diff --git a/app/Http/Controllers/UserController.php b/app/Http/Controllers/UserController.php index 9a63fc6..3d91a8a 100644 --- a/app/Http/Controllers/UserController.php +++ b/app/Http/Controllers/UserController.php @@ -38,6 +38,24 @@ class UserController extends Controller } } + public function deleteById(Request $request, int $id): JsonResponse { + + if(!$this->isAdmin($request->user()->role)){ + return response()->json(["message" => "Can't delete this user"], 403); + } + + try { + $user = User::find($id); + + if($user->role === 1) return response()->json(["message" => "Can't delete this user"], 403); + + $user->delete(); + return response()->json(['message' => 'User deleted successfully']); + } catch(\Exception $e) { + return response()->json(['message' => $e->getMessage()]); + } + } + public function getUser(Request $request, int $id): JsonResponse { try { @@ -94,6 +112,7 @@ class UserController extends Controller } public function addRole(Request $request, int $id): JsonResponse { + if(!$this->isAdmin($request->user()->role)){ return response()->json(["message" => "Can't add role to this user"], 403); } diff --git a/routes/api.php b/routes/api.php index 58ffbc8..49cae36 100644 --- a/routes/api.php +++ b/routes/api.php @@ -19,6 +19,8 @@ Route::middleware(['web', 'auth:sanctum'])->post('/users/logout', [AuthControlle Route::middleware(['web', 'auth:sanctum'])->delete('/users', [UserController::class, "delete"]); +Route::middleware(['web', 'auth:sanctum'])->delete('/users/{id}', [UserController::class, "deleteById"]); + Route::middleware(['web', 'auth:sanctum'])->get('/users/{id}', [UserController::class, "getUser"]); Route::middleware(['web', 'auth:sanctum'])->post('/users/update', [UserController::class, "update"]); diff --git a/tests/Users/Delete user by id.bru b/tests/Users/Delete user by id.bru new file mode 100644 index 0000000..8469f30 --- /dev/null +++ b/tests/Users/Delete user by id.bru @@ -0,0 +1,20 @@ +meta { + name: Delete user by id + type: http + seq: 7 +} + +delete { + url: http://localhost:8000/api/users/7 + body: none + auth: inherit +} + +headers { + X-XSRF-TOKEN: eyJpdiI6IndIakNUdWVLbUs4cEErZHpLYm9xY2c9PSIsInZhbHVlIjoib09MWDhBZWxrZnB0UCthSlpMVE1sT09iY0ZJNlpuZ1NWRWRvWnYvVVMrSm1yeWpob0JFSVpVa1pTTGJpc255eWV4QXlSS2IwZzNCZ0xPL1lMRWVRMDR6eU83OG9CV2J5ZUJqbENRWmdhRGZRM0hXczc2KzNKQVV1YmVCN0NwVHciLCJtYWMiOiIxOGZhNzI1ZDE0NTNlNTVkMDI3NjVhNTRmMjI4YWUwOTI1NjQ3MTllNTU4ZDA2NWQwNjM5MDM5MmE1OTIwYjUzIiwidGFnIjoiIn0= +} + +settings { + encodeUrl: true + timeout: 0 +}