From a251a343bdb9fccd1781c21f1ec2af21aa7d5c5c Mon Sep 17 00:00:00 2001 From: Your Name Date: Wed, 22 Jul 2026 22:02:15 +0500 Subject: [PATCH] Add admin user delete route --- src/vk_parser_app/admin.py | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/src/vk_parser_app/admin.py b/src/vk_parser_app/admin.py index 5245afa..2796872 100644 --- a/src/vk_parser_app/admin.py +++ b/src/vk_parser_app/admin.py @@ -3907,3 +3907,24 @@ async def user_toggle(request: Request, user_id: int, csrf_token: str = Form(... await pool.execute("UPDATE admin_users SET is_active=NOT is_active, updated_at=NOW() WHERE id=$1", user_id) await audit(user["id"], "user.toggle", "user", user_id) return redirect("/users") + + +@app.post("/users/{user_id}/delete") +async def user_delete(request: Request, user_id: int, csrf_token: str = Form(...)): + user = await get_current_user(request) + if not user: + return redirect("/login") + require_csrf(user, csrf_token) + if user["role"] != "admin" or int(user["id"]) == user_id: + return redirect("/users") + pool = await get_pool() + bootstrap_login = settings.admin_bootstrap_login.strip().lower() + target = await pool.fetchrow("SELECT id, login, role FROM admin_users WHERE id=$1", user_id) + if not target: + return redirect("/users") + if str(target["login"]).strip().lower() == bootstrap_login: + logger.warning("Attempt to delete bootstrap admin '{}' was blocked", bootstrap_login) + return redirect("/users") + await pool.execute("DELETE FROM admin_users WHERE id=$1", user_id) + await audit(user["id"], "user.delete", "user", user_id, None, {"login": target["login"], "role": target["role"]}) + return redirect("/users")