feat: add user management panel for superusers

2026-03-31 10:24:35 -07:00
parent 0f2228b9eb
commit 2ed86dafe9
8 changed files with 981 additions and 0 deletions
@@ -0,0 +1,188 @@
+import { NextResponse } from "next/server";
+import { prisma } from "@/lib/prisma";
+import { hasRole } from "@/lib/permissions";
+
+export async function PUT(
+  request: Request,
+  { params }: { params: { id: string } }
+) {
+  // Check permissions
+  const permission = await hasRole("club_admin");
+  if (!permission.allowed) {
+    return NextResponse.json(
+      { error: permission.reason || "Unauthorized" },
+      { status: 403 }
+    );
+  }
+
+  try {
+    const { id } = params;
+    const body = await request.json();
+    const { email, name, role, playerId } = body;
+
+    // Check if user exists
+    const existingUser = await prisma.user.findUnique({
+      where: { id },
+    });
+
+    if (!existingUser) {
+      return NextResponse.json(
+        { error: "User not found" },
+        { status: 404 }
+      );
+    }
+
+    // Update the user
+    const user = await prisma.user.update({
+      where: { id },
+      data: {
+        email: email || existingUser.email,
+        name: name !== undefined ? name : existingUser.name,
+        role: role || existingUser.role,
+        playerId: playerId ? parseInt(playerId) : null,
+      },
+    });
+
+    // Update the player's user relation if needed
+    if (playerId !== undefined) {
+      // First, remove user from any existing player
+      if (existingUser.playerId && existingUser.playerId !== parseInt(playerId)) {
+        await prisma.player.update({
+          where: { id: existingUser.playerId },
+          data: { user: { disconnect: true } },
+        });
+      }
+
+      // Then, connect user to the new player
+      if (playerId) {
+        await prisma.player.update({
+          where: { id: parseInt(playerId) },
+          data: { user: { connect: { id: user.id } } },
+        });
+      }
+    }
+
+    return NextResponse.json({
+      success: true,
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        role: user.role,
+        playerId: user.playerId,
+      },
+    });
+  } catch (error) {
+    console.error("Error updating user:", error);
+    return NextResponse.json(
+      { error: "Failed to update user" },
+      { status: 500 }
+    );
+  }
+}
+
+export async function DELETE(
+  request: Request,
+  { params }: { params: { id: string } }
+) {
+  // Check permissions - only site_admin can delete users
+  const permission = await hasRole("site_admin");
+  if (!permission.allowed) {
+    return NextResponse.json(
+      { error: permission.reason || "Unauthorized" },
+      { status: 403 }
+    );
+  }
+
+  try {
+    const { id } = params;
+
+    // Check if user exists
+    const existingUser = await prisma.user.findUnique({
+      where: { id },
+    });
+
+    if (!existingUser) {
+      return NextResponse.json(
+        { error: "User not found" },
+        { status: 404 }
+      );
+    }
+
+    // Cannot delete the last site_admin
+    const siteAdminCount = await prisma.user.count({
+      where: { role: "site_admin" },
+    });
+
+    if (existingUser.role === "site_admin" && siteAdminCount <= 1) {
+      return NextResponse.json(
+        { error: "Cannot delete the last site_admin user" },
+        { status: 400 }
+      );
+    }
+
+    // Remove user from player if associated
+    if (existingUser.playerId) {
+      await prisma.player.update({
+        where: { id: existingUser.playerId },
+        data: { user: { disconnect: true } },
+      });
+    }
+
+    // Delete the user
+    await prisma.user.delete({
+      where: { id },
+    });
+
+    return NextResponse.json({
+      success: true,
+      message: "User deleted successfully",
+    });
+  } catch (error) {
+    console.error("Error deleting user:", error);
+    return NextResponse.json(
+      { error: "Failed to delete user" },
+      { status: 500 }
+    );
+  }
+}
+
+export async function GET(
+  request: Request,
+  { params }: { params: { id: string } }
+) {
+  // Check permissions
+  const permission = await hasRole("club_admin");
+  if (!permission.allowed) {
+    return NextResponse.json(
+      { error: permission.reason || "Unauthorized" },
+      { status: 403 }
+    );
+  }
+
+  try {
+    const { id } = params;
+
+    const user = await prisma.user.findUnique({
+      where: { id },
+      include: {
+        player: true,
+      },
+    });
+
+    if (!user) {
+      return NextResponse.json(
+        { error: "User not found" },
+        { status: 404 }
+      );
+    }
+
+    return NextResponse.json({ user });
+  } catch (error) {
+    console.error("Error fetching user:", error);
+    return NextResponse.json(
+      { error: "Failed to fetch user" },
+      { status: 500 }
+    );
+  }
+}
@@ -0,0 +1,127 @@
+import { NextResponse } from "next/server";
+import { prisma } from "@/lib/prisma";
+import { hasRole } from "@/lib/permissions";
+import { auth } from "@/lib/auth";
+
+export async function POST(request: Request) {
+  // Check permissions
+  const permission = await hasRole("club_admin");
+  if (!permission.allowed) {
+    return NextResponse.json(
+      { error: permission.reason || "Unauthorized" },
+      { status: 403 }
+    );
+  }
+
+  try {
+    const body = await request.json();
+    const { email, password, name, role, playerId } = body;
+
+    // Validate required fields
+    if (!email || !password) {
+      return NextResponse.json(
+        { error: "Email and password are required" },
+        { status: 400 }
+      );
+    }
+
+    // Check if user already exists
+    const existingUser = await prisma.user.findUnique({
+      where: { email },
+    });
+
+    if (existingUser) {
+      return NextResponse.json(
+        { error: "A user with this email already exists" },
+        { status: 400 }
+      );
+    }
+
+    // Use Better Auth to create the user
+    const signUpResult = await auth.api.signUpEmail({
+      body: {
+        email,
+        password,
+        name: name || undefined,
+      },
+    });
+
+    const user = signUpResult.user;
+
+    // Update the user's role in the database
+    await prisma.user.update({
+      where: { id: user.id },
+      data: {
+        role: role || "player",
+        playerId: playerId ? parseInt(playerId) : null,
+        emailVerified: true, // Admin-created users are auto-verified
+      },
+    });
+
+    // If a player was associated, update the player's user relation
+    if (playerId) {
+      await prisma.player.update({
+        where: { id: parseInt(playerId) },
+        data: { user: { connect: { id: user.id } } },
+      });
+    }
+
+    return NextResponse.json({
+      success: true,
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        role: role || "player",
+        playerId: playerId ? parseInt(playerId) : null,
+      },
+    });
+  } catch (error: any) {
+    console.error("Error creating user:", error);
+    
+    // Handle Better Auth specific errors
+    if (error.message && error.message.includes("already exists")) {
+      return NextResponse.json(
+        { error: "A user with this email already exists" },
+        { status: 400 }
+      );
+    }
+    
+    return NextResponse.json(
+      { error: "Failed to create user" },
+      { status: 500 }
+    );
+  }
+}
+
+export async function GET(request: Request) {
+  // Check permissions
+  const permission = await hasRole("club_admin");
+  if (!permission.allowed) {
+    return NextResponse.json(
+      { error: permission.reason || "Unauthorized" },
+      { status: 403 }
+    );
+  }
+
+  try {
+    const { searchParams } = new URL(request.url);
+    const playerId = searchParams.get("playerId");
+
+    const users = await prisma.user.findMany({
+      where: playerId ? { playerId: parseInt(playerId) } : {},
+      orderBy: { createdAt: "desc" },
+      include: {
+        player: true,
+      },
+    });
+
+    return NextResponse.json({ users });
+  } catch (error) {
+    console.error("Error fetching users:", error);
+    return NextResponse.json(
+      { error: "Failed to fetch users" },
+      { status: 500 }
+    );
+  }
+}