feat: add admin dashboard and core API routes with Docker configuration

app/api/offers/[id]/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server'
 import prisma from '../../../../lib/prisma'
-
-type Params = { params: Promise<{ id: string }> }
+import { getAuthUser } from '@/lib/auth-utils'
 
 // GET /api/offers/[id]
 export async function GET(
@@ -22,17 +21,43 @@ export async function GET(
     }
 }
 
-// PATCH /api/offers/[id]
+// PATCH /api/offers/[id] (Owner or Admin only)
 export async function PATCH(
   request: NextRequest, 
   context: { params: Promise<{ id: string }> }
 ): Promise<Response> {
     try {
+        const authUser = await getAuthUser(request)
+        if (!authUser) {
+            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
+        }
+
         const { id } = await context.params
+        const existing = await prisma.offer.findUnique({
+            where: { id },
+            include: { business: { select: { ownerId: true } } }
+        })
+
+        if (!existing) {
+            return NextResponse.json({ error: 'Offre non trouvée' }, { status: 404 })
+        }
+
+        if (existing.business.ownerId !== authUser.id && authUser.role !== 'ADMIN') {
+            return NextResponse.json({ error: 'Non autorisé' }, { status: 403 })
+        }
+
         const body = await request.json()
+        const { title, description, price, type, imageUrl } = body
+
         const offer = await prisma.offer.update({
             where: { id },
-            data: body,
+            data: {
+                ...(title !== undefined ? { title } : {}),
+                ...(description !== undefined ? { description } : {}),
+                ...(price !== undefined ? { price } : {}),
+                ...(type !== undefined ? { type } : {}),
+                ...(imageUrl !== undefined ? { imageUrl } : {}),
+            },
             include: { business: true },
         })
         return NextResponse.json(offer)
@@ -42,13 +67,31 @@ export async function PATCH(
     }
 }
 
-// DELETE /api/offers/[id]
+// DELETE /api/offers/[id] (Owner or Admin only)
 export async function DELETE(
-  _request: NextRequest, 
+  request: NextRequest, 
   context: { params: Promise<{ id: string }> }
 ): Promise<Response> {
     try {
+        const authUser = await getAuthUser(request)
+        if (!authUser) {
+            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
+        }
+
         const { id } = await context.params
+        const existing = await prisma.offer.findUnique({
+            where: { id },
+            include: { business: { select: { ownerId: true } } }
+        })
+
+        if (!existing) {
+            return NextResponse.json({ error: 'Offre non trouvée' }, { status: 404 })
+        }
+
+        if (existing.business.ownerId !== authUser.id && authUser.role !== 'ADMIN') {
+            return NextResponse.json({ error: 'Non autorisé' }, { status: 403 })
+        }
+
         await prisma.offer.delete({ where: { id } })
         return NextResponse.json({ success: true })
     } catch (error) {