feat: add admin dashboard and core API routes with Docker configuration

app/api/users/me/route.ts

@@ -1,37 +1,52 @@
 import { NextRequest, NextResponse } from 'next/server'
 import prisma from '@/lib/prisma'
+import { getAuthUser, USER_SAFE_SELECT } from '@/lib/auth-utils'
 
-// PATCH /api/users/me — Update personal user profile
-export async function PATCH(
-    request: NextRequest,
-    context: { params: Promise<any> }
-): Promise<Response> {
+// GET /api/users/me — Get current authenticated user profile
+export async function GET(request: NextRequest): Promise<Response> {
     try {
-        const userId = request.headers.get('x-user-id')
-        const data = await request.json()
-
-        if (!userId) {
+        const authUser = await getAuthUser(request)
+        if (!authUser) {
             return NextResponse.json({ error: 'Utilisateur non identifié' }, { status: 401 })
         }
 
+        const user = await prisma.user.findUnique({
+            where: { id: authUser.id },
+            select: USER_SAFE_SELECT
+        })
+
+        if (!user) {
+            return NextResponse.json({ error: 'Utilisateur introuvable' }, { status: 404 })
+        }
+
+        return NextResponse.json(user)
+    } catch (error) {
+        console.error('GET /api/users/me error:', error)
+        return NextResponse.json({ error: 'Erreur serveur' }, { status: 500 })
+    }
+}
+
+// PATCH /api/users/me — Update personal user profile
+export async function PATCH(
+    request: NextRequest
+): Promise<Response> {
+    try {
+        const authUser = await getAuthUser(request)
+        if (!authUser) {
+            return NextResponse.json({ error: 'Utilisateur non identifié' }, { status: 401 })
+        }
+
+        const data = await request.json()
+
         const updatedUser = await prisma.user.update({
-            where: { id: userId },
+            where: { id: authUser.id },
             data: {
                 name: data.name,
                 phone: data.phone,
                 bio: data.bio,
                 location: data.location,
             },
-            select: {
-                id: true,
-                name: true,
-                email: true,
-                role: true,
-                phone: true,
-                bio: true,
-                location: true,
-                avatar: true
-            }
+            select: USER_SAFE_SELECT
         })
 
         return NextResponse.json(updatedUser)

app/api/users/profile/route.ts

@@ -1,27 +1,25 @@
 import { NextRequest, NextResponse } from 'next/server';
 import prisma from '@/lib/prisma';
+import { getAuthUser, USER_SAFE_SELECT } from '@/lib/auth-utils';
 
 export async function GET(request: NextRequest) {
-    const { searchParams } = new URL(request.url);
-    const email = searchParams.get('email');
+    const authUser = await getAuthUser(request);
+    if (!authUser) {
+        return NextResponse.json({ error: 'Authentification requise' }, { status: 401 });
+    }
 
-    if (!email) {
-        return NextResponse.json({ error: 'Email requis' }, { status: 400 });
+    const { searchParams } = new URL(request.url);
+    const email = searchParams.get('email')?.toLowerCase().trim() || authUser.email.toLowerCase();
+
+    // Seul l'utilisateur lui-même ou un administrateur peut consulter ce profil par email
+    if (authUser.role !== 'ADMIN' && authUser.email.toLowerCase() !== email) {
+        return NextResponse.json({ error: 'Accès non autorisé' }, { status: 403 });
     }
 
     try {
         const user = await prisma.user.findUnique({
             where: { email },
-            select: {
-                id: true,
-                name: true,
-                email: true,
-                role: true,
-                avatar: true,
-                phone: true,
-                bio: true,
-                location: true
-            }
+            select: USER_SAFE_SELECT
         });
 
         if (!user) {

app/api/users/route.ts

@@ -1,8 +1,9 @@
 import { NextRequest, NextResponse } from 'next/server'
+import bcrypt from 'bcryptjs'
 import prisma from '@/lib/prisma'
 import { isAdmin, USER_SAFE_SELECT } from '@/lib/auth-utils'
 
-// GET /api/users
+// GET /api/users (Admin only)
 export async function GET(request: NextRequest) {
     try {
         if (!(await isAdmin(request))) {
@@ -23,7 +24,7 @@ export async function GET(request: NextRequest) {
     }
 }
 
-// POST /api/users (Admin only)
+// POST /api/users (Admin only — hashes password and whitelists fields)
 export async function POST(request: NextRequest) {
     try {
         if (!(await isAdmin(request))) {
@@ -31,12 +32,33 @@ export async function POST(request: NextRequest) {
         }
 
         const body = await request.json()
-        
-        // Note: For admins, we might want to allow creating users directly, 
-        // but we should still ensure password hashing if provided.
-        // For now, we just restrict it to admins to prevent the public leak.
+        const email = body.email?.toLowerCase().trim()
+        const name = body.name?.trim()
+        const rawPassword = body.password
+
+        if (!email || !name || !rawPassword || rawPassword.length < 8) {
+            return NextResponse.json(
+                { error: 'Nom, email et mot de passe (min. 8 caractères) requis' },
+                { status: 400 }
+            )
+        }
+
+        const hashedPassword = await bcrypt.hash(rawPassword, 10)
+        const allowedRole = ['VISITOR', 'ENTREPRENEUR', 'ADMIN'].includes(body.role)
+            ? body.role
+            : 'VISITOR'
+
         const user = await prisma.user.create({ 
-            data: body,
+            data: {
+                name,
+                email,
+                password: hashedPassword,
+                role: allowedRole,
+                phone: body.phone || null,
+                bio: body.bio || null,
+                location: body.location || null,
+                emailVerified: true,
+            },
             select: USER_SAFE_SELECT
         })
         return NextResponse.json(user, { status: 201 })