Development: Let admins manage every user from one place

openapi/openapi.yaml

@@ -94,6 +94,126 @@ paths:
           content:
             application/json:
               schema: {$ref: '#/components/schemas/AdminExportTaskDTO'}
+  /api/admin/users:
+    get:
+      tags: [user-admin-resource]
+      operationId: getAllUsers
+      parameters:
+      - name: pageSize
+        in: query
+        required: false
+        schema: {type: integer, format: int32, minimum: 1}
+      - name: pageNumber
+        in: query
+        required: false
+        schema: {type: integer, format: int32, minimum: 0}
+      - name: sortBy
+        in: query
+        required: false
+        schema: {type: string}
+      - name: direction
+        in: query
+        required: false
+        schema:
+          type: string
+          enum: [ASC, DESC]
+      - name: roles
+        in: query
+        required: false
+        schema:
+          type: array
+          items:
+            type: string
+            enum: [APPLICANT, PROFESSOR, ADMIN, EMPLOYEE]
+      - name: researchGroupIds
+        in: query
+        required: false
+        schema:
+          type: array
+          items: {type: string, format: uuid}
+      - name: searchQuery
+        in: query
+        required: false
+        schema: {type: string}
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/PageAdminUserOverviewDTO'}
+    post:
+      tags: [user-admin-resource]
+      operationId: createUser
+      requestBody:
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/CreateUserDTO'}
+        required: true
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/AdminUserDetailDTO'}
+  /api/admin/users/import:
+    post:
+      tags: [user-admin-resource]
+      operationId: importUser
+      requestBody:
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/ImportUserDTO'}
+        required: true
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/AdminUserDetailDTO'}
+  /api/admin/users/{userId}:
+    get:
+      tags: [user-admin-resource]
+      operationId: getUser
+      parameters:
+      - name: userId
+        in: path
+        required: true
+        schema: {type: string, format: uuid}
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/AdminUserDetailDTO'}
+    put:
+      tags: [user-admin-resource]
+      operationId: updateUser
+      parameters:
+      - name: userId
+        in: path
+        required: true
+        schema: {type: string, format: uuid}
+      requestBody:
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/UpdateUserDTO'}
+        required: true
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/AdminUserDetailDTO'}
+    delete:
+      tags: [user-admin-resource]
+      operationId: deleteUser
+      parameters:
+      - name: userId
+        in: path
+        required: true
+        schema: {type: string, format: uuid}
+      responses:
+        '200': {description: OK}
   /api/ai/analyze-job-description:
     post:
       tags: [ai-resource]
@@ -3000,6 +3120,9 @@ components:
           items: {$ref: '#/components/schemas/KeycloakUserDTO'}
           minItems: 1
         researchGroupId: {type: string, format: uuid}
+        role:
+          type: string
+          enum: [APPLICANT, PROFESSOR, ADMIN, EMPLOYEE]
       required: [keycloakUsers]
     AdminApplicationOverviewDTO:
       type: object
@@ -3064,6 +3187,47 @@ components:
             APPLICATIONS_ONLY]
         userResearchGroupRoles: {$ref: '#/components/schemas/Counts'}
         users: {$ref: '#/components/schemas/Counts'}
+    AdminUserDetailDTO:
+      type: object
+      properties:
+        aiFeaturesEnabled: {type: boolean}
+        avatar: {type: string}
+        birthday: {type: string, format: date}
+        createdAt: {type: string, format: date-time}
+        email: {type: string}
+        firstName: {type: string}
+        gender: {type: string}
+        lastActivityAt: {type: string, format: date-time}
+        lastName: {type: string}
+        linkedinUrl: {type: string}
+        nationality: {type: string}
+        phoneNumber: {type: string}
+        primaryRole:
+          type: string
+          enum: [APPLICANT, PROFESSOR, ADMIN, EMPLOYEE]
+        researchGroupId: {type: string, format: uuid}
+        researchGroupName: {type: string}
+        selectedLanguage: {type: string}
+        universityId: {type: string}
+        userId: {type: string, format: uuid}
+        website: {type: string}
+      required: [userId]
+    AdminUserOverviewDTO:
+      type: object
+      properties:
+        avatar: {type: string}
+        email: {type: string}
+        firstName: {type: string}
+        lastActivityAt: {type: string, format: date-time}
+        lastName: {type: string}
+        primaryRole:
+          type: string
+          enum: [APPLICANT, PROFESSOR, ADMIN, EMPLOYEE]
+        researchGroupId: {type: string, format: uuid}
+        researchGroupName: {type: string}
+        universityId: {type: string}
+        userId: {type: string, format: uuid}
+      required: [userId]
     AiFeatureStatusDTO:
       type: object
       properties:
@@ -3355,6 +3519,26 @@ components:
           items: {$ref: '#/components/schemas/SlotInput'}
           minItems: 1
       required: [slots]
+    CreateUserDTO:
+      type: object
+      properties:
+        birthday: {type: string, format: date}
+        email: {type: string, format: email, minLength: 1}
+        firstName: {type: string, minLength: 1}
+        gender: {type: string}
+        lastName: {type: string, minLength: 1}
+        linkedinUrl: {type: string}
+        nationality: {type: string}
+        password: {type: string, maxLength: 2147483647, minLength: 8}
+        phoneNumber: {type: string}
+        primaryRole:
+          type: string
+          enum: [APPLICANT, PROFESSOR, ADMIN, EMPLOYEE]
+        researchGroupId: {type: string, format: uuid}
+        selectedLanguage: {type: string}
+        universityId: {type: string}
+        website: {type: string}
+      required: [email, firstName, lastName, password]
     CreatedJobDTO:
       type: object
       properties:
@@ -3555,6 +3739,11 @@ components:
         sizeBytes: {type: integer, format: int64}
         uploadedById: {type: string, format: uuid}
         url: {type: string}
+    ImportUserDTO:
+      type: object
+      properties:
+        universityId: {type: string, minLength: 1}
+      required: [universityId]
     InternalCommentDTO:
       type: object
       properties:
@@ -3936,6 +4125,22 @@ components:
         sort: {$ref: '#/components/schemas/SortObject'}
         totalElements: {type: integer, format: int64}
         totalPages: {type: integer, format: int32}
+    PageAdminUserOverviewDTO:
+      type: object
+      properties:
+        content:
+          type: array
+          items: {$ref: '#/components/schemas/AdminUserOverviewDTO'}
+        empty: {type: boolean}
+        first: {type: boolean}
+        last: {type: boolean}
+        number: {type: integer, format: int32}
+        numberOfElements: {type: integer, format: int32}
+        pageable: {$ref: '#/components/schemas/PageableObject'}
+        size: {type: integer, format: int32}
+        sort: {$ref: '#/components/schemas/SortObject'}
+        totalElements: {type: integer, format: int64}
+        totalPages: {type: integer, format: int32}
     PageApplicationOverviewDTO:
       type: object
       properties:
@@ -4357,6 +4562,25 @@ components:
       properties:
         location: {type: string, minLength: 1}
       required: [location]
+    UpdateUserDTO:
+      type: object
+      properties:
+        aiFeaturesEnabled: {type: boolean}
+        avatar: {type: string}
+        birthday: {type: string, format: date}
+        firstName: {type: string}
+        gender: {type: string}
+        lastName: {type: string}
+        linkedinUrl: {type: string}
+        nationality: {type: string}
+        phoneNumber: {type: string}
+        primaryRole:
+          type: string
+          enum: [APPLICANT, PROFESSOR, ADMIN, EMPLOYEE]
+        researchGroupId: {type: string, format: uuid}
+        selectedLanguage: {type: string}
+        universityId: {type: string}
+        website: {type: string}
     UpdateUserNameDTO:
       type: object
       properties:

src/main/java/de/tum/cit/aet/core/retention/UserRetentionService.java

@@ -155,6 +155,34 @@ public void warnUserOfDataDeletion(LocalDateTime warningDate) {
         }
     }
 
+    /**
+     * Deletes a single user on demand from the admin "Manage Users" page. Reuses the
+     * existing per-category anonymisation helpers and finally removes the user row.
+     * Unlike {@link #processUserIdsList(List, LocalDateTime, boolean)}, this method
+     * does not skip admins — the caller is responsible for preventing self-delete.
+     *
+     * @param userId the user UUID to delete
+     */
+    @Transactional
+    public void deleteUserByAdmin(UUID userId) {
+        Optional<User> userOpt = userRepository.findWithResearchGroupRolesByUserId(userId);
+        if (userOpt.isEmpty()) {
+            log.info("Admin delete: userId={} not found, nothing to do", userId);
+            return;
+        }
+        User user = userOpt.get();
+        RetentionCategory category = classify(user);
+
+        if (category == RetentionCategory.PROFESSOR_OR_EMPLOYEE || category == RetentionCategory.SKIP_ADMIN) {
+            // 1) Treat admins identically to professor/employee for anonymisation purposes.
+            handleProfessorOrEmployee(user, false);
+        } else if (category == RetentionCategory.APPLICANT) {
+            handleApplicant(user, false);
+        }
+        // 2) UNKNOWN users have no FKs to anonymise; jump straight to general cleanup.
+        handleGeneralData(user, false);
+    }
+
     // Helper methods for handling different categories
 
     private RetentionCategory classify(User user) {

src/main/java/de/tum/cit/aet/core/util/PageUtil.java

@@ -49,6 +49,11 @@ public enum ColumnMapping {
          */
         SCHOOLS_ADMIN(Set.of("name", "abbreviation")),
 
+        /**
+         * Sortable columns used in admin "Manage Users" listings.
+         */
+        USERS_ADMIN(Set.of("firstName", "lastName", "email", "universityId", "lastActivityAt")),
+
         /**
          * Sortable columns used in applicant's application listings.
          */

src/main/java/de/tum/cit/aet/usermanagement/dto/AddMembersToResearchGroupDTO.java

@@ -1,9 +1,20 @@
 package de.tum.cit.aet.usermanagement.dto;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
+import de.tum.cit.aet.usermanagement.constants.UserRole;
 import jakarta.validation.constraints.NotEmpty;
 import java.util.List;
 import java.util.UUID;
 
 @JsonInclude(JsonInclude.Include.NON_NULL)
-public record AddMembersToResearchGroupDTO(@NotEmpty List<KeycloakUserDTO> keycloakUsers, UUID researchGroupId) {}
+public record AddMembersToResearchGroupDTO(@NotEmpty List<KeycloakUserDTO> keycloakUsers, UUID researchGroupId, UserRole role) {
+    /**
+     * Returns the role to assign to the added members, defaulting to {@link UserRole#EMPLOYEE}
+     * when no role was specified by the caller (back-compat).
+     *
+     * @return the resolved {@link UserRole}, never {@code null}
+     */
+    public UserRole roleOrDefault() {
+        return role == null ? UserRole.EMPLOYEE : role;
+    }
+}

src/main/java/de/tum/cit/aet/usermanagement/dto/AdminUserDetailDTO.java

@@ -0,0 +1,32 @@
+package de.tum.cit.aet.usermanagement.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import de.tum.cit.aet.usermanagement.constants.UserRole;
+import jakarta.validation.constraints.NotNull;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.util.UUID;
+
+/** Full admin-scoped user detail DTO returned by the view / edit page. */
+@JsonInclude(JsonInclude.Include.NON_EMPTY)
+public record AdminUserDetailDTO(
+    @NotNull UUID userId,
+    String firstName,
+    String lastName,
+    String email,
+    String avatar,
+    String universityId,
+    UserRole primaryRole,
+    UUID researchGroupId,
+    String researchGroupName,
+    String phoneNumber,
+    String gender,
+    String nationality,
+    LocalDate birthday,
+    String website,
+    String linkedinUrl,
+    String selectedLanguage,
+    Boolean aiFeaturesEnabled,
+    LocalDateTime createdAt,
+    LocalDateTime lastActivityAt
+) {}