read log files from end, added user management

server/app.py

@@ -12,9 +12,11 @@ from flask_cors import CORS
 from werkzeug.security import check_password_hash, generate_password_hash
 
 from db_py import (
+    count_admin_users,
     count_tests,
     count_users,
     create_user,
+    delete_user,
     del_config,
     get_all_tests,
     get_all_users,
@@ -23,6 +25,7 @@ from db_py import (
     get_user_by_username,
     set_config,
     clear_users,
+    update_user_password,
 )
 from scanner import full_scan, is_scan_in_progress, resolve_runtime_path, scan_results_only
 from watcher import start_results_watchers, stop_results_watchers
@@ -404,6 +407,51 @@ def create_user_route():
     return jsonify({"id": user_id, "username": username, "role": role, "is_active": 1}), 201
 
 
+@app.post("/api/users/<int:user_id>/password")
+@require_auth
+@require_role("admin")
+def set_user_password_route(user_id):
+    body = request.get_json(silent=True)
+    if not isinstance(body, dict):
+        return jsonify({"error": "Request body must be a JSON object"}), 400
+
+    password = body.get("password") or ""
+    if not password:
+        return jsonify({"error": "Password is required"}), 400
+
+    user = get_user_by_id(user_id)
+    if not user:
+        return jsonify({"error": "User not found"}), 404
+
+    updated = update_user_password(user_id, generate_password_hash(password))
+    if updated == 0:
+        return jsonify({"error": "User not found"}), 404
+
+    return jsonify({"ok": True, "id": user_id})
+
+
+@app.delete("/api/users/<int:user_id>")
+@require_auth
+@require_role("admin")
+def delete_user_route(user_id):
+    user = get_user_by_id(user_id)
+    if not user:
+        return jsonify({"error": "User not found"}), 404
+
+    current_user = getattr(g, "current_user", None) or {}
+    if current_user.get("id") == user_id:
+        return jsonify({"error": "You cannot delete your own account"}), 400
+
+    if user.get("role") == "admin" and count_admin_users() <= 1:
+        return jsonify({"error": "Cannot delete the last active admin"}), 400
+
+    deleted = delete_user(user_id)
+    if deleted == 0:
+        return jsonify({"error": "User not found"}), 404
+
+    return jsonify({"ok": True, "id": user_id})
+
+
 @app.get("/api/config")
 @require_auth
 @require_role("admin")