Users

​

Get All Users

• Endpoint: GET /api/users
• Authentication: Required (admin only)
• Response: The password field is stripped from every record.

{
  "success": true,
  "data": [
    { "username": "admin", "isAdmin": true },
    { "username": "alice", "isAdmin": false }
  ]
}

​

Get a User

• Endpoint: GET /api/users/:username
• Authentication: Required (admin only)
• Response:

{
  "success": true,
  "data": { "username": "alice", "isAdmin": false }
}

​

Create a User

• Endpoint: POST /api/users
• Authentication: Required (admin only)
• Body:

{
  "username": "alice",
  "password": "P@ssw0rd-123",
  "isAdmin": false
}

• Returns 400 if username/password are missing, the password is too weak, or the username is already taken.
• Returns 201 with the new user (password stripped) on success.

​

Update a User

• Endpoint: PUT /api/users/:username
• Authentication: Required (admin only)
• Body (at least one field is required):

{
  "isAdmin": true,
  "newPassword": "Newp@ssw0rd"
}

• Returns 400 if neither field is supplied, the password fails validation, or the request would demote the last remaining admin.
• Returns 404 if the username does not exist.

​

Delete a User

• Endpoint: DELETE /api/users/:username
• Authentication: Required (admin only)
• Restrictions:
  • You cannot delete your own account.
  • You cannot delete the last admin.

{
  "success": true,
  "message": "User deleted successfully"
}

​

Get User Statistics

• Endpoint: GET /api/users-stats
• Authentication: Required (admin only)

{
  "success": true,
  "data": {
    "totalUsers": 5,
    "adminUsers": 1,
    "regularUsers": 4
  }
}