Use Better Auth impersonation and add user bans

.github/workflows/ci.yaml

@@ -30,6 +30,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Validate Prisma schema
+        run: pnpm exec prisma validate
+
       - name: Run lint
         run: pnpm lint
 

prisma/migrations/20260903000000_add_better_auth_impersonation/migration.sql

@@ -0,0 +1,8 @@
+-- Add the fields required by Better Auth's admin plugin.
+ALTER TABLE "User"
+  ADD COLUMN "banned" BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN "banReason" TEXT,
+  ADD COLUMN "banExpires" TIMESTAMP(3);
+
+ALTER TABLE "Session"
+  ADD COLUMN "impersonatedBy" TEXT;

prisma/schema/session.prisma

@@ -5,6 +5,7 @@ model Session {
   expiresAt DateTime
   ipAddress String?
   userAgent String?
+  impersonatedBy String?
   user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
 
   createdAt DateTime @default(now())

prisma/schema/user.prisma

@@ -5,6 +5,9 @@ model User {
   emailVerified    Boolean   @default(false)
   image            String?
   role             UserRole?
+  banned           Boolean   @default(false)
+  banReason        String?
+  banExpires       DateTime?
   pushSubscription String?
   accounts         Account[]
   sessions         Session[]

src/app/api/users/route.ts

@@ -74,6 +74,9 @@ export async function GET(request: NextRequest) {
         name: true,
         email: true,
         role: true,
+        banned: true,
+        banReason: true,
+        banExpires: true,
         createdAt: true,
         updatedAt: true,
       },

src/app/users/BanUserDialog.test.tsx

@@ -0,0 +1,53 @@
+import { render, screen } from '@/test/test-utils';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, it, vi } from 'vitest';
+import { BanUserDialog } from './BanUserDialog';
+
+describe('BanUserDialog', () => {
+  const defaultProps = {
+    isOpen: true,
+    onOpenChange: vi.fn(),
+    userToBan: { name: 'Test User' },
+    onConfirm: vi.fn().mockResolvedValue(undefined),
+    isLoading: false,
+  };
+
+  it('renders shadcn inputs and user details', () => {
+    render(<BanUserDialog {...defaultProps} />);
+
+    expect(
+      screen.getByRole('heading', { name: 'Ban User' })
+    ).toBeInTheDocument();
+    expect(screen.getByLabelText('Reason')).toBeInTheDocument();
+    expect(screen.getByLabelText('Ban ends')).toHaveAttribute(
+      'type',
+      'datetime-local'
+    );
+  });
+
+  it('requires a reason', async () => {
+    const user = userEvent.setup();
+    render(<BanUserDialog {...defaultProps} />);
+
+    await user.click(screen.getByRole('button', { name: 'Ban User' }));
+
+    expect(defaultProps.onConfirm).not.toHaveBeenCalled();
+    expect(screen.getByRole('alert')).toHaveTextContent(
+      'A reason is required.'
+    );
+  });
+
+  it('submits the reason and end time', async () => {
+    const user = userEvent.setup();
+    render(<BanUserDialog {...defaultProps} />);
+
+    await user.type(screen.getByLabelText('Reason'), 'Abuse of service');
+    await user.type(screen.getByLabelText('Ban ends'), '2030-01-01T12:00');
+    await user.click(screen.getByRole('button', { name: 'Ban User' }));
+
+    expect(defaultProps.onConfirm).toHaveBeenCalledWith({
+      banReason: 'Abuse of service',
+      banExpiresAt: '2030-01-01T12:00',
+    });
+  });
+});