feat: add admin dashboard and core API routes with Docker configuration

app/api/offers/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server'
 import prisma from '@/lib/prisma'
+import { getAuthUser } from '@/lib/auth-utils'
 
 // GET /api/offers — optionally filter by businessId
 export async function GET(request: NextRequest) {
@@ -22,11 +23,16 @@ export async function GET(request: NextRequest) {
     }
 }
 
-// POST /api/offers
+// POST /api/offers (Owner or Admin only)
 export async function POST(request: NextRequest) {
     try {
+        const authUser = await getAuthUser(request)
+        if (!authUser) {
+            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
+        }
+
         const body = await request.json()
-        const { businessId } = body
+        const { businessId, title, description, price, type, imageUrl } = body
 
         if (!businessId) {
             return NextResponse.json({ error: 'businessId manquant' }, { status: 400 })
@@ -44,6 +50,10 @@ export async function POST(request: NextRequest) {
             return NextResponse.json({ error: 'Entreprise non trouvée' }, { status: 404 })
         }
 
+        if (business.ownerId !== authUser.id && authUser.role !== 'ADMIN') {
+            return NextResponse.json({ error: 'Non autorisé : vous n\'êtes pas propriétaire de cette entreprise' }, { status: 403 })
+        }
+
         // Fetch the specific limit for this tier from the database
         const planDetails = await prisma.pricingPlan.findUnique({
             where: { tier: business.plan }
@@ -63,9 +73,16 @@ export async function POST(request: NextRequest) {
             }, { status: 403 })
         }
 
-        // 3. Create offer
+        // 3. Create offer with whitelisted fields
         const offer = await prisma.offer.create({
-            data: body,
+            data: {
+                businessId,
+                title: title || '',
+                description: description || '',
+                price: price ?? '',
+                type: type || 'PRODUCT',
+                imageUrl: imageUrl || '',
+            },
             include: { business: true },
         })
         return NextResponse.json(offer, { status: 201 })