Update main.py

main.py

@@ -1266,6 +1266,128 @@ def process_credit_request(request_id):
     except Exception as e:
         return jsonify({'error': str(e)}), 500
 
+
+@app.route('/api/admin/users', methods=['GET'])
+def admin_list_users():
+    try:
+        verify_admin(request.headers.get('Authorization', ''))
+
+        users_ref = db.reference('users')
+        all_users = users_ref.get() or {}
+        
+        # Convert dict to a list of { uid, ...data }
+        user_list = []
+        for uid, user_data in all_users.items():
+            user_list.append({
+                'uid': uid,
+                'email': user_data.get('email'),
+                'credits': user_data.get('credits', 0),
+                'is_admin': user_data.get('is_admin', False),
+                'created_at': user_data.get('created_at', ''),
+                'suspended': user_data.get('suspended', False)
+            })
+
+        return jsonify({'users': user_list}), 200
+    except Exception as e:
+        return jsonify({'error': str(e)}), 500
+
+@app.route('/api/admin/users/search', methods=['GET'])
+def admin_search_users():
+    try:
+        verify_admin(request.headers.get('Authorization', ''))
+        email_query = request.args.get('email', '').lower().strip()
+        if not email_query:
+            return jsonify({'error': 'email query param is required'}), 400
+
+        users_ref = db.reference('users')
+        all_users = users_ref.get() or {}
+
+        matched_users = []
+        for uid, user_data in all_users.items():
+            user_email = user_data.get('email', '').lower()
+            # If you want partial match, do `if email_query in user_email:`
+            # If you want exact match, do `if user_email == email_query:`
+            if email_query in user_email:
+                matched_users.append({
+                    'uid': uid,
+                    'email': user_data.get('email'),
+                    'credits': user_data.get('credits', 0),
+                    'is_admin': user_data.get('is_admin', False),
+                    'created_at': user_data.get('created_at', ''),
+                    'suspended': user_data.get('suspended', False)
+                })
+
+        return jsonify({'matched_users': matched_users}), 200
+    except Exception as e:
+        return jsonify({'error': str(e)}), 500
+
+@app.route('/api/admin/users/<string:uid>/suspend', methods=['PUT'])
+def admin_suspend_user(uid):
+    try:
+        verify_admin(request.headers.get('Authorization', ''))
+        data = request.get_json()
+        action = data.get('action')  # "suspend" or "unsuspend"
+
+        if action not in ["suspend", "unsuspend"]:
+            return jsonify({'error': 'action must be "suspend" or "unsuspend"'}), 400
+
+        user_ref = db.reference(f'users/{uid}')
+        user_data = user_ref.get()
+        if not user_data:
+            return jsonify({'error': 'User not found'}), 404
+
+        if action == "suspend":
+            user_ref.update({'suspended': True})
+        else:
+            user_ref.update({'suspended': False})
+
+        return jsonify({'success': True, 'message': f'User {uid} is now {action}ed'})
+    except Exception as e:
+        return jsonify({'error': str(e)}), 500
+
+@app.route('/api/admin/stories', methods=['GET'])
+def admin_list_stories():
+    try:
+        verify_admin(request.headers.get('Authorization', ''))
+
+        stories_ref = db.reference('stories')
+        all_stories = stories_ref.get() or {}
+        total_stories = len(all_stories)
+
+        # If you want to see how many stories each user has, do:
+        stories_per_user = {}
+        for sid, sdata in all_stories.items():
+            user_id = sdata.get('uid')
+            if user_id:
+                stories_per_user[user_id] = stories_per_user.get(user_id, 0) + 1
+
+        return jsonify({
+            'total_stories': total_stories,
+            'stories_per_user': stories_per_user
+        }), 200
+    except Exception as e:
+        return jsonify({'error': str(e)}), 500
+
+@app.route('/api/admin/reset-password', methods=['PUT'])
+def admin_reset_own_password():
+    try:
+        auth_header = request.headers.get('Authorization', '')
+        admin_uid = verify_admin(auth_header)  # Ensure caller is an admin
+        if not admin_uid:
+            return jsonify({'error': 'Unauthorized: Admin access required'}), 401
+
+        data = request.get_json()
+        new_password = data.get('new_password')
+        if not new_password:
+            return jsonify({'error': 'new_password is required'}), 400
+
+        # Use Firebase Admin SDK to update admin password
+        auth.update_user(admin_uid, password=new_password)
+
+        return jsonify({'success': True, 'message': 'Password updated successfully.'})
+    except Exception as e:
+        return jsonify({'error': str(e)}), 500
+
 # ---------- Admin Endpoint to Directly Update Credits ----------
 @app.route('/api/admin/users/<string:uid>/credits', methods=['PUT'])
 def admin_update_credits(uid):