route fixes

Author: Marwanyx

src/app/api/admin/system/all/route.ts

@@ -1,13 +1,21 @@
 import { NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
 import { requireAdmin, adminGuardResponse } from "@/lib/adminAuth";
+import { getAdminUtorids } from "@/lib/adminWhitelist";
 
 export async function DELETE() {
   try {
     const user = await requireAdmin();
     const guard = adminGuardResponse(user);
     if (guard) return guard;
 
+    const adminUtorids = getAdminUtorids();
+    const protectedUsers = await prisma.user.findMany({
+      where: { OR: [{ utorid: { in: adminUtorids } }, { role: "PROFESSOR" }] },
+      select: { id: true },
+    });
+    const protectedIds = protectedUsers.map((u) => u.id);
+
     await prisma.$transaction([
       prisma.answerUpvote.deleteMany(),
       prisma.questionUpvote.deleteMany(),
@@ -17,7 +25,9 @@ export async function DELETE() {
       prisma.session.deleteMany(),
       prisma.courseEnrollment.deleteMany(),
       prisma.course.deleteMany(),
-      prisma.user.deleteMany(),
+      prisma.user.deleteMany(
+        protectedIds.length > 0 ? { where: { id: { notIn: protectedIds } } } : undefined
+      ),
     ]);
 
     return NextResponse.json({ success: true });

src/app/api/admin/users/all/route.ts

@@ -1,13 +1,21 @@
 import { NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
 import { requireAdmin, adminGuardResponse } from "@/lib/adminAuth";
+import { getAdminUtorids } from "@/lib/adminWhitelist";
 
 export async function DELETE() {
   try {
     const user = await requireAdmin();
     const guard = adminGuardResponse(user);
     if (guard) return guard;
 
+    const adminUtorids = getAdminUtorids();
+    const protectedUsers = await prisma.user.findMany({
+      where: { OR: [{ utorid: { in: adminUtorids } }, { role: "PROFESSOR" }] },
+      select: { id: true },
+    });
+    const protectedIds = protectedUsers.map((u) => u.id);
+
     await prisma.$transaction([
       prisma.answerUpvote.deleteMany(),
       prisma.questionUpvote.deleteMany(),
@@ -17,7 +25,9 @@ export async function DELETE() {
       prisma.session.deleteMany(),
       prisma.courseEnrollment.deleteMany(),
       prisma.course.deleteMany(),
-      prisma.user.deleteMany(),
+      prisma.user.deleteMany(
+        protectedIds.length > 0 ? { where: { id: { notIn: protectedIds } } } : undefined
+      ),
     ]);
 
     return NextResponse.json({ success: true });

src/app/api/auth/session/route.ts

@@ -38,10 +38,11 @@ export async function GET(request: NextRequest) {
     // The server strips them from external connections (see server.ts), so
     // they can be trusted here.
     utorid = request.headers.get("utorid");
-    name =
-      request.headers.get("cn") ??
-      request.headers.get("displayname") ??
-      request.headers.get("utorid");
+    const rawCn = request.headers.get("cn");
+    // Strip double-quotes and collapse whitespace to handle LDAP-formatted
+    // names like `"First Middle" "Last"` → `First Middle Last`
+    const sanitizedCn = rawCn ? rawCn.replace(/"/g, "").replace(/\s+/g, " ").trim() : null;
+    name = sanitizedCn || request.headers.get("displayname") || request.headers.get("utorid");
     email = request.headers.get("mail") ?? request.headers.get("email");
   }
 

src/lib/adminWhitelist.ts

@@ -49,3 +49,10 @@ const ADMIN_WHITELIST: Set<string> = loadAdminWhitelist();
 export function isAdmin(utorid: string): boolean {
   return ADMIN_WHITELIST.has(utorid.toLowerCase());
 }
+
+/**
+ * Returns all admin UTORids as an array.
+ */
+export function getAdminUtorids(): string[] {
+  return Array.from(ADMIN_WHITELIST);
+}