feat: add system monitor component and API for performance metrics

feat: implement conversations API with message retrieval and posting feat: add avatar URL handling for users and update user role definitions feat: create chat system tables in the database with initial seed data fix: update user roles from "sales_user" to "sales" for consistency chore: add middleware for system API route access fixed fuckups on john's side, added a benchmark Made Graphs actualy load from database and realtime data, graphs will update and percentages will be mathematically made, and made realtime added chatcart edits, made graphs glow. added in some little small home feeling fuctions added in a slide show, in login with qoutes from creators because i want to leave a print on it saying we made this shit, we built it brick for brick login page added qoutes some random, and made them shuffle from left to right one dissapears other come in adding shape to the textbox for the qoutes Fixed my chat fuckups when it comes to chats
2026-06-18 22:48:03 +02:00
parent f5d09298a2
commit adbcc4b9af
38 changed files with 2321 additions and 741 deletions
@@ -0,0 +1,115 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+export async function GET(
+  _request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const { id } = await params
+
+    const [msgResult, otherReadResult] = await Promise.all([
+      query(
+        `SELECT m.id, m.sender_id, m.content, m.created_at, m.updated_at, m.deleted_at,
+                u.first_name || ' ' || u.last_name AS sender_name,
+                u.email AS sender_email,
+                u.avatar_url AS sender_avatar_url
+         FROM messages m
+         JOIN users u ON u.id = m.sender_id
+         WHERE m.conversation_id = $1 AND m.deleted_at IS NULL
+         ORDER BY m.created_at ASC`,
+        [id],
+      ),
+      query(
+        `SELECT last_read_at FROM conversation_participants
+         WHERE conversation_id = $1 AND user_id != $2`,
+        [id, user.id],
+      ),
+    ])
+
+    const otherLastReadAt = otherReadResult.rows[0]?.last_read_at
+      ? new Date(otherReadResult.rows[0].last_read_at).getTime()
+      : 0
+
+    const messages = msgResult.rows.map((row: any) => ({
+      id: row.id,
+      conversationId: id,
+      senderId: row.sender_id,
+      senderName: row.sender_name,
+      senderAvatar: row.sender_avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(row.sender_name)}&background=1d4ed8&color=fff&size=128`,
+      content: row.content,
+      timestamp: formatTime(new Date(row.created_at)),
+      createdAt: row.created_at,
+      read: row.sender_id === user.id
+        ? new Date(row.created_at).getTime() <= otherLastReadAt
+        : true,
+    }))
+
+    return NextResponse.json({ messages })
+  } catch (error) {
+    console.error("Messages error:", error)
+    return NextResponse.json({ error: "Failed to load messages" }, { status: 500 })
+  }
+}
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const { id } = await params
+    const { content } = await request.json()
+
+    if (!content?.trim()) {
+      return NextResponse.json({ error: "Message content is required" }, { status: 400 })
+    }
+
+    const result = await query(
+      `INSERT INTO messages (conversation_id, sender_id, content)
+       VALUES ($1, $2, $3)
+       RETURNING id, created_at`,
+      [id, user.id, content.trim()],
+    )
+
+    await query(
+      `UPDATE conversations SET updated_at = NOW() WHERE id = $1`,
+      [id],
+    )
+
+    const msg = result.rows[0]
+
+    return NextResponse.json({
+      message: {
+        id: msg.id,
+        conversationId: id,
+        senderId: user.id,
+        senderName: `${user.firstName} ${user.lastName}`,
+        senderAvatar: user.avatar,
+        content: content.trim(),
+        timestamp: formatTime(new Date(msg.created_at)),
+        createdAt: msg.created_at,
+        read: false,
+      },
+    })
+  } catch (error) {
+    console.error("Send message error:", error)
+    return NextResponse.json({ error: "Failed to send message" }, { status: 500 })
+  }
+}
+
+function formatTime(date: Date): string {
+  const now = new Date()
+  const isToday = date.toDateString() === now.toDateString()
+  if (isToday) {
+    return date.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" })
+  }
+  return date.toLocaleDateString([], { month: "short", day: "numeric" }) + " " +
+    date.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" })
+}
@@ -0,0 +1,27 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+export async function POST(
+  _request: NextRequest,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const { id } = await params
+
+    await query(
+      `UPDATE conversation_participants
+       SET last_read_at = NOW()
+       WHERE conversation_id = $1 AND user_id = $2`,
+      [id, user.id],
+    )
+
+    return NextResponse.json({ success: true })
+  } catch (error) {
+    console.error("Mark read error:", error)
+    return NextResponse.json({ error: "Failed to mark as read" }, { status: 500 })
+  }
+}
@@ -0,0 +1,129 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+export async function GET() {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const result = await query(
+      `SELECT
+         c.id,
+         c.updated_at,
+         cp_me.last_read_at,
+         u.id AS other_user_id,
+         u.first_name || ' ' || u.last_name AS other_user_name,
+         u.email AS other_user_email,
+         u.avatar_url AS other_user_avatar_url,
+         (SELECT content FROM messages WHERE conversation_id = c.id ORDER BY created_at DESC LIMIT 1) AS last_message,
+         (SELECT created_at FROM messages WHERE conversation_id = c.id ORDER BY created_at DESC LIMIT 1) AS last_message_time,
+         (SELECT count(*) FROM messages WHERE conversation_id = c.id AND sender_id != $1 AND created_at > COALESCE(cp_me.last_read_at, '1970-01-01')) AS unread
+       FROM conversations c
+       JOIN conversation_participants cp_me ON cp_me.conversation_id = c.id AND cp_me.user_id = $1
+       JOIN conversation_participants cp ON cp.conversation_id = c.id
+       JOIN users u ON u.id = cp.user_id AND u.id != $1
+       WHERE c.id IN (
+         SELECT conversation_id FROM conversation_participants WHERE user_id = $1
+       )
+       ORDER BY c.updated_at DESC`,
+      [user.id],
+    )
+
+    const conversations = result.rows.map((row: any) => ({
+      id: row.id,
+      updatedAt: row.updated_at,
+      otherUser: {
+        id: row.other_user_id,
+        name: row.other_user_name,
+        email: row.other_user_email,
+        avatar: row.other_user_avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(row.other_user_name)}&background=1d4ed8&color=fff&size=128`,
+      },
+      lastMessage: row.last_message || "",
+      lastMessageTime: row.last_message_time ? timeAgo(new Date(row.last_message_time)) : "",
+      unread: parseInt(row.unread) || 0,
+    }))
+
+    return NextResponse.json({ conversations })
+  } catch (error) {
+    console.error("Conversations error:", error)
+    return NextResponse.json({ error: "Failed to load conversations" }, { status: 500 })
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const { userId } = await request.json()
+    if (!userId) {
+      return NextResponse.json({ error: "userId is required" }, { status: 400 })
+    }
+
+    if (userId === user.id) {
+      return NextResponse.json({ error: "Cannot start a conversation with yourself" }, { status: 400 })
+    }
+
+    const existing = await query(
+      `SELECT c.id FROM conversations c
+       JOIN conversation_participants cp1 ON cp1.conversation_id = c.id AND cp1.user_id = $1
+       JOIN conversation_participants cp2 ON cp2.conversation_id = c.id AND cp2.user_id = $2
+       LIMIT 1`,
+      [user.id, userId],
+    )
+
+    if (existing.rows.length > 0) {
+      return NextResponse.json({ conversationId: existing.rows[0].id })
+    }
+
+    const convResult = await query(
+      `INSERT INTO conversations DEFAULT VALUES RETURNING id`,
+    )
+    const conversationId = convResult.rows[0].id
+
+    await query(
+      `INSERT INTO conversation_participants (conversation_id, user_id, last_read_at) VALUES ($1, $2, NOW()), ($1, $3, NOW())`,
+      [conversationId, user.id, userId],
+    )
+
+    const otherUser = await query(
+      `SELECT id, first_name || ' ' || last_name AS name, email, avatar_url
+       FROM users WHERE id = $1`,
+      [userId],
+    )
+
+    const other = otherUser.rows[0]
+
+    return NextResponse.json({
+      conversation: {
+        id: conversationId,
+        updatedAt: new Date().toISOString(),
+        otherUser: {
+          id: other.id,
+          name: other.name,
+          email: other.email,
+          avatar: other.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(other.name)}&background=1d4ed8&color=fff&size=128`,
+        },
+        lastMessage: "",
+        lastMessageTime: "",
+        unread: 0,
+      },
+    })
+  } catch (error) {
+    console.error("Create conversation error:", error)
+    return NextResponse.json({ error: "Failed to create conversation" }, { status: 500 })
+  }
+}
+
+function timeAgo(date: Date): string {
+  const seconds = Math.floor((Date.now() - date.getTime()) / 1000)
+  if (seconds < 60) return "now"
+  const minutes = Math.floor(seconds / 60)
+  if (minutes < 60) return `${minutes}m ago`
+  const hours = Math.floor(minutes / 60)
+  if (hours < 24) return `${hours}h ago`
+  const days = Math.floor(hours / 24)
+  if (days < 7) return `${days}d ago`
+  return date.toLocaleDateString()
+}
@@ -0,0 +1,207 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+function getPeriodDateRange(period: string): { start: Date; end: Date } {
+  const end = new Date()
+  let start: Date
+  switch (period) {
+    case "7days":
+      start = new Date(end); start.setDate(start.getDate() - 7); break
+    case "30days":
+      start = new Date(end); start.setDate(start.getDate() - 30); break
+    case "12months":
+      start = new Date(end); start.setFullYear(start.getFullYear() - 12); break
+    case "6months":
+    default:
+      start = new Date(end); start.setMonth(start.getMonth() - 6); break
+  }
+  return { start, end }
+}
+
+function getPreviousPeriodRange(period: string, currentStart: Date): { start: Date; end: Date } {
+  const end = new Date(currentStart)
+  const diff = end.getTime() - currentStart.getTime()
+  const start = new Date(end.getTime() - diff)
+  return { start, end }
+}
+
+const periodLabels: Record<string, string> = {
+  "7days": "Last 7 days",
+  "30days": "Last 30 days",
+  "6months": "Last 6 months",
+  "12months": "Last 12 months",
+}
+
+function stageToStatus(name: string): string {
+  switch (name) {
+    case "New": return "open"
+    case "Contacted": return "contacted"
+    case "Qualified":
+    case "Interested":
+    case "Demo Scheduled":
+    case "Negotiation": return "pending"
+    case "Closed Won": return "closed"
+    case "Closed Lost": return "ignored"
+    default: return "open"
+  }
+}
+
+async function fetchLeadsInRange(start: Date, end: Date) {
+  const result = await query(
+    `SELECT l.id, l.created_at, l.company_name, l.contact_name, l.email, l.phone,
+            l.notes, l.assigned_to, l.score,
+            ls.name AS stage_name,
+            u.id AS user_id, u.first_name, u.last_name, u.email AS user_email, u.avatar_url
+     FROM leads l
+     JOIN lead_stages ls ON ls.id = l.stage_id
+     LEFT JOIN users u ON u.id = l.assigned_to
+     WHERE l.deleted_at IS NULL
+       AND l.created_at >= $1 AND l.created_at <= $2
+     ORDER BY l.created_at DESC`,
+    [start.toISOString(), end.toISOString()]
+  )
+  return result.rows.map((r: any) => ({
+    ...r,
+    status: stageToStatus(r.stage_name),
+  }))
+}
+
+function countStatuses(leads: any[]) {
+  const counts = { open: 0, contacted: 0, pending: 0, closed: 0, ignored: 0 }
+  leads.forEach((l: any) => {
+    const s = l.status as keyof typeof counts
+    if (s in counts) counts[s]++
+  })
+  return counts
+}
+
+function buildMonthlyBreakdown(leads: any[], period: string) {
+  const { start, end } = getPeriodDateRange(period)
+  const result: { label: string; total: number; open: number; contacted: number; pending: number; closed: number; ignored: number }[] = []
+  const current = new Date(start)
+  const isMonthly = period === "6months" || period === "12months"
+
+  while (current <= end) {
+    const label = isMonthly
+      ? current.toLocaleDateString("en-US", { month: "short", year: "2-digit" })
+      : current.toLocaleDateString("en-US", { month: "short", day: "numeric" })
+
+    const ps = new Date(current)
+    const pe = isMonthly
+      ? new Date(current.getFullYear(), current.getMonth() + 1, 0, 23, 59, 59)
+      : (() => { const d = new Date(current); d.setHours(23, 59, 59, 999); return d })()
+
+    const inPeriod = leads.filter((l: any) => {
+      const d = new Date(l.created_at)
+      return d >= ps && d <= pe
+    })
+
+    const counts = countStatuses(inPeriod)
+    result.push({ label, total: inPeriod.length, ...counts })
+
+    if (isMonthly) current.setMonth(current.getMonth() + 1)
+    else current.setDate(current.getDate() + 1)
+  }
+  return result
+}
+
+function computeTrend(current: number, previous: number): { pct: number; up: boolean } {
+  if (previous === 0) return { pct: current > 0 ? 100 : 0, up: current > 0 }
+  const pct = Math.round(((current - previous) / previous) * 100)
+  return { pct: Math.abs(pct), up: pct >= 0 }
+}
+
+export async function GET(request: NextRequest) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const { searchParams } = new URL(request.url)
+    const period = searchParams.get("period") || "6months"
+    const yearParam = searchParams.get("year")
+    let start: Date, end: Date, prevRange: { start: Date; end: Date }
+    if (yearParam) {
+      const y = parseInt(yearParam)
+      start = new Date(y, 0, 1)
+      end = new Date(y, 11, 31, 23, 59, 59)
+      prevRange = { start: new Date(y - 1, 0, 1), end: new Date(y - 1, 11, 31, 23, 59, 59) }
+    } else {
+      const r = getPeriodDateRange(period)
+      start = r.start; end = r.end
+      prevRange = getPreviousPeriodRange(period, start)
+    }
+
+    const [currentLeads, prevLeads] = await Promise.all([
+      fetchLeadsInRange(start, end),
+      fetchLeadsInRange(prevRange.start, prevRange.end),
+    ])
+
+    const currentCounts = countStatuses(currentLeads)
+    const prevCounts = countStatuses(prevLeads)
+
+    const totalLeads = currentLeads.length
+    const closedLeads = currentCounts.closed
+    const conversionRate = totalLeads > 0 ? Math.round((closedLeads / totalLeads) * 100) : 0
+
+    const mappedLeads = currentLeads.map((r: any) => ({
+      id: r.id,
+      companyName: r.company_name || "",
+      contactName: r.contact_name,
+      email: r.email || "",
+      phone: r.phone || "",
+      source: "",
+      description: r.notes || "",
+      status: r.status,
+      assignedUserId: r.assigned_to,
+      assignedUser: r.assigned_to ? {
+        id: r.user_id,
+        name: `${r.first_name} ${r.last_name}`,
+        email: r.user_email,
+        avatar: r.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(`${r.first_name} ${r.last_name}`)}&background=1d4ed8&color=fff&size=128`,
+      } : null,
+      createdAt: r.created_at,
+      updatedAt: r.updated_at,
+    }))
+
+    const monthlyBreakdown = buildMonthlyBreakdown(currentLeads, period)
+
+    const trends = {
+      totalLeads: computeTrend(currentCounts.open + currentCounts.contacted + currentCounts.pending + currentCounts.closed + currentCounts.ignored,
+        prevCounts.open + prevCounts.contacted + prevCounts.pending + prevCounts.closed + prevCounts.ignored),
+      openLeads: computeTrend(currentCounts.open, prevCounts.open),
+      contactedLeads: computeTrend(currentCounts.contacted, prevCounts.contacted),
+      pendingLeads: computeTrend(currentCounts.pending, prevCounts.pending),
+      closedLeads: computeTrend(currentCounts.closed, prevCounts.closed),
+      conversionRate: computeTrend(conversionRate,
+        prevLeads.length > 0 ? Math.round((prevCounts.closed / prevLeads.length) * 100) : 0),
+    }
+
+    const stats = {
+      totalLeads,
+      openLeads: currentCounts.open,
+      contactedLeads: currentCounts.contacted,
+      pendingLeads: currentCounts.pending,
+      closedLeads,
+      ignoredLeads: currentCounts.ignored,
+      conversionRate,
+      monthlyBreakdown,
+      leadsPerMonth: monthlyBreakdown.map((m: any) => ({ label: m.label, leads: m.total, closed: m.closed })),
+      trends,
+      recentLeads: mappedLeads.slice(0, 10),
+      statusDistribution: [
+        { name: "Open", value: currentCounts.open, color: "#3b82f6" },
+        { name: "Contacted", value: currentCounts.contacted, color: "#f59e0b" },
+        { name: "Pending", value: currentCounts.pending, color: "#8b5cf6" },
+        { name: "Closed", value: currentCounts.closed, color: "#10b981" },
+        { name: "Ignored", value: currentCounts.ignored, color: "#6B7280" },
+      ],
+      periodLabel: periodLabels[period] ?? "Selected period",
+    }
+
+    return NextResponse.json(stats)
+  } catch (error) {
+    console.error("Dashboard API error:", error)
+    return NextResponse.json({ error: "Failed to load dashboard stats" }, { status: 500 })
+  }
+}
@@ -0,0 +1,62 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+export async function POST(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const { id } = await params
+    const { content } = await request.json()
+    if (!content?.trim()) {
+      return NextResponse.json({ error: "Content is required" }, { status: 400 })
+    }
+
+    await query(
+      `INSERT INTO customer_notes (customer_id, author_id, content)
+       VALUES ($1, $2, $3)`,
+      [id, user.id, content.trim()]
+    )
+
+    return NextResponse.json({ success: true })
+  } catch (error) {
+    console.error("Create note error:", error)
+    return NextResponse.json({ error: "Failed to create note" }, { status: 500 })
+  }
+}
+
+export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const { id } = await params
+
+    const result = await query(
+      `SELECT cn.id, cn.created_at, cn.updated_at, cn.content,
+              u.id AS user_id, u.first_name, u.last_name, u.avatar_url
+       FROM customer_notes cn
+       JOIN users u ON u.id = cn.author_id
+       WHERE cn.customer_id = $1 AND cn.deleted_at IS NULL
+       ORDER BY cn.created_at DESC`,
+      [id]
+    )
+
+    const notes = result.rows.map((r: any) => ({
+      id: r.id,
+      leadId: id,
+      userId: r.user_id,
+      authorName: `${r.first_name} ${r.last_name}`,
+      authorAvatar: r.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(`${r.first_name} ${r.last_name}`)}&background=1d4ed8&color=fff&size=128`,
+      note: r.content,
+      createdAt: r.created_at,
+      updatedAt: r.updated_at,
+    }))
+
+    return NextResponse.json(notes)
+  } catch (error) {
+    console.error("Lead notes API error:", error)
+    return NextResponse.json({ error: "Failed to load notes" }, { status: 500 })
+  }
+}
@@ -0,0 +1,68 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+function stageToStatus(name: string): string {
+  switch (name) {
+    case "New": return "open"
+    case "Contacted": return "contacted"
+    case "Qualified":
+    case "Interested":
+    case "Demo Scheduled":
+    case "Negotiation": return "pending"
+    case "Closed Won": return "closed"
+    case "Closed Lost": return "ignored"
+    default: return "open"
+  }
+}
+
+export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const { id } = await params
+
+    const result = await query(
+      `SELECT l.id, l.company_name, l.contact_name, l.email, l.phone, l.score,
+              l.assigned_to, l.created_at, l.updated_at, l.notes, l.source_id,
+              ls.name AS stage_name,
+              u.id AS user_id, u.first_name, u.last_name, u.email AS user_email, u.avatar_url
+       FROM leads l
+       JOIN lead_stages ls ON ls.id = l.stage_id
+       LEFT JOIN users u ON u.id = l.assigned_to
+       WHERE l.id = $1 AND l.deleted_at IS NULL`,
+      [id]
+    )
+
+    if (result.rows.length === 0) {
+      return NextResponse.json({ error: "Lead not found" }, { status: 404 })
+    }
+
+    const r = result.rows[0]
+    const lead = {
+      id: r.id,
+      companyName: r.company_name || "",
+      contactName: r.contact_name,
+      email: r.email || "",
+      phone: r.phone || "",
+      source: "",
+      description: r.notes || "",
+      status: stageToStatus(r.stage_name),
+      assignedUserId: r.assigned_to,
+      assignedUser: r.assigned_to ? {
+        id: r.user_id,
+        name: `${r.first_name} ${r.last_name}`,
+        email: r.user_email,
+        avatar: r.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(`${r.first_name} ${r.last_name}`)}&background=1d4ed8&color=fff&size=128`,
+      } : null,
+      createdAt: r.created_at,
+      updatedAt: r.updated_at,
+    }
+
+    return NextResponse.json(lead)
+  } catch (error) {
+    console.error("Lead detail API error:", error)
+    return NextResponse.json({ error: "Failed to load lead" }, { status: 500 })
+  }
+}
@@ -0,0 +1,105 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+function stageToStatus(name: string): string {
+  switch (name) {
+    case "New": return "open"
+    case "Contacted": return "contacted"
+    case "Qualified":
+    case "Interested":
+    case "Demo Scheduled":
+    case "Negotiation": return "pending"
+    case "Closed Won": return "closed"
+    case "Closed Lost": return "ignored"
+    default: return "open"
+  }
+}
+
+function getPeriodDateRange(period: string): { start: Date; end: Date } | null {
+  if (period === "all") return null
+  const end = new Date()
+  let start: Date
+  switch (period) {
+    case "7days": start = new Date(end); start.setDate(start.getDate() - 7); break
+    case "30days": start = new Date(end); start.setDate(start.getDate() - 30); break
+    case "12months": start = new Date(end); start.setFullYear(start.getFullYear() - 12); break
+    case "6months": default: start = new Date(end); start.setMonth(start.getMonth() - 6); break
+  }
+  return { start, end }
+}
+
+export async function GET(request: NextRequest) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const { searchParams } = new URL(request.url)
+    const search = searchParams.get("search") || ""
+    const status = searchParams.get("status") || "all"
+    const period = searchParams.get("period") || "all"
+
+    let sql = `SELECT l.id, l.company_name, l.contact_name, l.email, l.phone, l.score,
+                      l.assigned_to, l.created_at, l.updated_at, l.notes, l.source_id,
+                      ls.name AS stage_name,
+                      u.id AS user_id, u.first_name, u.last_name, u.email AS user_email, u.avatar_url
+               FROM leads l
+               JOIN lead_stages ls ON ls.id = l.stage_id
+               LEFT JOIN users u ON u.id = l.assigned_to
+               WHERE l.deleted_at IS NULL`
+
+    const params: any[] = []
+    let paramIdx = 1
+
+    if (period !== "all") {
+      const range = getPeriodDateRange(period)
+      if (range) {
+        sql += ` AND l.created_at >= $${paramIdx} AND l.created_at <= $${paramIdx + 1}`
+        params.push(range.start.toISOString(), range.end.toISOString())
+        paramIdx += 2
+      }
+    }
+
+    if (search) {
+      sql += ` AND (l.contact_name ILIKE $${paramIdx} OR l.company_name ILIKE $${paramIdx} OR l.email ILIKE $${paramIdx} OR l.phone ILIKE $${paramIdx})`
+      params.push(`%${search}%`)
+      paramIdx++
+    }
+
+    sql += ` ORDER BY l.created_at DESC`
+
+    const result = await query(sql, params)
+
+    let leads = result.rows.map((r: any) => {
+      const s = stageToStatus(r.stage_name)
+      return {
+        id: r.id,
+        companyName: r.company_name || "",
+        contactName: r.contact_name,
+        email: r.email || "",
+        phone: r.phone || "",
+        source: "",
+        description: r.notes || "",
+        status: s,
+        assignedUserId: r.assigned_to,
+        assignedUser: r.assigned_to ? {
+          id: r.user_id,
+          name: `${r.first_name} ${r.last_name}`,
+          email: r.user_email,
+          avatar: r.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(`${r.first_name} ${r.last_name}`)}&background=1d4ed8&color=fff&size=128`,
+        } : null,
+        createdAt: r.created_at,
+        updatedAt: r.updated_at,
+      }
+    })
+
+    if (status !== "all") {
+      leads = leads.filter((l: any) => l.status === status)
+    }
+
+    return NextResponse.json(leads)
+  } catch (error) {
+    console.error("Leads API error:", error)
+    return NextResponse.json({ error: "Failed to load leads" }, { status: 500 })
+  }
+}
@@ -0,0 +1,29 @@
+import { NextResponse } from "next/server"
+import os from "os"
+
+let prevCpu = process.cpuUsage()
+let prevTime = Date.now()
+
+export async function GET() {
+  const now = Date.now()
+  const elapsed = now - prevTime
+  const currentCpu = process.cpuUsage()
+
+  const user = currentCpu.user - prevCpu.user
+  const sys = currentCpu.system - prevCpu.system
+  const totalUs = user + sys
+
+  // CPU time (ms) / wall time (ms) * 100 = % of one core
+  const cpuPct = elapsed > 0 ? Math.round((totalUs / 1000) / elapsed * 100 * 10) / 10 : 0
+
+  prevCpu = currentCpu
+  prevTime = now
+
+  const mem = process.memoryUsage()
+
+  return NextResponse.json({
+    rssMB: Math.round(mem.rss / 1024 / 1024),
+    cpuPct,
+    cores: os.cpus().length,
+  })
+}
@@ -0,0 +1,25 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+export async function POST(request: NextRequest) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const { avatar } = await request.json()
+    if (!avatar || typeof avatar !== "string") {
+      return NextResponse.json({ error: "Invalid avatar data" }, { status: 400 })
+    }
+
+    await query(
+      `UPDATE users SET avatar_url = $1 WHERE id = $2`,
+      [avatar, user.id],
+    )
+
+    return NextResponse.json({ avatar })
+  } catch (error) {
+    console.error("Avatar upload error:", error)
+    return NextResponse.json({ error: "Failed to update avatar" }, { status: 500 })
+  }
+}
@@ -6,7 +6,7 @@ export async function GET() {
  try {
    const result = await query(
      `SELECT u.id, u.username, u.email, u.first_name, u.last_name,
-              u.is_active AS active, u.created_at,
+              u.is_active AS active, u.created_at, u.avatar_url,
              r.name AS role
       FROM users u
       JOIN user_roles ur ON ur.user_id = u.id
@@ -20,7 +20,7 @@ export async function GET() {
      email: row.email,
      role: row.role.toLowerCase(),
      active: row.active,
-      avatar: `https://ui-avatars.com/api/?name=${encodeURIComponent(`${row.first_name}+${row.last_name}`)}&background=1d4ed8&color=fff&size=128`,
+      avatar: row.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(`${row.first_name}+${row.last_name}`)}&background=1d4ed8&color=fff&size=128`,
      createdAt: row.created_at,
    }))
    return NextResponse.json({ users }, { status: 200 })
@@ -0,0 +1,40 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+export async function GET(request: NextRequest) {
+  try {
+    const currentUser = await getSessionUser()
+    if (!currentUser) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const q = request.nextUrl.searchParams.get("q") || ""
+
+    if (!q.trim()) {
+      return NextResponse.json({ users: [] })
+    }
+
+    const result = await query(
+      `SELECT id, first_name || ' ' || last_name AS name, email, avatar_url
+       FROM users
+       WHERE deleted_at IS NULL
+         AND id != $1
+         AND (LOWER(first_name || ' ' || last_name) LIKE LOWER($2)
+              OR LOWER(email) LIKE LOWER($2))
+       ORDER BY first_name ASC
+       LIMIT 10`,
+      [currentUser.id, `%${q}%`],
+    )
+
+    const users = result.rows.map((row: any) => ({
+      id: row.id,
+      name: row.name,
+      email: row.email,
+      avatar: row.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(row.name)}&background=1d4ed8&color=fff&size=128`,
+    }))
+
+    return NextResponse.json({ users })
+  } catch (error) {
+    console.error("User search error:", error)
+    return NextResponse.json({ error: "Search failed" }, { status: 500 })
+  }
+}