BTCPay-infrastructure-recovery

LittleShop/Areas/Admin/Controllers/UsersController.cs

@@ -30,19 +30,28 @@ public class UsersController : Controller
     [HttpPost]
     public async Task<IActionResult> Create(CreateUserDto model)
     {
-        if (!ModelState.IsValid)
+        try
         {
+            if (!ModelState.IsValid)
+            {
+                return View(model);
+            }
+
+            var user = await _authService.CreateUserAsync(model);
+            if (user == null)
+            {
+                ModelState.AddModelError("Username", "User with this username already exists");
+                return View(model);
+            }
+
+            TempData["SuccessMessage"] = $"User '{user.Username}' created successfully";
+            return RedirectToAction(nameof(Index));
+        }
+        catch (Exception ex)
+        {
+            ModelState.AddModelError("", "An error occurred while creating the user: " + ex.Message);
             return View(model);
         }
-
-        var user = await _authService.CreateUserAsync(model);
-        if (user == null)
-        {
-            ModelState.AddModelError("", "User with this username already exists");
-            return View(model);
-        }
-
-        return RedirectToAction(nameof(Index));
     }
 
     public async Task<IActionResult> Edit(Guid id)
@@ -66,25 +75,89 @@ public class UsersController : Controller
     [HttpPost]
     public async Task<IActionResult> Edit(Guid id, UpdateUserDto model)
     {
-        if (!ModelState.IsValid)
+        try
         {
+            // Additional validation for required username
+            if (string.IsNullOrWhiteSpace(model.Username))
+            {
+                ModelState.AddModelError("Username", "Username is required");
+            }
+
+            // Validate password if provided
+            if (!string.IsNullOrEmpty(model.Password) && model.Password.Length < 3)
+            {
+                ModelState.AddModelError("Password", "Password must be at least 3 characters if changing");
+            }
+
+            if (!ModelState.IsValid)
+            {
+                ViewData["UserId"] = id;
+                return View(model);
+            }
+
+            var success = await _authService.UpdateUserAsync(id, model);
+            if (!success)
+            {
+                // Check if it's because of duplicate username
+                var existingUser = await _authService.GetUserByIdAsync(id);
+                if (existingUser == null)
+                {
+                    return NotFound();
+                }
+                
+                ModelState.AddModelError("Username", "Username is already taken by another user");
+                ViewData["UserId"] = id;
+                return View(model);
+            }
+
+            TempData["SuccessMessage"] = "User updated successfully";
+            return RedirectToAction(nameof(Index));
+        }
+        catch (Exception ex)
+        {
+            ModelState.AddModelError("", "An error occurred while updating the user: " + ex.Message);
             ViewData["UserId"] = id;
             return View(model);
         }
-
-        var success = await _authService.UpdateUserAsync(id, model);
-        if (!success)
-        {
-            return NotFound();
-        }
-
-        return RedirectToAction(nameof(Index));
     }
 
     [HttpPost]
     public async Task<IActionResult> Delete(Guid id)
     {
-        await _authService.DeleteUserAsync(id);
-        return RedirectToAction(nameof(Index));
+        try
+        {
+            // Prevent admin user from deleting themselves
+            var currentUserIdClaim = User.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value;
+            if (Guid.TryParse(currentUserIdClaim, out Guid currentUserId) && currentUserId == id)
+            {
+                TempData["ErrorMessage"] = "You cannot delete your own account";
+                return RedirectToAction(nameof(Index));
+            }
+
+            // Get user info for confirmation message
+            var user = await _authService.GetUserByIdAsync(id);
+            if (user == null)
+            {
+                TempData["ErrorMessage"] = "User not found";
+                return RedirectToAction(nameof(Index));
+            }
+
+            var success = await _authService.DeleteUserAsync(id);
+            if (success)
+            {
+                TempData["SuccessMessage"] = $"User '{user.Username}' has been deactivated";
+            }
+            else
+            {
+                TempData["ErrorMessage"] = "Failed to delete user";
+            }
+
+            return RedirectToAction(nameof(Index));
+        }
+        catch (Exception ex)
+        {
+            TempData["ErrorMessage"] = "An error occurred while deleting the user: " + ex.Message;
+            return RedirectToAction(nameof(Index));
+        }
     }
 }