Added User Status Change

mckaragoz · mckaragoz · commit cc15c7398e73 · 2026-01-30T00:00:11.000+03:00
diff --git a/samples/blazor-server/CodeBeam.UltimateAuth.Sample.BlazorServer/Components/Pages/Home.razor.cs b/samples/blazor-server/CodeBeam.UltimateAuth.Sample.BlazorServer/Components/Pages/Home.razor.cs
@@ -86,12 +86,12 @@ private async Task HandleGetMe()
 
         private async Task ChangeUserInactive()
         {
-            ChangeUserStatusRequest request = new ChangeUserStatusRequest
+            ChangeUserStatusAdminRequest request = new ChangeUserStatusAdminRequest
             {
                 UserKey = UserKey.FromString("user"),
                 NewStatus = UserStatus.Disabled
             };
-            var result = await UAuth.Users.ChangeStatusAsync(request);
+            var result = await UAuth.Users.ChangeStatusAdminAsync(request);
             if (result.Ok)
             {
                 Snackbar.Add($"User is disabled.", Severity.Info);
diff --git a/src/CodeBeam.UltimateAuth.Client/Services/DefaultUserClient.cs b/src/CodeBeam.UltimateAuth.Client/Services/DefaultUserClient.cs
@@ -39,9 +39,16 @@ public async Task<UAuthResult<UserCreateResult>> CreateAsync(CreateUserRequest r
             return UAuthResultMapper.FromJson<UserCreateResult>(raw);
         }
 
-        public async Task<UAuthResult<UserStatusChangeResult>> ChangeStatusAsync(ChangeUserStatusRequest request)
+        public async Task<UAuthResult<UserStatusChangeResult>> ChangeStatusSelfAsync(ChangeUserStatusSelfRequest request)
         {
-            var url = UAuthUrlBuilder.Combine(_options.Endpoints.Authority, "/users/status");
+            var url = UAuthUrlBuilder.Combine(_options.Endpoints.Authority, $"/users/status");
+            var raw = await _request.SendJsonAsync(url, request);
+            return UAuthResultMapper.FromJson<UserStatusChangeResult>(raw);
+        }
+
+        public async Task<UAuthResult<UserStatusChangeResult>> ChangeStatusAdminAsync(ChangeUserStatusAdminRequest request)
+        {
+            var url = UAuthUrlBuilder.Combine(_options.Endpoints.Authority, $"/admin/users/{request.UserKey.Value}/status");
             var raw = await _request.SendJsonAsync(url, request);
             return UAuthResultMapper.FromJson<UserStatusChangeResult>(raw);
         }
diff --git a/src/CodeBeam.UltimateAuth.Client/Services/IUserClient.cs b/src/CodeBeam.UltimateAuth.Client/Services/IUserClient.cs
@@ -7,7 +7,8 @@ namespace CodeBeam.UltimateAuth.Client.Services
     public interface IUserClient
     {
         Task<UAuthResult<UserCreateResult>> CreateAsync(CreateUserRequest request);
-        Task<UAuthResult<UserStatusChangeResult>> ChangeStatusAsync(ChangeUserStatusRequest request);
+        Task<UAuthResult<UserStatusChangeResult>> ChangeStatusSelfAsync(ChangeUserStatusSelfRequest request);
+        Task<UAuthResult<UserStatusChangeResult>> ChangeStatusAdminAsync(ChangeUserStatusAdminRequest request);
         Task<UAuthResult<UserDeleteResult>> DeleteAsync(DeleteUserRequest request);
 
         Task<UAuthResult<UserViewDto>> GetMeAsync();
diff --git a/src/CodeBeam.UltimateAuth.Server/Defaults/UAuthActions.cs b/src/CodeBeam.UltimateAuth.Server/Defaults/UAuthActions.cs
@@ -6,7 +6,7 @@ public static class Users
         {
             public const string Create = "users.create";
             public const string Delete = "users.delete";
-            public const string ChangeStatus = "users.status.change";
+            public const string ChangeStatusSelf = "users.status.change.self";
             public const string ChangeStatusAdmin = "users.status.change.admin";
         }
 
diff --git a/src/CodeBeam.UltimateAuth.Server/Endpoints/Abstractions/IUserEndpointHandler.cs b/src/CodeBeam.UltimateAuth.Server/Endpoints/Abstractions/IUserEndpointHandler.cs
@@ -6,7 +6,8 @@ namespace CodeBeam.UltimateAuth.Server.Endpoints;
 public interface IUserEndpointHandler
 {
     Task<IResult> CreateAsync(HttpContext ctx);
-    Task<IResult> ChangeStatusAsync(HttpContext ctx);
+    Task<IResult> ChangeStatusSelfAsync(HttpContext ctx);
+    Task<IResult> ChangeStatusAdminAsync(UserKey userKey, HttpContext ctx);
     Task<IResult> DeleteAsync(HttpContext ctx);
 
     Task<IResult> GetMeAsync(HttpContext ctx);
diff --git a/src/CodeBeam.UltimateAuth.Server/Endpoints/UAuthEndpointRegistrar.cs b/src/CodeBeam.UltimateAuth.Server/Endpoints/UAuthEndpointRegistrar.cs
@@ -5,6 +5,7 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Routing;
+using static CodeBeam.UltimateAuth.Server.Defaults.UAuthActions;
 
 namespace CodeBeam.UltimateAuth.Server.Endpoints
 {
@@ -114,7 +115,7 @@ public void MapEndpoints(RouteGroupBuilder rootGroup, UAuthServerOptions options
                     => await h.CreateAsync(ctx)).WithMetadata(new AuthFlowMetadata(AuthFlowType.UserManagement));
 
                 users.MapPost("/status", async ([FromServices] IUserEndpointHandler h, HttpContext ctx)
-                    => await h.ChangeStatusAsync(ctx)).WithMetadata(new AuthFlowMetadata(AuthFlowType.UserManagement));
+                    => await h.ChangeStatusSelfAsync(ctx)).WithMetadata(new AuthFlowMetadata(AuthFlowType.UserManagement));
 
                 // Post is intended for Auth
                 users.MapPost("/delete", async ([FromServices] IUserEndpointHandler h, HttpContext ctx)
@@ -136,6 +137,9 @@ public void MapEndpoints(RouteGroupBuilder rootGroup, UAuthServerOptions options
             {
                 var admin = group.MapGroup("/admin/users");
 
+                admin.MapPost("/{userKey}/status", async ([FromServices] IUserEndpointHandler h, UserKey userKey, HttpContext ctx)
+                    => await h.ChangeStatusAdminAsync(userKey, ctx)).WithMetadata(new AuthFlowMetadata(AuthFlowType.UserManagement));
+
                 admin.MapPost("/{userKey}/profile/get", async ([FromServices] IUserEndpointHandler h, UserKey userKey, HttpContext ctx)
                     => await h.GetUserAsync(userKey, ctx)).WithMetadata(new AuthFlowMetadata(AuthFlowType.UserManagement));
 
diff --git a/src/CodeBeam.UltimateAuth.Server/Options/UAuthServerOptions.cs b/src/CodeBeam.UltimateAuth.Server/Options/UAuthServerOptions.cs
@@ -110,7 +110,7 @@ public void ReplaceSessionCookieManager<T>() where T : class, IUAuthCookieManage
 
         public bool EnableUserLifecycleEndpoints { get; set; } = true;
         public bool EnableUserProfileEndpoints { get; set; } = true;
-        public bool EnableAdminChangeUserProfileEndpoints { get; set; } = false;
+        public bool EnableAdminChangeUserProfileEndpoints { get; set; } = true;
         public bool EnableCredentialsEndpoints { get; set; } = true;
         public bool EnableAuthorizationEndpoints { get; set; } = true;
 
diff --git a/src/users/CodeBeam.UltimateAuth.Users.Contracts/Dtos/UserStatus.cs b/src/users/CodeBeam.UltimateAuth.Users.Contracts/Dtos/UserStatus.cs
@@ -2,28 +2,20 @@
 {
     public enum UserStatus
     {
-        // Normal state
+
         Active = 0,
 
-        // User initiated
         SelfSuspended = 10,
 
-        // Administrative actions
         Disabled = 20,
         Suspended = 30,
 
-        // Security / risk based
         Locked = 40,
         RiskHold = 50,
 
-        // Lifecycle
         PendingActivation = 60,
         PendingVerification = 70,
 
-        // Terminal (soft-delete)
         Deactivated = 80,
-
-        // Soft // TODO: User domain already have IsDeleted, this may remove
-        Deleted = 90
     }
 }
diff --git a/src/users/CodeBeam.UltimateAuth.Users.Contracts/Requests/ChangeUserStatusAdminRequest.cs b/src/users/CodeBeam.UltimateAuth.Users.Contracts/Requests/ChangeUserStatusAdminRequest.cs
@@ -2,7 +2,7 @@
 
 namespace CodeBeam.UltimateAuth.Users.Contracts
 {
-    public sealed class ChangeUserStatusRequest
+    public sealed class ChangeUserStatusAdminRequest
     {
         public required UserKey UserKey { get; init; }
         public required UserStatus NewStatus { get; init; }
diff --git a/src/users/CodeBeam.UltimateAuth.Users.Contracts/Requests/ChangeUserStatusSelfRequest.cs b/src/users/CodeBeam.UltimateAuth.Users.Contracts/Requests/ChangeUserStatusSelfRequest.cs
@@ -0,0 +1,7 @@
+﻿namespace CodeBeam.UltimateAuth.Users.Contracts
+{
+    public class ChangeUserStatusSelfRequest
+    {
+        public required UserStatus NewStatus { get; init; }
+    }
+}
diff --git a/src/users/CodeBeam.UltimateAuth.Users.Reference/Endpoints/DefaultUserEndpointHandler.cs b/src/users/CodeBeam.UltimateAuth.Users.Reference/Endpoints/DefaultUserEndpointHandler.cs
@@ -41,19 +41,37 @@ public async Task<IResult> CreateAsync(HttpContext ctx)
             : Results.BadRequest(result);
     }
 
-    public async Task<IResult> ChangeStatusAsync(HttpContext ctx)
+    public async Task<IResult> ChangeStatusSelfAsync(HttpContext ctx)
     {
         var flow = _authFlow.Current;
         if (!flow.IsAuthenticated)
             return Results.Unauthorized();
 
-        var request = await ctx.ReadJsonAsync<ChangeUserStatusRequest>(ctx.RequestAborted);
+        var request = await ctx.ReadJsonAsync<ChangeUserStatusSelfRequest>(ctx.RequestAborted);
+
+        var accessContext = await _accessContextFactory.CreateAsync(
+            authFlow: flow,
+            action: UAuthActions.Users.ChangeStatusSelf,
+            resource: "users",
+            resourceId: flow?.UserKey?.Value);
+
+        await _users.ChangeUserStatusAsync(accessContext, request, ctx.RequestAborted);
+        return Results.Ok();
+    }
+
+    public async Task<IResult> ChangeStatusAdminAsync(UserKey userKey, HttpContext ctx)
+    {
+        var flow = _authFlow.Current;
+        if (!flow.IsAuthenticated)
+            return Results.Unauthorized();
+
+        var request = await ctx.ReadJsonAsync<ChangeUserStatusAdminRequest>(ctx.RequestAborted);
 
         var accessContext = await _accessContextFactory.CreateAsync(
             authFlow: flow,
             action: UAuthActions.Users.ChangeStatusAdmin,
             resource: "users",
-            resourceId: request.UserKey.Value);
+            resourceId: userKey.Value);
 
         await _users.ChangeUserStatusAsync(accessContext, request, ctx.RequestAborted);
         return Results.Ok();
diff --git a/src/users/CodeBeam.UltimateAuth.Users.Reference/Services/IUserApplicationService.cs b/src/users/CodeBeam.UltimateAuth.Users.Reference/Services/IUserApplicationService.cs
@@ -10,7 +10,7 @@ public interface IUserApplicationService
 
         Task<UserCreateResult> CreateUserAsync(AccessContext context, CreateUserRequest request, CancellationToken ct = default);
 
-        Task ChangeUserStatusAsync(AccessContext context, ChangeUserStatusRequest request, CancellationToken ct = default);
+        Task ChangeUserStatusAsync(AccessContext context, object request, CancellationToken ct = default);
 
         Task UpdateUserProfileAsync(AccessContext context, UpdateProfileRequest request, CancellationToken ct = default);
 
diff --git a/src/users/CodeBeam.UltimateAuth.Users.Reference/Services/UserApplicationService.cs b/src/users/CodeBeam.UltimateAuth.Users.Reference/Services/UserApplicationService.cs
@@ -125,12 +125,36 @@ await _identifierStore.CreateAsync(context.ResourceTenantId,
         return await _accessOrchestrator.ExecuteAsync(context, command, ct);
     }
 
-    public async Task ChangeUserStatusAsync(AccessContext context, ChangeUserStatusRequest request, CancellationToken ct = default)
+    public async Task ChangeUserStatusAsync(AccessContext context, object request, CancellationToken ct = default)
     {
         var command = new ChangeUserStatusCommand(async innerCt =>
         {
+            var newStatus = request switch
+            {
+                ChangeUserStatusSelfRequest r => r.NewStatus,
+                ChangeUserStatusAdminRequest r => r.NewStatus,
+                _ => throw new InvalidOperationException("invalid_request")
+            };
+
+            if (context.IsSelfAction)
+            {
+                if (newStatus is UserStatus.Disabled 
+                    or UserStatus.Suspended
+                    or UserStatus.Locked
+                    or UserStatus.RiskHold
+                    or UserStatus.PendingActivation
+                    or UserStatus.PendingVerification)
+                    throw new InvalidOperationException("self_cannot_set_admin_status");
+            }
+
+            if (!context.IsSelfAction)
+            {
+                if (newStatus is UserStatus.SelfSuspended or UserStatus.Deactivated)
+                    throw new InvalidOperationException("admin_cannot_set_self_status");
+            }
+
             var targetUserKey = context.GetTargetUserKey();
-            await _lifecycleStore.ChangeStatusAsync(context.ResourceTenantId, targetUserKey, request.NewStatus, _clock.UtcNow, innerCt);
+            await _lifecycleStore.ChangeStatusAsync(context.ResourceTenantId, targetUserKey, newStatus, _clock.UtcNow, innerCt);
         });
 
         await _accessOrchestrator.ExecuteAsync(context, command, ct);

Original file line number	Diff line number	Diff line change
`@@ -86,12 +86,12 @@ private async Task HandleGetMe()`
`86`	`86`
`87`	`87`	`private async Task ChangeUserInactive()`
`88`	`88`	`{`
`89`		`- ChangeUserStatusRequest request = new ChangeUserStatusRequest`
	`89`	`+ ChangeUserStatusAdminRequest request = new ChangeUserStatusAdminRequest`
`90`	`90`	`{`
`91`	`91`	`UserKey = UserKey.FromString("user"),`
`92`	`92`	`NewStatus = UserStatus.Disabled`
`93`	`93`	`};`
`94`		`- var result = await UAuth.Users.ChangeStatusAsync(request);`
	`94`	`+ var result = await UAuth.Users.ChangeStatusAdminAsync(request);`
`95`	`95`	`if (result.Ok)`
`96`	`96`	`{`
`97`	`97`	`Snackbar.Add($"User is disabled.", Severity.Info);`
Original file line number	Diff line number	Diff line change
`@@ -39,9 +39,16 @@ public async Task<UAuthResult<UserCreateResult>> CreateAsync(CreateUserRequest r`
`39`	`39`	`return UAuthResultMapper.FromJson<UserCreateResult>(raw);`
`40`	`40`	`}`
`41`	`41`
`42`		`- public async Task<UAuthResult<UserStatusChangeResult>> ChangeStatusAsync(ChangeUserStatusRequest request)`
	`42`	`+ public async Task<UAuthResult<UserStatusChangeResult>> ChangeStatusSelfAsync(ChangeUserStatusSelfRequest request)`
`43`	`43`	`{`
`44`		`- var url = UAuthUrlBuilder.Combine(_options.Endpoints.Authority, "/users/status");`
	`44`	`+ var url = UAuthUrlBuilder.Combine(_options.Endpoints.Authority, $"/users/status");`
	`45`	`+ var raw = await _request.SendJsonAsync(url, request);`
	`46`	`+ return UAuthResultMapper.FromJson<UserStatusChangeResult>(raw);`
	`47`	`+ }`
	`48`	`+`
	`49`	`+ public async Task<UAuthResult<UserStatusChangeResult>> ChangeStatusAdminAsync(ChangeUserStatusAdminRequest request)`
	`50`	`+ {`
	`51`	`+ var url = UAuthUrlBuilder.Combine(_options.Endpoints.Authority, $"/admin/users/{request.UserKey.Value}/status");`
`45`	`52`	`var raw = await _request.SendJsonAsync(url, request);`
`46`	`53`	`return UAuthResultMapper.FromJson<UserStatusChangeResult>(raw);`
`47`	`54`	`}`
Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,8 @@ namespace CodeBeam.UltimateAuth.Client.Services`
`7`	`7`	`public interface IUserClient`
`8`	`8`	`{`
`9`	`9`	`Task<UAuthResult<UserCreateResult>> CreateAsync(CreateUserRequest request);`
`10`		`- Task<UAuthResult<UserStatusChangeResult>> ChangeStatusAsync(ChangeUserStatusRequest request);`
	`10`	`+ Task<UAuthResult<UserStatusChangeResult>> ChangeStatusSelfAsync(ChangeUserStatusSelfRequest request);`
	`11`	`+ Task<UAuthResult<UserStatusChangeResult>> ChangeStatusAdminAsync(ChangeUserStatusAdminRequest request);`
`11`	`12`	`Task<UAuthResult<UserDeleteResult>> DeleteAsync(DeleteUserRequest request);`
`12`	`13`
`13`	`14`	`Task<UAuthResult<UserViewDto>> GetMeAsync();`
Original file line number	Diff line number	Diff line change
`@@ -6,7 +6,7 @@ public static class Users`
`6`	`6`	`{`
`7`	`7`	`public const string Create = "users.create";`
`8`	`8`	`public const string Delete = "users.delete";`
`9`		`- public const string ChangeStatus = "users.status.change";`
	`9`	`+ public const string ChangeStatusSelf = "users.status.change.self";`
`10`	`10`	`public const string ChangeStatusAdmin = "users.status.change.admin";`
`11`	`11`	`}`
`12`	`12`
Original file line number	Diff line number	Diff line change
`@@ -6,7 +6,8 @@ namespace CodeBeam.UltimateAuth.Server.Endpoints;`
`6`	`6`	`public interface IUserEndpointHandler`
`7`	`7`	`{`
`8`	`8`	`Task<IResult> CreateAsync(HttpContext ctx);`
`9`		`- Task<IResult> ChangeStatusAsync(HttpContext ctx);`
	`9`	`+ Task<IResult> ChangeStatusSelfAsync(HttpContext ctx);`
	`10`	`+ Task<IResult> ChangeStatusAdminAsync(UserKey userKey, HttpContext ctx);`
`10`	`11`	`Task<IResult> DeleteAsync(HttpContext ctx);`
`11`	`12`
`12`	`13`	`Task<IResult> GetMeAsync(HttpContext ctx);`
Original file line number	Diff line number	Diff line change
`@@ -2,7 +2,7 @@`
`2`	`2`
`3`	`3`	`namespace CodeBeam.UltimateAuth.Users.Contracts`
`4`	`4`	`{`
`5`		`- public sealed class ChangeUserStatusRequest`
	`5`	`+ public sealed class ChangeUserStatusAdminRequest`
`6`	`6`	`{`
`7`	`7`	`public required UserKey UserKey { get; init; }`
`8`	`8`	`public required UserStatus NewStatus { get; init; }`