nextjs-rewrite (#5)

Reviewed-on: #5
Co-authored-by: David Gwilliam <dhgwilliam@gmail.com>
Co-committed-by: David Gwilliam <dhgwilliam@gmail.com>

src/app/api/users/[id]/role/route.ts

@@ -0,0 +1,89 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { prisma } from '@/lib/prisma';
+import { getSession } from '@/lib/auth-simple';
+import { canAssignTournamentAdmin } from '@/lib/permissions';
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  try {
+    const session = await getSession();
+    
+    if (!session) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    // Users can only query their own role or if they're an admin
+    // Fetch the requesting user's current role from database to avoid session cache issues
+    const requestingUser = await prisma.user.findUnique({
+      where: { id: session.user.id },
+      select: { role: true }
+    });
+
+    if (!requestingUser) {
+      return NextResponse.json({ error: 'Requesting user not found' }, { status: 404 });
+    }
+
+    if (session.user.id !== params.id && requestingUser.role !== 'club_admin') {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
+
+    const user = await prisma.user.findUnique({
+      where: { id: params.id },
+      select: { role: true }
+    });
+
+    if (!user) {
+      return NextResponse.json({ error: 'User not found' }, { status: 404 });
+    }
+
+    return NextResponse.json({ role: user.role });
+  } catch (error) {
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
+
+export async function PATCH(
+  request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  try {
+    // Check if the current user has permission to assign roles
+    const permission = await canAssignTournamentAdmin();
+    if (!permission.allowed) {
+      return NextResponse.json(
+        { error: permission.reason || 'Insufficient permissions' },
+        { status: 403 }
+      );
+    }
+
+    const { role } = await request.json();
+
+    // Validate the role
+    const validRoles = ['player', 'tournament_admin', 'club_admin'];
+    if (!validRoles.includes(role)) {
+      return NextResponse.json(
+        { error: `Invalid role. Must be one of: ${validRoles.join(', ')}` },
+        { status: 400 }
+      );
+    }
+
+    // Update the user's role
+    const updatedUser = await prisma.user.update({
+      where: { id: params.id },
+      data: { role }
+    });
+
+    return NextResponse.json({ 
+      message: 'Role updated successfully',
+      user: { id: updatedUser.id, email: updatedUser.email, role: updatedUser.role }
+    });
+  } catch (error) {
+    console.error("Failed to update user role:", error);
+    return NextResponse.json(
+      { error: "Failed to update user role" },
+      { status: 500 }
+    );
+  }
+}