feat: add Facebook account tracking and management

- Introduced new migration for `facebook_accounts` and `facebook_scrape_logs` tables.
- Updated the scraping logic to handle Facebook accounts, including success and failure tracking.
- Implemented API endpoints for managing Facebook accounts and their scrape logs.
- Enhanced user permissions to restrict access to Facebook account management to admins and super admins.
- Added a dialog component for displaying and managing Facebook accounts in the UI.
- Updated lead fetching logic to include user role checks for assignment and access.

src/app/api/leads/[id]/notes/route.ts

@@ -3,12 +3,28 @@ import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"
 import { avatarSvgUrl } from "@/lib/avatar"
 
+async function checkLeadAccess(leadId: string, userId: string): Promise<boolean> {
+  const result = await query(
+    `SELECT 1 FROM leads WHERE id = $1 AND deleted_at IS NULL
+     AND (assigned_to = $2 OR EXISTS (
+       SELECT 1 FROM user_roles ur JOIN roles r ON r.id = ur.role_id
+       WHERE ur.user_id = $2 AND r.name IN ('ADMIN', 'SUPER_ADMIN')
+     ))`,
+    [leadId, userId]
+  )
+  return result.rows.length > 0
+}
+
 export async function POST(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   try {
     const user = await getSessionUser()
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
     const { id } = await params
+    if (!await checkLeadAccess(id, user.id)) {
+      return NextResponse.json({ error: "Lead not found" }, { status: 404 })
+    }
+
     const { content } = await request.json()
     if (!content?.trim()) {
       return NextResponse.json({ error: "Content is required" }, { status: 400 })
@@ -33,6 +49,9 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
     const { id } = await params
+    if (!await checkLeadAccess(id, user.id)) {
+      return NextResponse.json({ error: "Lead not found" }, { status: 404 })
+    }
     const { searchParams } = new URL(request.url)
     const limit = parseInt(searchParams.get("limit") || "50", 10)
     const offset = parseInt(searchParams.get("offset") || "0", 10)

src/app/api/leads/[id]/route.ts

@@ -111,6 +111,11 @@ export async function PATCH(request: NextRequest, { params }: { params: Promise<
     if (body.description !== undefined) { fields.push(`notes = $${idx++}`); values.push(body.description) }
     if (body.source !== undefined) { fields.push(`source_id = $${idx++}`); values.push(body.source) }
     if (body.assignedUserId !== undefined) {
+      const isAdmin = user.role === "admin" || user.role === "super_admin"
+      if (!isAdmin) {
+        // non-admin cannot reassign
+        return NextResponse.json({ error: "Only admins can reassign leads" }, { status: 403 })
+      }
       fields.push(`assigned_to = $${idx++}`)
       values.push(body.assignedUserId === "none" ? null : body.assignedUserId)
     }

src/app/api/leads/route.ts

@@ -123,6 +123,15 @@ export async function POST(request: NextRequest) {
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
     const body = await request.json()
+    const isAdmin = user.role === "admin" || user.role === "super_admin"
+
+    // Non-admin users can only assign leads to themselves; admin/super_admin can assign to anyone
+    let assignedUserId = body.assignedUserId
+    if (!isAdmin) {
+      assignedUserId = user.id
+    } else if (assignedUserId === "none" || !assignedUserId) {
+      assignedUserId = null
+    }
 
     const stageResult = await query(
       "SELECT id FROM lead_stages WHERE name = $1",
@@ -142,7 +151,7 @@ export async function POST(request: NextRequest) {
         body.description || null,
         body.source || null,
         stageId,
-        body.assignedUserId === "none" ? null : body.assignedUserId,
+        assignedUserId,
       ]
     )