: ${permissions.join(" OR ")}`,
        });
      }

      next();
    } catch (error) {
      console.error("requirePermission error:", error);
      return res.status(500).json({
        ok: false,
        message: "Internal server error",
      });
    }
  };
}

import express from "express";
import AdminController from "./admin.controller.js";
import requireAuth from "../../middleware/requireAuth.js";
import { requireAdmin } from "../../middleware/requireAdmin.js";
import { requirePermission } from "../../middleware/requirePermission.js";

const router = express.Router();

/**
 * Super Admin Routes - Direct Admin Management
 * All routes require authentication, admin role, and MANAGE_ADMINS permission
 */

// POST /api/admin/create - Create admin instantly
router.post(
  "/create",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.createAdmin
);

// GET /api/admin/all - Get all admins
router.get(
  "/all",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.getAllAdmins
);

// GET /api/admin/:adminId - Get single admin
router.get(
  "/:adminId",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.getAdminById
);

// GET /api/admin/search/phone - Search admin by phone number
router.get(
  "/search/phone",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.searchByPhone

// PUT /api/admin/:adminId/permissions - Update permissions
router.put(
  "/:adminId/permissions",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.updatePermissions
);

// PUT /api/admin/:adminId/status - Toggle admin status
router.put(
  "/:adminId/status",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.toggleAdminStatus
);

// PUT /api/admin/:adminId - Update admin details
router.put(
  "/:adminId",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.updateAdminDetails
);

// DELETE /api/admin/:adminId - Delete admin
router.delete(
  "/:adminId",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.deleteAdmin
);

// GET /api/admin/activity - Get activity logs
router.get(
  "/activity",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.getActivityLog
);

export default router;

import type { Request, Response, NextFunction } from "express";

/**
 * Middleware to verify user is SUPER_ADMIN role
 * Used only for super admin-specific operations
 */
export function requireSuperAdmin(
  req: Request,
  res: Response,
  next: NextFunction
) {
  try {
    if (!req.user) {
      return res.status(401).json({
        ok: false,
        message: "Authentication required",
      });
    }

    if (req.user.role !== "SUPER_ADMIN") {
      return res.status(403).json({
        ok: false,
        message: "Super admin access required",
      });
    }

    next();
  } catch (error) {
    console.error("requireSuperAdmin error:", error);
    return res.status(500).json({
      ok: false,
      message: "Internal server error",
    });
  }
}

import type { Request, Response, NextFunction } from "express";
import prisma from "../db/prismaClient.js";

/**
 * Generic middleware to check if user is an admin (ADMIN or SUPER_ADMIN)
 * and their profile is active. Does NOT check specific permissions.
 * Use requirePermission() for permission-based checks.
 */
export async function requireAdmin(
  req: Request,
  res: Response,
  next: NextFunction
) {
  try {
    if (!req.user) {
      return res.status(401).json({
        ok: false,
        message: "Authentication required",
      });
    }

    // Check if user is admin or super admin
    if (!["ADMIN", "SUPER_ADMIN"].includes(req.user.role)) {
      return res.status(403).json({
        ok: false,
        message: "Admin access required",
      });
    }

    // Verify admin profile exists and is active (except for super admin creation)
    if (req.user.role === "ADMIN") {
      const adminProfile = await prisma.adminProfile.findUnique({
        where: { userId: req.user.id },
      });

      if (!adminProfile || !adminProfile.isActive) {
        return res.status(403).json({
          ok: false,
          message: "Admin profile is inactive",
        });
      }

      // Attach admin profile to request for permission checks
      (req as any).adminProfile = adminProfile;
    } else if (req.user.role === "SUPER_ADMIN") {
      // Super admin check - ensure profile exists
      const superAdminProfile = await prisma.adminProfile.findUnique({
        where: { userId: req.user.id },
      });

      if (!superAdminProfile) {
        return res.status(403).json({
          ok: false,
          message: "Super admin profile not found",
        });
      }

      (req as any).adminProfile = superAdminProfile;
    }

    next();
  } catch (error) {
    console.error("requireAdmin error:", error);
    return res.status(500).json({
      ok: false,
      message: "Internal server error",
    });
  }
}

import type { Request, Response, NextFunction } from "express";

/**
 * Middleware factory to check if user has specific permission(s)
 * Super admins bypass all permission checks automatically
 * Usage: router.post('/endpoint', requireAuth, requireAdmin, requirePermission('MANAGE_USERS'), controller)
 */
export function requirePermission(...permissions: string[]) {
  return (req: Request, res: Response, next: NextFunction) => {
    try {
      if (!req.user) {
        return res.status(401).json({
          ok: false,
          message: "Authentication required",
        });
      }

      // Super admin has all permissions implicitly
      if (req.user.role === "SUPER_ADMIN") {
        return next();
      }

      // Get admin profile from request (should be attached by requireAdmin middleware)
      const adminProfile = (req as any).adminProfile;

      if (!adminProfile) {
        return res.status(403).json({
          ok: false,
          message: "Admin profile not found",
        });
      }

      // Check if user has at least one of the required permissions
      const hasPermission = permissions.some((perm) =>
        adminProfile.permissions.includes(perm)
      );

      if (!hasPermission) {
        return res.status(403).json({
          ok: false,
          message: `Permission denied. Required: ${permissions.join(" OR ")}`,
        });
      }

      next();
    } catch (error) {
      console.error("requirePermission error:", error);
      return res.status(500).json({
        ok: false,
        message: "Internal server error",
      });
    }
  };
}

import express from "express";
import AdminController from "./admin.controller.js";
import requireAuth from "../../middleware/requireAuth.js";
import { requireAdmin } from "../../middleware/requireAdmin.js";
import { requirePermission } from "../../middleware/requirePermission.js";

const router = express.Router();

/**
 * Super Admin Routes - Direct Admin Management
 * All routes require authentication, admin role, and MANAGE_ADMINS permission
 */

// POST /api/admin/create - Create admin instantly
router.post(
  "/create",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.createAdmin
);

// GET /api/admin/all - Get all admins
router.get(
  "/all",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.getAllAdmins
);

// GET /api/admin/:adminId - Get single admin
router.get(
  "/:adminId",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.getAdminById
);

// GET /api/admin/search/phone - Search admin by phone number
router.get(
  "/search/phone",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.searchByPhone

// PUT /api/admin/:adminId/permissions - Update permissions
router.put(
  "/:adminId/permissions",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.updatePermissions
);

// PUT /api/admin/:adminId/status - Toggle admin status
router.put(
  "/:adminId/status",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.toggleAdminStatus
);

// PUT /api/admin/:adminId - Update admin details
router.put(
  "/:adminId",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.updateAdminDetails
);

// DELETE /api/admin/:adminId - Delete admin
router.delete(
  "/:adminId",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.deleteAdmin
);

// GET /api/admin/activity - Get activity logs
router.get(
  "/activity",
  requireAuth,
  requireAdmin,
  requirePermission("MANAGE_ADMINS"),
  AdminController.getActivityLog
);

export default router;

import type { Request, Response, NextFunction } from "express";

/**
 * Middleware to verify user is SUPER_ADMIN role
 * Used only for super admin-specific operations
 */
export function requireSuperAdmin(
  req: Request,
  res: Response,
  next: NextFunction
) {
  try {
    if (!req.user) {
      return res.status(401).json({
        ok: false,
        message: "Authentication required",
      });
    }

    if (req.user.role !== "SUPER_ADMIN") {
      return res.status(403).json({
        ok: false,
        message: "Super admin access required",
      });
    }

    next();
  } catch (error) {
    console.error("requireSuperAdmin error:", error);
    return res.status(500).json({
      ok: false,
      message: "Internal server error",
    });
  }
}

import type { Request, Response, NextFunction } from "express";
import prisma from "../db/prismaClient.js";

/**
 * Generic middleware to check if user is an admin (ADMIN or SUPER_ADMIN)
 * and their profile is active. Does NOT check specific permissions.
 * Use requirePermission() for permission-based checks.
 */
export async function requireAdmin(
  req: Request,
  res: Response,
  next: NextFunction
) {
  try {
    if (!req.user) {
      return res.status(401).json({
        ok: false,
        message: "Authentication required",
      });
    }

    // Check if user is admin or super admin
    if (!["ADMIN", "SUPER_ADMIN"].includes(req.user.role)) {
      return res.status(403).json({
        ok: false,
        message: "Admin access required",
      });
    }

    // Verify admin profile exists and is active (except for super admin creation)
    if (req.user.role === "ADMIN") {
      const adminProfile = await prisma.adminProfile.findUnique({
        where: { userId: req.user.id },
      });

      if (!adminProfile || !adminProfile.isActive) {
        return res.status(403).json({
          ok: false,
          message: "Admin profile is inactive",
        });
      }

      // Attach admin profile to request for permission checks
      (req as any).adminProfile = adminProfile;
    } else if (req.user.role === "SUPER_ADMIN") {
      // Super admin check - ensure profile exists
      const superAdminProfile = await prisma.adminProfile.findUnique({
        where: { userId: req.user.id },
      });

      if (!superAdminProfile) {
        return res.status(403).json({
          ok: false,
          message: "Super admin profile not found",
        });
      }

      (req as any).adminProfile = superAdminProfile;
    }

    next();
  } catch (error) {
    console.error("requireAdmin error:", error);
    return res.status(500).json({
      ok: false,
      message: "Internal server error",
    });
  }
}