70 lines
2.3 KiB
TypeScript
70 lines
2.3 KiB
TypeScript
import { NextRequest, NextResponse } from 'next/server'
|
|
import bcrypt from 'bcryptjs'
|
|
import prisma from '@/lib/prisma'
|
|
import { isAdmin, USER_SAFE_SELECT } from '@/lib/auth-utils'
|
|
|
|
// GET /api/users (Admin only)
|
|
export async function GET(request: NextRequest) {
|
|
try {
|
|
if (!(await isAdmin(request))) {
|
|
return NextResponse.json({ error: 'Accès non autorisé' }, { status: 403 })
|
|
}
|
|
|
|
const users = await prisma.user.findMany({
|
|
select: {
|
|
...USER_SAFE_SELECT,
|
|
businesses: true
|
|
},
|
|
orderBy: { createdAt: 'desc' },
|
|
})
|
|
return NextResponse.json(users)
|
|
} catch (error) {
|
|
console.error('GET /api/users error:', error)
|
|
return NextResponse.json({ error: 'Erreur serveur' }, { status: 500 })
|
|
}
|
|
}
|
|
|
|
// POST /api/users (Admin only — hashes password and whitelists fields)
|
|
export async function POST(request: NextRequest) {
|
|
try {
|
|
if (!(await isAdmin(request))) {
|
|
return NextResponse.json({ error: 'Accès non autorisé' }, { status: 403 })
|
|
}
|
|
|
|
const body = await request.json()
|
|
const email = body.email?.toLowerCase().trim()
|
|
const name = body.name?.trim()
|
|
const rawPassword = body.password
|
|
|
|
if (!email || !name || !rawPassword || rawPassword.length < 8) {
|
|
return NextResponse.json(
|
|
{ error: 'Nom, email et mot de passe (min. 8 caractères) requis' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
const hashedPassword = await bcrypt.hash(rawPassword, 10)
|
|
const allowedRole = ['VISITOR', 'ENTREPRENEUR', 'ADMIN'].includes(body.role)
|
|
? body.role
|
|
: 'VISITOR'
|
|
|
|
const user = await prisma.user.create({
|
|
data: {
|
|
name,
|
|
email,
|
|
password: hashedPassword,
|
|
role: allowedRole,
|
|
phone: body.phone || null,
|
|
bio: body.bio || null,
|
|
location: body.location || null,
|
|
emailVerified: true,
|
|
},
|
|
select: USER_SAFE_SELECT
|
|
})
|
|
return NextResponse.json(user, { status: 201 })
|
|
} catch (error) {
|
|
console.error('POST /api/users error:', error)
|
|
return NextResponse.json({ error: 'Erreur lors de la création' }, { status: 500 })
|
|
}
|
|
}
|