Admin: Event moderation + user management

[manoahLinks]

Summary

Admin endpoints for managing events (moderation, status changes) and users (role management, account actions). Gives platform administrators control over content and users.

Endpoints

List All Events (Admin View)

GET /api/admin/events
Auth: ADMIN

Query Parameters:

Param	Type	Default	Description
page	number	1	Page number
limit	number	20	Items per page
status	EventStatus	—	Filter by status
search	string	—	Search by name or organizer email
category	EventCategory	—	Filter by category

Response includes: Event details + organizer info + sales stats (same as organizer view but for ALL events).

Cancel Event (Admin Override)

POST /api/admin/events/:id/cancel
Auth: ADMIN

Admins can cancel any event regardless of sales or refundability. Used for policy violations.

{
  "reason": "Policy violation: misleading event description"
}

List All Users

GET /api/admin/users
Auth: ADMIN

Query Parameters:

Param	Type	Default	Description
page	number	1	Page number
limit	number	20	Items per page
role	UserRole	—	Filter by BUYER, ORGANIZER, ADMIN
search	string	—	Search by name or email

Response:

{
  "success": true,
  "data": {
    "users": [
      {
        "id": "uuid",
        "email": "john@example.com",
        "firstName": "John",
        "lastName": "Doe",
        "role": "ORGANIZER",
        "phone": "+2348012345678",
        "kycStatus": "VERIFIED",
        "kycTier": "BASIC",
        "eventsCount": 5,
        "ticketsBought": 12,
        "createdAt": "2026-01-15T10:00:00Z"
      }
    ],
    "pagination": { ... }
  }
}

Update User Role

PATCH /api/admin/users/:id/role
Auth: ADMIN

{
  "role": "ORGANIZER"
}

Used to manually upgrade/downgrade users or grant ADMIN access.

Suspend User (Future Enhancement)

Not in initial scope but keep in mind for schema additions later.

Tasks

• Implement AdminService.getAllEvents() — all events with organizer info and stats
• Implement AdminService.cancelEvent() — admin override cancellation with reason
• Implement AdminService.getAllUsers() — user list with KYC status and activity counts
• Implement AdminService.updateUserRole() — change user role
• Add all endpoints to AdminController with @Roles(UserRole.ADMIN)

Security Notes

• Admin role changes should be logged (audit trail)
• Prevent admins from removing their own ADMIN role
• Admin event cancellation should record the reason for accountability

Acceptance Criteria

• All events visible to admin (including DRAFT)
• Admin can cancel any event with a reason
• User list includes KYC status and activity metrics
• Role changes work (with self-demotion protection)
• All endpoints restricted to ADMIN role
• Search works on names and emails