Current state

2026-06-26 14:31:38 +02:00
commit 7a76841309
982 changed files with 451988 additions and 0 deletions
@@ -0,0 +1,31 @@
+import { NextRequest, NextResponse } from "next/server"
+import { query } from "@/lib/db"
+import { getSessionUser } from "@/lib/auth"
+
+export async function DELETE(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) {
+      return NextResponse.json({ error: "Not authenticated" }, { status: 401 })
+    }
+    if (sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Only super admins can delete users" }, { status: 403 })
+    }
+
+    const { id } = await params
+
+    if (id === sessionUser.id) {
+      return NextResponse.json({ error: "Cannot delete yourself" }, { status: 400 })
+    }
+
+    await query(
+      `UPDATE users SET deleted_at = NOW() WHERE id = $1 AND deleted_at IS NULL`,
+      [id]
+    )
+
+    return NextResponse.json({ success: true }, { status: 200 })
+  } catch (error) {
+    console.error("Error deleting user:", error)
+    return NextResponse.json({ error: "Failed to delete user" }, { status: 500 })
+  }
+}
@@ -0,0 +1,40 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+const ALLOWED_PREFIXES = ["data:image/png;base64,", "data:image/jpeg;base64,", "data:image/gif;base64,"]
+const MAX_AVATAR_BYTES = 2 * 1024 * 1024 // 2MB
+
+export async function POST(request: NextRequest) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const { avatar } = await request.json()
+    if (!avatar || typeof avatar !== "string") {
+      return NextResponse.json({ error: "Invalid avatar data" }, { status: 400 })
+    }
+
+    const allowed = ALLOWED_PREFIXES.some((p) => avatar.startsWith(p))
+    if (!allowed) {
+      return NextResponse.json({ error: "Avatar must be a PNG, JPEG, or GIF data URL" }, { status: 400 })
+    }
+
+    // Approximate decoded size: base64 is ~4/3 of original
+    const base64Data = avatar.split(",")[1] || ""
+    const estimatedBytes = Math.round(base64Data.length * 0.75)
+    if (estimatedBytes > MAX_AVATAR_BYTES) {
+      return NextResponse.json({ error: "Avatar exceeds 2MB size limit" }, { status: 400 })
+    }
+
+    await query(
+      `UPDATE users SET avatar_url = $1 WHERE id = $2`,
+      [avatar, user.id],
+    )
+
+    return NextResponse.json({ avatar })
+  } catch (error) {
+    console.error("Avatar upload error:", error)
+    return NextResponse.json({ error: "Failed to update avatar" }, { status: 500 })
+  }
+}
@@ -0,0 +1,38 @@
+import { NextRequest, NextResponse } from "next/server"
+import { query } from "@/lib/db"
+
+export async function GET(request: NextRequest) {
+  const phone = request.nextUrl.searchParams.get("phone")
+  if (!phone) {
+    return NextResponse.json({ error: "Phone parameter required" }, { status: 400 })
+  }
+
+  try {
+    const result = await query(
+      `SELECT id, username, first_name, last_name, phone, avatar_url
+       FROM users
+       WHERE phone = $1 AND deleted_at IS NULL
+       LIMIT 1`,
+      [phone],
+    )
+
+    if (result.rows.length === 0) {
+      return NextResponse.json({ found: false })
+    }
+
+    const user = result.rows[0]
+    return NextResponse.json({
+      found: true,
+      user: {
+        id: user.id,
+        username: user.username,
+        firstName: user.first_name,
+        lastName: user.last_name,
+        phone: user.phone,
+        avatar: user.avatar_url,
+      },
+    })
+  } catch {
+    return NextResponse.json({ error: "Lookup failed" }, { status: 500 })
+  }
+}
@@ -0,0 +1,99 @@
+import { NextRequest, NextResponse } from "next/server"
+import { query } from "@/lib/db"
+import { hashPassword, getSessionUser } from "@/lib/auth"
+import { avatarSvgUrl } from "@/lib/avatar"
+
+export async function GET(request: NextRequest) {
+  try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    if (sessionUser.role !== "admin" && sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
+
+    const { searchParams } = new URL(request.url)
+    const limit = parseInt(searchParams.get("limit") || "50", 10)
+    const offset = parseInt(searchParams.get("offset") || "0", 10)
+
+    const result = await query(
+      `SELECT u.id, u.username, u.email, u.first_name, u.last_name,
+              u.is_active AS active, u.created_at, u.avatar_url,
+              r.name AS role
+       FROM users u
+       JOIN user_roles ur ON ur.user_id = u.id
+       JOIN roles r ON r.id = ur.role_id
+       WHERE u.deleted_at IS NULL
+       ORDER BY u.created_at DESC
+       LIMIT $1 OFFSET $2`,
+      [limit, offset]
+    )
+    const users = result.rows.map((row: any) => ({
+      id: row.id,
+      name: `${row.first_name} ${row.last_name}`,
+      email: row.email,
+      role: row.role.toLowerCase(),
+      active: row.active,
+      avatar: avatarSvgUrl(`${row.first_name} ${row.last_name}`),
+      createdAt: row.created_at,
+    }))
+    return NextResponse.json({ users }, { status: 200 })
+  } catch (error) {
+    console.error("Error fetching users:", error)
+    return NextResponse.json({ error: "Failed to fetch users" }, { status: 500 })
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) {
+      return NextResponse.json({ error: "Not authenticated" }, { status: 401 })
+    }
+    if (sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Only super admins can create users" }, { status: 403 })
+    }
+
+    const { name, email, password, role, active } = await request.json()
+    if (!name || !email || !password || !role) {
+      return NextResponse.json({ error: "Name, email, password, and role are required" }, { status: 400 })
+    }
+
+    const validRoles = ["sales", "admin", "super_admin", "dev"]
+    if (!validRoles.includes(role)) {
+      return NextResponse.json({ error: "Invalid role" }, { status: 400 })
+    }
+
+    const nameParts = name.trim().split(/\s+/)
+    const firstName = nameParts[0]
+    const lastName = nameParts.slice(1).join(" ") || firstName
+    const username = email.split("@")[0]
+    const passwordHash = await hashPassword(password)
+
+    const result = await query(
+      `INSERT INTO users (username, email, password_hash, first_name, last_name, is_active, created_by)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       RETURNING id`,
+      [username.toLowerCase(), email.toLowerCase(), passwordHash, firstName, lastName, active ?? true, sessionUser.id]
+    )
+
+    const roleId = (
+      await query(`SELECT id FROM roles WHERE LOWER(name) = LOWER($1)`, [role])
+    ).rows[0]?.id
+
+    if (roleId) {
+      await query(
+        `INSERT INTO user_roles (user_id, role_id, assigned_by)
+         VALUES ($1, $2, $3)`,
+        [result.rows[0].id, roleId, sessionUser.id]
+      )
+    }
+
+    return NextResponse.json({ success: true, id: result.rows[0].id }, { status: 201 })
+  } catch (error: any) {
+    console.error("Error creating user:", error)
+    if (error?.constraint === "uq_users_username" || error?.constraint === "uq_users_email") {
+      return NextResponse.json({ error: "A user with this email or username already exists" }, { status: 409 })
+    }
+    return NextResponse.json({ error: error?.message || "Failed to create user" }, { status: 500 })
+  }
+}
@@ -0,0 +1,44 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+import { avatarSvgUrl } from "@/lib/avatar"
+
+export async function GET(request: NextRequest) {
+  try {
+    const currentUser = await getSessionUser()
+    if (!currentUser) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    if (currentUser.role !== "admin" && currentUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
+
+    const q = request.nextUrl.searchParams.get("q") || ""
+
+    if (!q.trim()) {
+      return NextResponse.json({ users: [] })
+    }
+
+    const result = await query(
+      `SELECT id, first_name || ' ' || last_name AS name, email, avatar_url
+       FROM users
+       WHERE deleted_at IS NULL
+         AND id != $1
+         AND (LOWER(first_name || ' ' || last_name) LIKE LOWER($2)
+              OR LOWER(email) LIKE LOWER($2))
+       ORDER BY first_name ASC
+       LIMIT 10`,
+      [currentUser.id, `%${q}%`],
+    )
+
+    const users = result.rows.map((row: any) => ({
+      id: row.id,
+      name: row.name,
+      email: row.email,
+      avatar: avatarSvgUrl(row.name),
+    }))
+
+    return NextResponse.json({ users })
+  } catch (error) {
+    console.error("User search error:", error)
+    return NextResponse.json({ error: "Search failed" }, { status: 500 })
+  }
+}