Merge branch 'main' of https://git.coastit.co.za/caitlin/CRM_ENVR

# Conflicts:
#	src/app/(dashboard)/chats/page.tsx

src/app/api/ai/chat/route.ts

@@ -1,12 +1,14 @@
 import { NextRequest, NextResponse } from "next/server"
-import { chatWithAI } from "@/lib/ai"
 import { getSessionUser } from "@/lib/auth"
+import { chatWithAI } from "@/lib/ai"
 
 export async function POST(request: NextRequest) {
   try {
     const user = await getSessionUser()
-    if (!user) {
-      return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    if (!["sales", "admin", "super_admin"].includes(user.role)) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
     }
 
     const { message } = await request.json()
@@ -14,16 +16,15 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: "Message is required" }, { status: 400 })
     }
 
-    const sessionCookie = request.cookies.get("session")
-    const jwtToken = sessionCookie?.value
-    if (!jwtToken) {
-      return NextResponse.json({ error: "No session token" }, { status: 401 })
-    }
+    // Forward the JWT from the session cookie to the Rust backend
+    const sessionCookie = request.cookies.get("session")?.value
+    if (!sessionCookie) return NextResponse.json({ error: "No session" }, { status: 401 })
+
+    const response = await chatWithAI(message, sessionCookie)
 
-    const response = await chatWithAI(message, jwtToken)
     return NextResponse.json({ response })
-  } catch (error: any) {
+  } catch (error) {
     console.error("AI chat error:", error)
-    return NextResponse.json({ error: error.message || "AI service error" }, { status: 500 })
+    return NextResponse.json({ error: "AI service unavailable" }, { status: 503 })
   }
 }

src/app/api/auth/login/route.ts

@@ -9,7 +9,6 @@ import {
   resetFailedAttempts,
   isAccountLocked,
   createSession,
-  setSessionContext,
 } from "@/lib/auth"
 
 export async function POST(request: NextRequest) {
@@ -107,7 +106,6 @@ export async function POST(request: NextRequest) {
     )
 
     await createSession(dbUser.id, dbUser.role_name)
-    await setSessionContext(dbUser.id, ipAddress)
 
     const user = mapDbUserToSessionUser(dbUser)
 

src/app/api/conversations/route.ts

@@ -13,11 +13,10 @@ export async function GET() {
          c.id,
          c.updated_at,
          cp_me.last_read_at,
-          u.id AS other_user_id,
-          u.first_name || ' ' || u.last_name AS other_user_name,
-          u.email AS other_user_email,
-          u.phone AS other_user_phone,
-          u.avatar_url AS other_user_avatar_url,
+         u.id AS other_user_id,
+         u.first_name || ' ' || u.last_name AS other_user_name,
+         u.email AS other_user_email,
+         u.avatar_url AS other_user_avatar_url,
          (SELECT content FROM messages WHERE conversation_id = c.id ORDER BY created_at DESC LIMIT 1) AS last_message,
          (SELECT created_at FROM messages WHERE conversation_id = c.id ORDER BY created_at DESC LIMIT 1) AS last_message_time,
          (SELECT count(*) FROM messages WHERE conversation_id = c.id AND sender_id != $1 AND created_at > COALESCE(cp_me.last_read_at, '1970-01-01')) AS unread
@@ -40,7 +39,6 @@ export async function GET() {
         id: row.other_user_id,
         name: row.other_user_name,
         email: row.other_user_email,
-        phone: row.other_user_phone || "",
         avatar: avatarSvgUrl(row.other_user_name),
       },
       lastMessage: row.last_message || "",
@@ -92,7 +90,7 @@ export async function POST(request: NextRequest) {
     )
 
     const otherUser = await query(
-      `SELECT id, first_name || ' ' || last_name AS name, email, phone, avatar_url
+      `SELECT id, first_name || ' ' || last_name AS name, email, avatar_url
        FROM users WHERE id = $1`,
       [userId],
     )
@@ -107,7 +105,6 @@ export async function POST(request: NextRequest) {
           id: other.id,
           name: other.name,
           email: other.email,
-          phone: other.phone || "",
           avatar: avatarSvgUrl(other.name),
         },
         lastMessage: "",

src/app/api/users/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server"
 import { query } from "@/lib/db"
-import { hashPassword, getSessionUser, encryptPassword, setSessionContext } from "@/lib/auth"
+import { hashPassword, getSessionUser } from "@/lib/auth"
 import { avatarSvgUrl } from "@/lib/avatar"
 
 export async function GET(request: NextRequest) {
@@ -63,20 +63,17 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: "Invalid role" }, { status: 400 })
     }
 
-    await setSessionContext(sessionUser.id)
-
     const nameParts = name.trim().split(/\s+/)
     const firstName = nameParts[0]
     const lastName = nameParts.slice(1).join(" ") || firstName
     const username = email.split("@")[0]
     const passwordHash = await hashPassword(password)
-    const passwordEncrypted = await encryptPassword(password)
 
     const result = await query(
-      `INSERT INTO users (username, email, password_hash, password_encrypted, first_name, last_name, is_active, created_by)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+      `INSERT INTO users (username, email, password_hash, first_name, last_name, is_active, created_by)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
        RETURNING id`,
-      [username.toLowerCase(), email.toLowerCase(), passwordHash, passwordEncrypted, firstName, lastName, active ?? true, sessionUser.id]
+      [username.toLowerCase(), email.toLowerCase(), passwordHash, firstName, lastName, active ?? true, sessionUser.id]
     )
 
     const roleId = (