fix: Multiple Admin Support by SyedHannanMehdi · Pull Request #46 · Fahad-Dezloper/Crowdify

SyedHannanMehdi · 2026-03-29T20:58:36Z

Automated fix for #27 — implemented by CashClaw agent.

Closes #27

…min invites

vercel · 2026-03-29T20:58:41Z

@SyedHannanMehdi is attempting to deploy a commit to the fahad-dezloper's projects Team on Vercel.

A member of the Team first needs to authorize it.

Copilot

Pull request overview

Adds an admin-role system intended to support multiple admins by introducing a role enum, invite flow, and admin-only API endpoints.

Changes:

Introduces AdminRole, User.role, and an AdminInvite model + migration.
Adds admin helper utilities (getCurrentUser, role hierarchy checks) and admin API routes to list users, update roles, and issue/accept invites.
Adds a new NextAuth configuration (authOptions) and NextAuth type augmentation for session.user.role.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
types/next-auth.d.ts	Extends NextAuth session/user types to include `id` and `role`.
prisma/schema.prisma	Replaces Prisma schema with AdminRole + invite + (unrelated) new auth/campaign models.
prisma/migrations/20240101000000_add_admin_roles/migration.sql	Adds AdminRole enum, `User.role`, and `AdminInvite` table.
lib/auth.ts	Adds NextAuth `authOptions` with PrismaAdapter and a session callback adding role/id.
lib/admin.ts	Adds helpers for current user lookup, role checks, and seeding a super admin.
app/api/admin/users/route.ts	Adds admin-protected endpoint to list users (and roles).
app/api/admin/users/[id]/role/route.ts	Adds super-admin-only role update/removal endpoints.
app/api/admin/invite/route.ts	Adds super-admin invite creation and pending-invite listing endpoints.
app/api/admin/invite/accept/route.ts	Adds endpoint for an authenticated user to accept an invite token.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-29T21:04:23Z

+  const updated = await prisma.user.update({
+    where: { id },
+    data: { role: null },
+    select: { id: true, name: true, email: true, role: true },
+  });


Same as PATCH: prisma.user.update will throw if id doesn’t exist, causing an unhandled 500. Consider handling the “user not found” case and returning 404 for invalid ids.

Copilot · 2026-03-29T21:04:23Z

+// GET /api/admin/users  — list all users with roles (ADMIN+)
+export async function GET() {
+  const user = await getCurrentUser();
+
+  if (!user || !hasRole(user.role, AdminRole.ADMIN)) {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  const users = await prisma.user.findMany({


The comment says this endpoint lists “all users with roles”, but the query returns all users (including those with role: null). Either update the comment to match behavior or filter the query (e.g., where: { role: { not: null } }) if the endpoint should only return admins.

Copilot · 2026-03-29T21:04:23Z

+enum AdminRole {
+  SUPER_ADMIN
+  ADMIN
+  MODERATOR
 }

-model Room {
-  id           String     @id @default(uuid())
-  code         String     @unique
-  name         String
-  adminId      String
-  admin        User       @relation(fields: [adminId], references: [id])
-  users        RoomUser[]
-  streams      Stream[]
-  messages     Message[]
-  allowSongAdd Boolean    @default(true) // Admin can control this
-  createdAt    DateTime   @default(now())
+model User {
+  id            String    @id @default(cuid())
+  name          String?
+  email         String?   @unique
+  emailVerified DateTime?
+  image         String?
+  role          AdminRole?
+  accounts      Account[]
+  sessions      Session[]
+  campaigns     Campaign[]
+  donations     Donation[]
+  adminInvitesSent AdminInvite[] @relation("InvitedBy")
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
 }


prisma/schema.prisma has been rewritten to a completely different domain model (Campaign/Donation + NextAuth Account/Session tables) and removes existing models (e.g., Room/RoomUser/Stream/Upvote/Message) that are referenced throughout the app (e.g., prismaClient.room in app/api/room/create). This will break Prisma Client generation and runtime queries, and it also no longer matches the existing migration history. Suggestion: revert to the current schema and apply the “multiple admin support” change incrementally (e.g., add AdminRole + User.role + AdminInvite while keeping the existing Room/Stream models intact).

Copilot · 2026-03-29T21:04:23Z

+-- AlterTable: Add role to User
+ALTER TABLE "User" ADD COLUMN "role" "AdminRole";
+


The migration folder name 20240101000000_add_admin_roles sorts before the existing 202502..._init migration, but it runs ALTER TABLE "User" ... which will fail if User hasn’t been created yet. Rename/regenerate this migration with a timestamp after the latest migration and ensure it is based on the current schema state so it applies cleanly.

Copilot · 2026-03-29T21:04:24Z

+import { NextAuthOptions } from "next-auth";
+import GoogleProvider from "next-auth/providers/google";
+import { PrismaAdapter } from "@auth/prisma-adapter";
+import { prisma } from "@/lib/prisma";
+
+export const authOptions: NextAuthOptions = {
+  // @ts-ignore – PrismaAdapter type mismatch between next-auth versions
+  adapter: PrismaAdapter(prisma),


lib/auth.ts won’t compile as-is: it imports PrismaAdapter from @auth/prisma-adapter, but that package isn’t listed in package.json, and it also imports prisma from @/lib/prisma which doesn’t exist in the repo. Either add the missing dependency and a lib/prisma.ts singleton (or switch these imports to the existing prismaClient from app/lib/db.ts) so the auth configuration can actually be used.

Copilot · 2026-03-29T21:04:24Z

+import { getServerSession } from "next-auth";
+import { authOptions } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
+import { AdminRole } from "@prisma/client";
+
+/**
+ * Returns the current session's user with their role,
+ * or null if the user is not authenticated.
+ */
+export async function getCurrentUser() {
+  const session = await getServerSession(authOptions);
+  if (!session?.user?.email) return null;


getServerSession(authOptions) here will only work if the same authOptions is also used by the NextAuth handler in app/api/auth/[...nextauth]/route.ts. Currently the repo defines NextAuth options inline in that route (no adapter / different callbacks), so this can lead to sessions not being decoded or user data not matching. Consider centralizing the NextAuth config (export authOptions and use it both in the handler and in getServerSession).

Copilot · 2026-03-29T21:04:24Z

+  const updated = await prisma.user.update({
+    where: { id },
+    data: { role: role ?? null },
+    select: { id: true, name: true, email: true, role: true },
+  });


prisma.user.update({ where: { id } ... }) will throw a Prisma P2025 error if the user id doesn’t exist, which will currently surface as a 500 from the route. Handle the “record not found” case explicitly (e.g., catch Prisma known request errors and return 404).

… non-admins)

…y add AdminRole enum, User.role, and AdminInvite incrementally

…2502..._init migration and runs after User table is created

…01000000_add_admin_roles which has correct ordering

SyedHannanMehdi added 9 commits March 30, 2026 02:27

feat: add AdminRole enum and AdminInvite table migration

da2a15f

feat: update Prisma schema with AdminRole enum and AdminInvite model

cd0060b

feat: add admin utility helpers (role check, getCurrentUser)

fa96ab0

feat: extend NextAuth session to include user id and role

44ff4ba

feat: extend NextAuth types to include id and role on session user

baef842

feat: add POST/GET /api/admin/invite route for sending and listing ad…

853a753

…min invites

feat: add POST /api/admin/invite/accept route to accept admin invites

8902256

feat: add GET /api/admin/users route to list all users with roles

08f8b1c

feat: add PATCH/DELETE /api/admin/users/[id]/role for role management

e9ce040

Copilot AI review requested due to automatic review settings March 29, 2026 20:58

Copilot started reviewing on behalf of SyedHannanMehdi March 29, 2026 20:59 View session

Copilot AI reviewed Mar 29, 2026

View reviewed changes

SyedHannanMehdi added 5 commits March 30, 2026 02:57

fix: handle user-not-found with 404 in PATCH and DELETE role routes

4fb4fe4

fix: clarify comment — endpoint lists all users (role may be null for…

9b1d753

… non-admins)

fix: revert schema to preserve Room/Stream/Message/Upvote models; onl…

19283a9

…y add AdminRole enum, User.role, and AdminInvite incrementally

fix: rename migration to 20250601000000 so it sorts after existing 20…

603a58f

…2502..._init migration and runs after User table is created

fix: mark old migration (20240101) as superseded — replaced by 202506…

086eccd

…01000000_add_admin_roles which has correct ordering

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: Multiple Admin Support#46

fix: Multiple Admin Support#46
SyedHannanMehdi wants to merge 14 commits into
Fahad-Dezloper:mainfrom
SyedHannanMehdi:cashclaw/fix-27-multiple-admin-support

SyedHannanMehdi commented Mar 29, 2026

Uh oh!

vercel Bot commented Mar 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		-- AlterTable: Add role to User
		ALTER TABLE "User" ADD COLUMN "role" "AdminRole";

Conversation

SyedHannanMehdi commented Mar 29, 2026

Uh oh!

vercel Bot commented Mar 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants