diff --git a/app/org/maproulette/framework/controller/UserController.scala b/app/org/maproulette/framework/controller/UserController.scala index 6ff89168..5fc91f8f 100644 --- a/app/org/maproulette/framework/controller/UserController.scala +++ b/app/org/maproulette/framework/controller/UserController.scala @@ -561,7 +561,7 @@ class UserController @Inject() ( * Get the current list of superusers * @return the list of maproulette user ids that are superusers */ - def getSuperUserIds: Action[AnyContent] = Action.async { implicit request => + def getSuperUserIds(): Action[AnyContent] = Action.async { implicit request => implicit val requireSuperUser: Boolean = true this.sessionManager.authenticatedRequest { implicit user => Ok(Json.toJson(this.serviceManager.user.superUsers)) @@ -576,10 +576,10 @@ class UserController @Inject() ( def promoteUserToSuperUser(maprouletteUserId: Long): Action[AnyContent] = Action.async { implicit request => implicit val requireSuperUser: Boolean = true - this.sessionManager.authenticatedRequest { implicit grantorUser => + this.sessionManager.authenticatedRequest { implicit user => this.serviceManager.user.retrieve(maprouletteUserId) match { - case Some(user) => - this.serviceManager.user.promoteUserToSuperUser(user, grantorUser) + case Some(grantee) => + this.serviceManager.user.promoteUserToSuperUser(grantee, user) NoContent case None => throw new NotFoundException(s"Could not find user with ID $maprouletteUserId") @@ -595,13 +595,13 @@ class UserController @Inject() ( def demoteSuperUserToUser(maprouletteUserId: Long): Action[AnyContent] = Action.async { implicit request => implicit val requireSuperUser: Boolean = true - this.sessionManager.authenticatedRequest { implicit grantorUser => + this.sessionManager.authenticatedRequest { implicit user => this.serviceManager.user.retrieve(maprouletteUserId) match { - case Some(user) => - if (user.id == grantorUser.id) { + case Some(grantee) => + if (grantee.id == user.id) { throw new IllegalAccessException("A superuser cannot demote themselves") } - this.serviceManager.user.demoteSuperUserToUser(user) + this.serviceManager.user.demoteSuperUserToUser(grantee) NoContent case None => throw new NotFoundException(s"Could not find user with ID $maprouletteUserId") diff --git a/conf/v2_route/user.api b/conf/v2_route/user.api index 7e2c53f8..fc4822b8 100644 --- a/conf/v2_route/user.api +++ b/conf/v2_route/user.api @@ -598,24 +598,6 @@ DELETE /user/:userId/project/:projectId/:role @org.maproulette.framework.contr DELETE /user/project/:projectId/:role @org.maproulette.framework.controller.UserController.removeUsersFromProject(projectId:Long, role:Int, isOSMUserId:Boolean ?= false) ### # tags: [ User ] -# summary: Get all current superusers -# description: Return a list of maproulette user ids who are superusers. The requesting user must be a super user. -# responses: -# '200': -# description: The list was obtained and the response contains the list of superusers -# content: -# application/json: -# schema: -# type: array -# items: -# type: integer -# format: int64 -# '401': -# description: The user is not authorized to make this request -### -GET /user/superusers @org.maproulette.framework.controller.UserController.getSuperUserIds() -### -# tags: [ User ] # summary: Promote a standard user to a super user # description: Promote a standard user, a 'grantee', to a super user role; the requesting user is called a 'grantor'. # This will add the superuser role to the user, allowing the grantee to perform super user actions. @@ -632,7 +614,7 @@ GET /user/superusers @org.maproulette.framework.controller.UserController.getSup # in: path # description: The MapRoulette user id of the user (the grantee) to be promoted ### -PUT /user/superuser/:userId @org.maproulette.framework.controller.UserController.promoteUserToSuperUser(userId:Long) +PUT /superuser/:userId @org.maproulette.framework.controller.UserController.promoteUserToSuperUser(userId:Long) ### # tags: [ User ] # summary: Remove the superuser role from a super user @@ -653,4 +635,22 @@ PUT /user/superuser/:userId @org.maproulette.framework.controller.UserController # in: path # description: The MapRoulette user id of the user (the grantee) to be promoted ### -DELETE /user/superuser/:userId @org.maproulette.framework.controller.UserController.demoteSuperUserToUser(userId:Long) +DELETE /superuser/:userId @org.maproulette.framework.controller.UserController.demoteSuperUserToUser(userId:Long) +### +# tags: [ User ] +# summary: Get all current superusers +# description: Return a list of MapRoulette user ids who are superusers. The requesting user must be a super user. +# responses: +# '200': +# description: The list was obtained and the response contains the list of superusers +# content: +# application/json: +# schema: +# type: array +# items: +# type: integer +# uniqueItems: true +# '401': +# description: The user is not authorized to make this request +### +GET /superusers @org.maproulette.framework.controller.UserController.getSuperUserIds()