feat: add Facebook account tracking and management

- Introduced new migration for `facebook_accounts` and `facebook_scrape_logs` tables.
- Updated the scraping logic to handle Facebook accounts, including success and failure tracking.
- Implemented API endpoints for managing Facebook accounts and their scrape logs.
- Enhanced user permissions to restrict access to Facebook account management to admins and super admins.
- Added a dialog component for displaying and managing Facebook accounts in the UI.
- Updated lead fetching logic to include user role checks for assignment and access.

src/app/api/users/avatar/route.ts

@@ -2,6 +2,9 @@ import { NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"
 
+const ALLOWED_PREFIXES = ["data:image/png;base64,", "data:image/jpeg;base64,", "data:image/gif;base64,"]
+const MAX_AVATAR_BYTES = 2 * 1024 * 1024 // 2MB
+
 export async function POST(request: NextRequest) {
   try {
     const user = await getSessionUser()
@@ -12,6 +15,18 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: "Invalid avatar data" }, { status: 400 })
     }
 
+    const allowed = ALLOWED_PREFIXES.some((p) => avatar.startsWith(p))
+    if (!allowed) {
+      return NextResponse.json({ error: "Avatar must be a PNG, JPEG, or GIF data URL" }, { status: 400 })
+    }
+
+    // Approximate decoded size: base64 is ~4/3 of original
+    const base64Data = avatar.split(",")[1] || ""
+    const estimatedBytes = Math.round(base64Data.length * 0.75)
+    if (estimatedBytes > MAX_AVATAR_BYTES) {
+      return NextResponse.json({ error: "Avatar exceeds 2MB size limit" }, { status: 400 })
+    }
+
     await query(
       `UPDATE users SET avatar_url = $1 WHERE id = $2`,
       [avatar, user.id],

src/app/api/users/route.ts

@@ -7,6 +7,9 @@ export async function GET(request: NextRequest) {
   try {
     const sessionUser = await getSessionUser()
     if (!sessionUser) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    if (sessionUser.role !== "admin" && sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
 
     const { searchParams } = new URL(request.url)
     const limit = parseInt(searchParams.get("limit") || "50", 10)

src/app/api/users/search/route.ts

@@ -7,6 +7,9 @@ export async function GET(request: NextRequest) {
   try {
     const currentUser = await getSessionUser()
     if (!currentUser) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    if (currentUser.role !== "admin" && currentUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
 
     const q = request.nextUrl.searchParams.get("q") || ""