admin board

src/app/api/admin/users/route.ts

@@ -0,0 +1,62 @@
+import { NextResponse } from "next/server";
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
+
+// GET /api/admin/users - List all users
+export async function GET() {
+  const session = await getServerSession(authOptions);
+
+  if (!session || session.user.role !== "ADMIN") {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const users = await prisma.user.findMany({
+    select: {
+      id: true,
+      name: true,
+      email: true,
+      image: true,
+      role: true,
+      reports: {
+        orderBy: { date: "desc" },
+        take: 1,
+        select: { date: true, status: true },
+      },
+    },
+    orderBy: { name: "asc" },
+  });
+
+  return NextResponse.json(users);
+}
+
+// PATCH /api/admin/users - Update a user's role
+export async function PATCH(req: Request) {
+  const session = await getServerSession(authOptions);
+
+  if (!session || session.user.role !== "ADMIN") {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const { userId, role } = await req.json();
+
+  if (!userId || !["EMPLOYEE", "ADMIN"].includes(role)) {
+    return NextResponse.json({ error: "Invalid request" }, { status: 400 });
+  }
+
+  // Prevent admins from demoting themselves
+  if (userId === session.user.id && role === "EMPLOYEE") {
+    return NextResponse.json({ error: "You cannot remove your own admin privileges" }, { status: 403 });
+  }
+
+  const updated = await prisma.user.update({
+    where: { id: userId },
+    data: { role },
+    select: { id: true, name: true, email: true, role: true },
+  });
+
+  return NextResponse.json(updated);
+}