From d0ec000bffa2aaecd89378957d1cfa0e035613c9 Mon Sep 17 00:00:00 2001
From: Bastian Wagner <bastian.wagner@softconcis.de>
Date: Sat, 1 Aug 2026 09:26:14 +0200
Subject: [PATCH] fix: harden admin frontend contracts

---
 .../src/app/core/auth/auth-api.spec.ts            | 15 ++++++++++-----
 .../src/app/core/auth/auth-api.ts                 |  8 +++++++-
 .../src/app/models/user-directory.model.ts        |  7 +++++--
 3 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/myteamwallet_frontend_modern/src/app/core/auth/auth-api.spec.ts b/myteamwallet_frontend_modern/src/app/core/auth/auth-api.spec.ts
index e0340cc..1f4d9f6 100644
--- a/myteamwallet_frontend_modern/src/app/core/auth/auth-api.spec.ts
+++ b/myteamwallet_frontend_modern/src/app/core/auth/auth-api.spec.ts
@@ -1,7 +1,7 @@
 import { TestBed } from '@angular/core/testing';
 import { provideHttpClient } from '@angular/common/http';
 import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing';
-import { AuthApi } from './auth-api';
+import { AuthApi, RegistrationRequest } from './auth-api';
 import { environment } from '../../../environments/environment';
 import { User } from '../../models/user.model';
 
@@ -59,8 +59,8 @@ describe('AuthApi', () => {
     request.flush(invitation);
   });
 
-  it('registers and links an invited player', () => {
-    const registration = {
+  it('registers with only the supported account fields', () => {
+    const registrationWithLegacyField = {
       email: 'alex@example.de',
       password: 'secret1',
       firstName: 'Alex',
@@ -68,11 +68,16 @@ describe('AuthApi', () => {
       linkPlayerId: 7,
     };
 
-    service.register(registration).subscribe();
+    service.register(registrationWithLegacyField as RegistrationRequest).subscribe();
 
     const request = httpMock.expectOne(`${environment.apiUrl}auth/email/register`);
     expect(request.request.method).toBe('POST');
-    expect(request.request.body).toEqual(registration);
+    expect(request.request.body).toEqual({
+      email: 'alex@example.de',
+      password: 'secret1',
+      firstName: 'Alex',
+      lastName: 'Muster',
+    });
     request.flush(null);
   });
 
diff --git a/myteamwallet_frontend_modern/src/app/core/auth/auth-api.ts b/myteamwallet_frontend_modern/src/app/core/auth/auth-api.ts
index eea30bc..10b5414 100644
--- a/myteamwallet_frontend_modern/src/app/core/auth/auth-api.ts
+++ b/myteamwallet_frontend_modern/src/app/core/auth/auth-api.ts
@@ -52,7 +52,13 @@ export class AuthApi {
   }
 
   register(request: RegistrationRequest): Observable<void> {
-    return this.http.post<void>(`${this.baseUrl}/email/register`, request);
+    const { email, password, firstName, lastName } = request;
+    return this.http.post<void>(`${this.baseUrl}/email/register`, {
+      email,
+      password,
+      firstName,
+      lastName,
+    });
   }
 
   forgotPassword(email: string): Observable<void> {
diff --git a/myteamwallet_frontend_modern/src/app/models/user-directory.model.ts b/myteamwallet_frontend_modern/src/app/models/user-directory.model.ts
index 254d349..0a91db4 100644
--- a/myteamwallet_frontend_modern/src/app/models/user-directory.model.ts
+++ b/myteamwallet_frontend_modern/src/app/models/user-directory.model.ts
@@ -52,12 +52,15 @@ export interface AdminUserProfileRequest {
   lastName?: string | null;
 }
 
+export type AdminUserRoleId = 1 | 2;
+export type AdminUserStatusId = 1 | 2;
+
 export interface AdminUserRoleRequest {
-  role: number;
+  role: AdminUserRoleId;
 }
 
 export interface AdminUserStatusRequest {
-  status: number;
+  status: AdminUserStatusId;
 }
 
 export type AdminPlayerAssignmentFilter = 'all' | 'assigned' | 'unassigned';