feat: add admin dashboard and core API routes with Docker configuration

app/api/offers/[id]/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server'
 import prisma from '../../../../lib/prisma'
-
-type Params = { params: Promise<{ id: string }> }
+import { getAuthUser } from '@/lib/auth-utils'
 
 // GET /api/offers/[id]
 export async function GET(
@@ -22,17 +21,43 @@ export async function GET(
     }
 }
 
-// PATCH /api/offers/[id]
+// PATCH /api/offers/[id] (Owner or Admin only)
 export async function PATCH(
   request: NextRequest, 
   context: { params: Promise<{ id: string }> }
 ): Promise<Response> {
     try {
+        const authUser = await getAuthUser(request)
+        if (!authUser) {
+            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
+        }
+
         const { id } = await context.params
+        const existing = await prisma.offer.findUnique({
+            where: { id },
+            include: { business: { select: { ownerId: true } } }
+        })
+
+        if (!existing) {
+            return NextResponse.json({ error: 'Offre non trouvée' }, { status: 404 })
+        }
+
+        if (existing.business.ownerId !== authUser.id && authUser.role !== 'ADMIN') {
+            return NextResponse.json({ error: 'Non autorisé' }, { status: 403 })
+        }
+
         const body = await request.json()
+        const { title, description, price, type, imageUrl } = body
+
         const offer = await prisma.offer.update({
             where: { id },
-            data: body,
+            data: {
+                ...(title !== undefined ? { title } : {}),
+                ...(description !== undefined ? { description } : {}),
+                ...(price !== undefined ? { price } : {}),
+                ...(type !== undefined ? { type } : {}),
+                ...(imageUrl !== undefined ? { imageUrl } : {}),
+            },
             include: { business: true },
         })
         return NextResponse.json(offer)
@@ -42,13 +67,31 @@ export async function PATCH(
     }
 }
 
-// DELETE /api/offers/[id]
+// DELETE /api/offers/[id] (Owner or Admin only)
 export async function DELETE(
-  _request: NextRequest, 
+  request: NextRequest, 
   context: { params: Promise<{ id: string }> }
 ): Promise<Response> {
     try {
+        const authUser = await getAuthUser(request)
+        if (!authUser) {
+            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
+        }
+
         const { id } = await context.params
+        const existing = await prisma.offer.findUnique({
+            where: { id },
+            include: { business: { select: { ownerId: true } } }
+        })
+
+        if (!existing) {
+            return NextResponse.json({ error: 'Offre non trouvée' }, { status: 404 })
+        }
+
+        if (existing.business.ownerId !== authUser.id && authUser.role !== 'ADMIN') {
+            return NextResponse.json({ error: 'Non autorisé' }, { status: 403 })
+        }
+
         await prisma.offer.delete({ where: { id } })
         return NextResponse.json({ success: true })
     } catch (error) {

app/api/offers/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server'
 import prisma from '@/lib/prisma'
+import { getAuthUser } from '@/lib/auth-utils'
 
 // GET /api/offers — optionally filter by businessId
 export async function GET(request: NextRequest) {
@@ -22,11 +23,16 @@ export async function GET(request: NextRequest) {
     }
 }
 
-// POST /api/offers
+// POST /api/offers (Owner or Admin only)
 export async function POST(request: NextRequest) {
     try {
+        const authUser = await getAuthUser(request)
+        if (!authUser) {
+            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
+        }
+
         const body = await request.json()
-        const { businessId } = body
+        const { businessId, title, description, price, type, imageUrl } = body
 
         if (!businessId) {
             return NextResponse.json({ error: 'businessId manquant' }, { status: 400 })
@@ -44,6 +50,10 @@ export async function POST(request: NextRequest) {
             return NextResponse.json({ error: 'Entreprise non trouvée' }, { status: 404 })
         }
 
+        if (business.ownerId !== authUser.id && authUser.role !== 'ADMIN') {
+            return NextResponse.json({ error: 'Non autorisé : vous n\'êtes pas propriétaire de cette entreprise' }, { status: 403 })
+        }
+
         // Fetch the specific limit for this tier from the database
         const planDetails = await prisma.pricingPlan.findUnique({
             where: { tier: business.plan }
@@ -63,9 +73,16 @@ export async function POST(request: NextRequest) {
             }, { status: 403 })
         }
 
-        // 3. Create offer
+        // 3. Create offer with whitelisted fields
         const offer = await prisma.offer.create({
-            data: body,
+            data: {
+                businessId,
+                title: title || '',
+                description: description || '',
+                price: price ?? '',
+                type: type || 'PRODUCT',
+                imageUrl: imageUrl || '',
+            },
             include: { business: true },
         })
         return NextResponse.json(offer, { status: 201 })