feat: update user management functionality to allow/return role and a… - #20
Merged
Conversation
✅ Test Results - Booker API📊 Summary
🎉 Ready to merge! 📁 View Test Reports |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR enhances admin-oriented user management by exposing additional user fields to admins, allowing admins to update role/lock status, and improving username/email uniqueness checks during user updates.
Changes:
- Added
AdminUserDTOplus mapping support to exposerole,accountNonLocked, and timestamps to admins. - Updated
/users(admin-only) list endpoint to returnPage<AdminUserDTO>instead ofPage<UserDTO>. - Improved update-time uniqueness checks by excluding the current user from username/email “already exists” queries, and added admin gating for role/lock updates.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
src/main/java/com/booker/services/UserService.java |
Adds admin-only update behavior for role/accountNonLocked and adjusts uniqueness checks during updates. |
src/main/java/com/booker/repositories/UserRepository.java |
Adds existsByUsernameAndIdNot / existsByEmailAndIdNot helpers for update-time uniqueness. |
src/main/java/com/booker/mappers/UserMapper.java |
Adds toAdminDTO mapper for admin-facing user fields. |
src/main/java/com/booker/controllers/UserController.java |
Changes admin-only GET /users to return admin DTOs. |
src/main/java/com/booker/DTO/User/UpdateUserDTO.java |
Extends update payload with role and accountNonLocked. |
src/main/java/com/booker/DTO/User/AdminUserDTO.java |
Introduces new admin-facing user DTO. |
Contributor
Co-authored-by: Mats057 <119885089+Mats057@users.noreply.github.com>
✅ Test Results - Booker API📊 Summary
🎉 Ready to merge! 📁 View Test Reports |
Enforce "self or admin" authorization on PATCH /users/{id}
✅ Test Results - Booker API📊 Summary
🎉 Ready to merge! 📁 View Test Reports |
✅ Test Results - Booker API📊 Summary
🎉 Ready to merge! 📁 View Test Reports |
gustavo-atanazio
approved these changes
Mar 7, 2026
✅ Test Results - Booker API📊 Summary
🎉 Ready to merge! 📁 View Test Reports |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces enhancements to user management, particularly around admin-level operations and user updates. The main changes include the creation of a new
AdminUserDTOfor exposing additional user fields to admins, updates to allow modifying user roles and account status with proper access control, and improvements to user uniqueness checks. Below are the key changes grouped by theme:Admin User Data Exposure and Mapping:
AdminUserDTOrecord to represent user data with admin-specific fields such asrole,accountNonLocked, and timestamps.UserController'sgetAllendpoint to return a page ofAdminUserDTOinstead of the standardUserDTO, and mapped users to this new DTO using a newtoAdminDTOmethod inUserMapper. [1] [2]User Update Enhancements and Access Control:
UpdateUserDTOto includeroleandaccountNonLockedfields, allowing these properties to be updated.UserService.updatemethod to:roleandaccountNonLockedif the current user has admin privileges, throwing anAccessDeniedExceptionotherwise.Repository Improvements:
existsByUsernameAndIdNotandexistsByEmailAndIdNotmethods toUserRepositoryto support uniqueness checks during user updates.Supporting Imports and Constants:
These changes collectively strengthen admin capabilities, enforce stricter access control, and improve the reliability of user data updates.