feat: add admin dashboard and core API routes with Docker configuration

app/api/businesses/[id]/route.ts

@@ -2,8 +2,6 @@ import { NextRequest, NextResponse } from 'next/server'
 import prisma from '@/lib/prisma'
 import { USER_SAFE_SELECT, getAuthUser } from '@/lib/auth-utils'
 
-type Params = { params: Promise<{ id: string }> }
-
 // GET /api/businesses/[id]
 export async function GET(
   request: NextRequest, 
@@ -50,11 +48,56 @@ export async function PATCH(
   context: { params: Promise<{ id: string }> }
 ): Promise<Response> {
     try {
+        const authUser = await getAuthUser(request)
+        if (!authUser) {
+            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
+        }
+
         const { id } = await context.params
+        const existing = await prisma.business.findUnique({
+            where: { id },
+            select: { ownerId: true }
+        })
+
+        if (!existing) {
+            return NextResponse.json({ error: 'Boutique non trouvée' }, { status: 404 })
+        }
+
+        const isAdmin = authUser.role === 'ADMIN'
+        const isOwner = existing.ownerId === authUser.id
+
+        if (!isOwner && !isAdmin) {
+            return NextResponse.json({ error: 'Non autorisé' }, { status: 403 })
+        }
+
         const body = await request.json()
+
+        // Whitelist allowed fields for owners; sensitive fields require ADMIN role
+        const allowedOwnerFields = [
+            'name', 'slug', 'category', 'categoryId', 'suggestedCategory',
+            'location', 'countryId', 'city', 'description', 'logoUrl',
+            'coverUrl', 'coverPosition', 'coverZoom', 'videoUrl',
+            'contactEmail', 'contactPhone', 'websiteUrl', 'socialLinks',
+            'showEmail', 'showPhone', 'showSocials', 'tags',
+            'founderName', 'founderImageUrl', 'keyMetric', 'isActive'
+        ]
+        const allowedAdminFields = [
+            ...allowedOwnerFields,
+            'verified', 'plan', 'isFeatured', 'isHomeFeatured',
+            'isSuspended', 'suspensionReason', 'metaTitle', 'metaDescription'
+        ]
+
+        const permittedKeys = isAdmin ? allowedAdminFields : allowedOwnerFields
+        const updateData: Record<string, any> = {}
+        for (const key of permittedKeys) {
+            if (body[key] !== undefined) {
+                updateData[key] = body[key]
+            }
+        }
+
         const business = await prisma.business.update({
             where: { id },
-            data: body,
+            data: updateData,
             include: { 
                 owner: {
                     select: USER_SAFE_SELECT
@@ -75,8 +118,12 @@ export async function DELETE(
   context: { params: Promise<{ id: string }> }
 ): Promise<Response> {
     try {
+        const authUser = await getAuthUser(request)
+        if (!authUser) {
+            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
+        }
+
         const { id } = await context.params
-        const headerUserId = request.headers.get('x-user-id')
 
         // 1. Find business to check owner
         const business = await prisma.business.findUnique({
@@ -89,9 +136,8 @@ export async function DELETE(
         }
 
         // 2. Auth check (Owner or Admin)
-        const user = headerUserId ? await prisma.user.findUnique({ where: { id: headerUserId } }) : null
-        const isAdmin = user?.role === 'ADMIN'
-        const isOwner = business.ownerId === headerUserId
+        const isAdmin = authUser.role === 'ADMIN'
+        const isOwner = business.ownerId === authUser.id
 
         if (!isOwner && !isAdmin) {
             return NextResponse.json({ error: 'Non autorisé' }, { status: 403 })
@@ -101,13 +147,13 @@ export async function DELETE(
         await prisma.business.delete({ where: { id } })
 
         // 4. Update user role if they don't have other businesses
-        if (headerUserId && !isAdmin) {
+        if (!isAdmin) {
             const otherBusinesses = await prisma.business.findFirst({
-                where: { ownerId: headerUserId }
+                where: { ownerId: authUser.id }
             })
             if (!otherBusinesses) {
                 await prisma.user.update({
-                    where: { id: headerUserId },
+                    where: { id: authUser.id },
                     data: { role: 'VISITOR' }
                 })
             }