add server side filter for server admin

server/routers/user/adminListUsers.ts

@@ -88,6 +88,15 @@ const listUsersSchema = z.strictObject({
             type: "boolean",
             description:
                 "Filter by 2FA state matching: enabled if twoFactorEnabled or twoFactorSetupRequested"
+        }),
+    server_admin: z
+        .enum(["true", "false"])
+        .transform((v) => v === "true")
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "boolean",
+            description: "Filter by server admin status"
         })
 });
 
@@ -177,7 +186,8 @@ export async function adminListUsers(
             sort_by,
             order,
             idp_id,
-            two_factor: twoFactorFilter
+            two_factor: twoFactorFilter,
+            server_admin: serverAdminFilter
         } = parsedQuery.data;
 
         if (typeof idp_id === "number") {
@@ -233,6 +243,10 @@ export async function adminListUsers(
             }
         }
 
+        if (typeof serverAdminFilter === "boolean") {
+            conditions.push(eq(users.serverAdmin, serverAdminFilter));
+        }
+
         const whereClause = and(...conditions);
 
         const countQuery = db.$count(

server/routers/user/adminSetServerAdmin.ts

@@ -31,7 +31,8 @@ const AdminSetServerAdminResponseDataSchema = z.object({
 registry.registerPath({
     method: "post",
     path: "/user/{userId}/server-admin",
-    description: "Promote or demote a user's server admin status (server admin).",
+    description:
+        "Promote or demote a user's server admin status (server admin).",
     tags: [OpenAPITags.User],
     request: {
         params: setServerAdminParamsSchema,
@@ -63,9 +64,7 @@ export async function adminSetServerAdmin(
     next: NextFunction
 ): Promise<any> {
     try {
-        const parsedParams = setServerAdminParamsSchema.safeParse(
-            req.params
-        );
+        const parsedParams = setServerAdminParamsSchema.safeParse(req.params);
         if (!parsedParams.success) {
             return next(
                 createHttpError(
@@ -91,7 +90,8 @@ export async function adminSetServerAdmin(
         const [existingUser] = await db
             .select({
                 userId: users.userId,
-                serverAdmin: users.serverAdmin
+                serverAdmin: users.serverAdmin,
+                type: users.type
             })
             .from(users)
             .where(eq(users.userId, userId))
@@ -101,6 +101,15 @@ export async function adminSetServerAdmin(
             return next(createHttpError(HttpCode.NOT_FOUND, "User not found"));
         }
 
+        if (existingUser.type !== "internal") {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Server admin status can only be changed for internal users"
+                )
+            );
+        }
+
         if (!serverAdmin && req.user?.userId === userId) {
             return next(
                 createHttpError(