arcadia-admin/app/lib/arcadia/users.ts

// Arcadia users API helpers.
//
// Backed by /api/v1/users (resources route). The OpenAPI spec doesn't yet
// describe these operations as typed paths, so we hand-roll types and use
// the generic verb methods on the client. Same pattern as tenants.ts.

import type { ArcadiaClient } from "@crema/arcadia-core-client"

export type UserStatus = "active" | "inactive" | "suspended"

export interface UserRoleSummary {
  id: string
  slug: string
  name: string
  permissions: string[]
}

export interface User {
  id: string
  email: string
  first_name: string | null
  last_name: string | null
  full_name: string
  status: UserStatus
  email_verified: boolean
  email_verified_at: string | null
  last_sign_in_at: string | null
  tenant_id: string
  roles: UserRoleSummary[]
  inserted_at: string
  updated_at: string
}

export interface UserListParams {
  status?: UserStatus
  email_verified?: boolean
}

export interface UserInput {
  email: string
  first_name?: string | null
  last_name?: string | null
  status?: UserStatus
  password?: string
  role_ids?: string[]
}

export async function listUsers(
  arcadia: ArcadiaClient,
  params?: UserListParams,
): Promise<User[]> {
  const queryParams = params
    ? {
        status: params.status,
        email_verified: params.email_verified == null ? undefined : String(params.email_verified),
      }
    : undefined
  const res = await arcadia.GET<{ data: User[] }>("/api/v1/users", { params: queryParams })
  return res.data
}

export async function getUser(arcadia: ArcadiaClient, id: string): Promise<User> {
  const res = await arcadia.GET<{ data: User }>(`/api/v1/users/${id}`)
  return res.data
}

export async function createUser(arcadia: ArcadiaClient, input: UserInput): Promise<User> {
  const res = await arcadia.POST<{ data: User }>("/api/v1/users", { body: { user: input } })
  return res.data
}

export async function updateUser(
  arcadia: ArcadiaClient,
  id: string,
  input: Partial<UserInput>,
): Promise<User> {
  const res = await arcadia.PATCH<{ data: User }>(`/api/v1/users/${id}`, {
    body: { user: input },
  })
  return res.data
}

export async function deleteUser(arcadia: ArcadiaClient, id: string): Promise<void> {
  await arcadia.DELETE(`/api/v1/users/${id}`)
}

export async function assignRole(
  arcadia: ArcadiaClient,
  userId: string,
  roleId: string,
): Promise<User> {
  const res = await arcadia.POST<{ data: User }>(`/api/v1/users/${userId}/roles/${roleId}`)
  return res.data
}

export async function removeRole(
  arcadia: ArcadiaClient,
  userId: string,
  roleId: string,
): Promise<User> {
  const res = await arcadia.DELETE<{ data: User }>(`/api/v1/users/${userId}/roles/${roleId}`)
  return res.data
}

export async function setUserStatus(
  arcadia: ArcadiaClient,
  id: string,
  status: UserStatus,
): Promise<User> {
  return updateUser(arcadia, id, { status })
}

// --- Impersonation ---
// The operator (platform/tenant admin) can act as another user for support.
// `startImpersonation` returns a token scoped to the target; the client swaps
// to it (see session.beginImpersonation). Stopping is a client-side restore of
// the operator's parked session — the /stop endpoint can't be reached with the
// impersonation token (it lacks admin), so we don't rely on it.

export interface CanImpersonate {
  can_impersonate: boolean
  user: Pick<User, "id" | "email" | "status"> & { first_name?: string; last_name?: string }
}

export interface ImpersonationToken {
  access_token: string
  impersonated_by: string
  expires_in: number
}

export async function canImpersonate(
  arcadia: ArcadiaClient,
  userId: string,
): Promise<CanImpersonate> {
  const res = await arcadia.GET<{ data: CanImpersonate }>(
    `/api/v1/admin/impersonate/${userId}/can-impersonate`,
  )
  return res.data
}

export async function startImpersonation(
  arcadia: ArcadiaClient,
  userId: string,
): Promise<ImpersonationToken> {
  const res = await arcadia.POST<{ data: ImpersonationToken }>(
    `/api/v1/admin/impersonate/${userId}`,
  )
  return res.data
}