feat: add shared media assets and fix credit lifecycle

admin_users.go

@@ -57,6 +57,7 @@ func (a *App) adminCreateUser(c *gin.Context) {
 		c.JSON(500, gin.H{"error": err.Error()})
 		return
 	}
+	admin := c.MustGet("user").(*User)
 	var u User
 	err = a.db.Transaction(func(tx *gorm.DB) error {
 		u = User{Username: strings.TrimSpace(in.Username), PasswordHash: hash, Role: in.Role, Status: UserActive}
@@ -83,6 +84,7 @@ func (a *App) adminCreateUser(c *gin.Context) {
 		return
 	}
 	u.PasswordHash = ""
+	a.audit(admin.ID, "user.create", "user", strconv.FormatUint(uint64(u.ID), 10), "role="+u.Role)
 	c.JSON(201, u)
 }
 
@@ -145,10 +147,48 @@ func (a *App) adminUpdateUser(c *gin.Context) {
 		}
 		u.Status = *in.Status
 	}
-	if err := a.db.Save(&u).Error; err != nil {
+	operator := c.MustGet("user").(*User)
+	if u.ID == operator.ID && (u.Role != RoleAdmin || u.Status == UserDisabled) {
+		var admins int64
+		if err := a.db.Model(&User{}).Where("role = ? AND status = ?", RoleAdmin, UserActive).Count(&admins).Error; err != nil {
+			c.JSON(500, gin.H{"error": err.Error()})
+			return
+		}
+		if admins <= 1 {
+			c.JSON(400, gin.H{"error": "cannot remove the last active admin account"})
+			return
+		}
+	}
+	if err := a.db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Save(&u).Error; err != nil {
+			return err
+		}
+		if in.Role != nil {
+			if err := tx.Where("user_id = ?", u.ID).Delete(&UserPermission{}).Error; err != nil {
+				return err
+			}
+			for _, p := range defaultPermissions(u.Role) {
+				if err := tx.Create(&UserPermission{UserID: u.ID, Permission: p, Enabled: true}).Error; err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	}); err != nil {
 		c.JSON(500, gin.H{"error": err.Error()})
 		return
 	}
 	u.PasswordHash = ""
+	changes := []string{}
+	if in.Password != nil {
+		changes = append(changes, "password")
+	}
+	if in.Role != nil {
+		changes = append(changes, "role="+u.Role)
+	}
+	if in.Status != nil {
+		changes = append(changes, "status="+u.Status)
+	}
+	a.audit(operator.ID, "user.update", "user", strconv.FormatUint(uint64(u.ID), 10), strings.Join(changes, ","))
 	c.JSON(200, u)
 }