Add banned_users endpoint to AdminController and update routes (#870)

* Add banned_users endpoint to AdminController and update routes

* Merge branch 'main' into addingGetBanAdminAPI_Endpoint

* move function out of private

* docs

* re swaggerize

app/controllers/api/admin/v1/admin_controller.rb

@@ -818,6 +818,25 @@ module Api
           render json: { counts: counts }
         end
 
+        def banned_users
+          limit = [ params.fetch(:limit, 200).to_i, 1000 ].min
+          offset = [ params.fetch(:offset, 0).to_i, 0 ].max
+
+          banned = User.where(trust_level: User.trust_levels[:red])
+            .left_joins(:email_addresses)
+            .select("users.id, users.username, MIN(email_addresses.email) AS email")
+            .group("users.id, users.username")
+            .order("users.id")
+            .limit(limit)
+            .offset(offset)
+
+          render json: {
+            banned_users: banned.map { |u|
+              { id: u.id, username: u.username, email: u.email || "no email" }
+            }
+          }
+        end
+
         private
 
         def can_write!

config/routes.rb

@@ -220,6 +220,7 @@ Rails.application.routes.draw do
         get "user/stats", to: "admin#user_stats"
         get "user/projects", to: "admin#user_projects"
         get "user/trust_logs", to: "admin#trust_logs"
+        get "banned_users", to: "admin#banned_users"
         post "user/get_user_by_email", to: "admin#get_user_by_email"
         post "user/search_fuzzy", to: "admin#search_users_fuzzy"
         post "user/convict", to: "admin#user_convict"

spec/requests/api/admin/v1/admin_users_spec.rb

@@ -51,4 +51,41 @@ RSpec.describe 'Api::Admin::V1::AdminUsers', type: :request do
       end
     end
   end
+
+  path '/api/admin/v1/banned_users' do
+    get('Get banned users') do
+      tags 'Admin'
+      description 'Get a list of banned users.'
+      security [ AdminToken: [] ]
+      produces 'application/json'
+
+      parameter name: :limit, in: :query, type: :integer, required: false, description: 'Max results to return (default: 200, max: 1000)'
+      parameter name: :offset, in: :query, type: :integer, required: false, description: 'Number of results to skip for pagination (default: 0)'
+
+      response(200, 'successful') do
+        schema type: :object,
+          properties: {
+            banned_users: {
+              type: :array,
+              items: {
+                type: :object,
+                properties: {
+                  id: { type: :integer, description: 'User ID' },
+                  username: { type: :string, description: 'Username' },
+                  email: { type: :string, description: 'Primary email or "no email"' }
+                }
+              }
+            }
+          }
+
+        let(:Authorization) { "Bearer dev-admin-api-key-12345" }
+        run_test!
+      end
+
+      response(403, 'forbidden') do
+        let(:Authorization) { "Bearer viewer-api-key" }
+        run_test!
+      end
+    end
+  end
 end

swagger/v1/swagger.yaml

@@ -1439,6 +1439,51 @@ paths:
       responses:
         '200':
           description: successful
+  "/api/admin/v1/banned_users":
+    get:
+      summary: Get banned users
+      tags:
+      - Admin
+      description: Get a list of banned users.
+      security:
+      - AdminToken: []
+      parameters:
+      - name: limit
+        in: query
+        required: false
+        description: 'Max results to return (default: 200, max: 1000)'
+        schema:
+          type: integer
+      - name: offset
+        in: query
+        required: false
+        description: 'Number of results to skip for pagination (default: 0)'
+        schema:
+          type: integer
+      responses:
+        '200':
+          description: successful
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  banned_users:
+                    type: array
+                    items:
+                      type: object
+                      properties:
+                        id:
+                          type: integer
+                          description: User ID
+                        username:
+                          type: string
+                          description: Username
+                        email:
+                          type: string
+                          description: Primary email or "no email"
+        '403':
+          description: forbidden
   "/api/admin/v1/permissions":
     get:
       summary: List Permissions