Issue #67 — Backend: Update Member Status Provider & Endpoint

[yusuftomilola]

Location:

• backend/src/users/providers/update-member-status.provider.ts
• backend/src/users/members.controller.ts

Description

Admins need to take four distinct actions on individual member accounts: suspend an active member (preventing login), reactivate a suspended member, promote a regular user to staff role, or demote a staff member back to regular user. All four actions are handled through a single PATCH /members/:id endpoint using an action field in the request body to describe the intent.

Several guard rails are required: admins must not be able to act on other admin accounts, a SUPER_ADMIN account must never be modifiable, and no-op actions (e.g. suspending an already suspended member) should return a clear error rather than silently succeeding.

Acceptance Criteria

• An UpdateMemberStatusProvider class is created at backend/src/users/providers/update-member-status.provider.ts
• PATCH /members/:id accepts UpdateMemberStatusDto and applies the requested action:
  • suspend — sets membershipStatus = SUSPENDED. Throws BadRequestException if already suspended
  • activate — sets membershipStatus = ACTIVE. Throws BadRequestException if already active
  • promote — sets role = UserRole.STAFF. Throws BadRequestException if already STAFF or higher
  • demote — sets role = UserRole.USER. Throws BadRequestException if already USER
• The provider throws NotFoundException if the target user does not exist
• The provider throws ForbiddenException if the target user's role is ADMIN or SUPER_ADMIN — admins cannot manage other admins through this endpoint
• The provider throws ForbiddenException if the requesting user attempts to act on their own account
• Returns { success: true, message: "<Action> applied successfully", data: User } with sensitive fields excluded
• The endpoint is guarded with @UseGuards(RolesGuard) and @Roles(UserRole.ADMIN, UserRole.SUPER_ADMIN)
• UpdateMemberStatusProvider is registered in UsersModule
• npx tsc --noEmit passes with no errors