feat: add admin KYC review endpoint (closes #59) - #1
Closed
shaaibu7 wants to merge 76 commits into
Closed
Conversation
Project Structure Initialized
- Install and configure cors middleware - Restrict allowed origins to ALLOWED_ORIGINS env variable (comma-separated) - Allow methods: GET, POST, PUT, PATCH, DELETE - Allow headers: Authorization, Content-Type - Requests from disallowed origins will receive a CORS error Configure CORS Policy Fixes Merzher#6
Created src/middlewares/validate.js for validating req.body against Joi schemas - Returned 400 Bad Request with structured field-level errors on validation failure - Added example validators in src/validators/auth.validators.js (register/login schemas)
…sted-origins feat: configure CORS middleware for trusted origins
feat: add reusable Joi request validation middleware, closes Merzher#3
Setup CI/CD Pipeline to Run Linting, Tests, and Build
Configure-Environment-Variables-Setup-Global-Error-Handling-Middleware
…-Error-Handling-Middleware
set up the npm run lint to check for errors
created user schema, closes Merzher#9
…iables-Setup-Global-Error-Handling-Middleware Configure-Environment-Variables-Setup-Global-Error-Handling-Middleware
…ility-Helper feat: Add API Response Utility Helper
chore: setup ESLint and Prettier (Merzher#7)
…tility - Create logger utility (src/utils/logger.js) with stream interface for Morgan - Update Morgan configuration to use dev format in development and combined format in production - Stream Morgan output through custom logger using console.log - All acceptance criteria met: environment-aware formats, custom logger, Morgan integration, quality checks pass
feat(logging): add HTTP request logging with morgan for dev and production environments (Merzher#5)
…point The User Registration endpoint has been created accordingly
feat(auth): implement login endpoint with JWT tokens
Implement reset password endpoint
Made-with: Cursor
…t-password-endpoint feat: implement forgot password endpoint
…astructure for admin-exclusive routes
…n-middleware Implement the role-based authorization middleware and set up the infrastructure for admin-exclusive routes
Implement-Token-Refresh-Endpoin
…ndpoint Implement-Token-Refresh-Endpoin
…d-Endpoint-#28 feat:Add Change Password Endpoint Merzher#28
user endpoint
updated workflow file
feat: user kyc endpoint
feat: add GET /api/admin/kyc endpoint
) - Add deletedAt field to User model for soft delete - Add Mongoose middleware to exclude deleted users from queries - Create DELETE /api/admin/users/:id endpoint - Add isAdmin middleware for role verification - Prevent admins from deleting their own account - Add restore endpoint for soft-deleted users
- Install multer for file upload handling - Add avatar field to User model to store file path - Create POST /api/users/me/avatar endpoint for profile picture uploads - Implement file validation: only JPEG/PNG, max 2MB - Add static file serving to make avatars accessible - Auto-delete old avatars when new ones are uploaded - Add uploads directory to .gitignore
…61-admin-delete-user feat: add admin delete user endpoint with soft delete (Closes Merzher#61)
feat: add user profile picture upload functionality
Add PATCH /api/admin/kyc/:id for admins to review KYC submissions. - Requires authentication and admin role (reuses existing middleware) - Validates body with Joi: status (approved|rejected) required, optional reviewNote - Updates the user's kycStatus and kycReviewNotes - Emails the user about the decision via a new KYC decision template (non-blocking so the review still succeeds if email delivery fails) - Adds tests covering auth, role, validation, 404, approve and reject
Author
|
Closing — opened against the wrong upstream by mistake. Reopened on Merzher#68. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an admin-only endpoint that lets admins review KYC submissions and update their status, notifying the user of the decision by email.
Closes Merzher#59
Changes
PATCH /api/admin/kyc/:idadded to the admin router (already gated byauthenticate+isAdmin, so it's admin-only).reviewKycSchema, Joi):statusis required and must beapprovedorrejected;reviewNoteis optional (trimmed, max 1000 chars).reviewKyc): looks up the user (404 if missing), updateskycStatusandkycReviewNotes, saves, then emails the user. Email sending is non-blocking — the review still succeeds if delivery fails (matching the existing pattern inauth.controller.js).kycDecision.template.js): approved/rejected HTML variants, styled consistently with the existing welcome/password-reset templates, and includes the reviewer note when present.admin.kyc.test.js): cover auth required, non-admin rejected, invalid status, 404, approve, and reject.Reuses the existing
Usermodel fields (kycStatus,kycReviewNotes),email.service, andresponseutilities — no schema changes.Notes
node --check, and the tests follow the existingusers.kyc.test.jsmocking style. Please runnpm install && npm testto confirm.