role based auth

implemented superadmin -> admin -> traniner

apps/admin/src/app/api/recommendations/route.ts

@@ -17,6 +17,8 @@ import {
   badRequestResponse,
   internalErrorResponse,
 } from "@/lib/api/responses";
+import { getRecommendationsByGym } from "@/lib/gym-context";
+import { ensureUserSynced } from "@/lib/sync-user";
 
 export async function GET(request: NextRequest) {
   try {
@@ -25,38 +27,59 @@ export async function GET(request: NextRequest) {
       return unauthorizedResponse();
     }
 
+    const db = await getDatabase();
+    const currentUser = await ensureUserSynced(currentUserId, db);
+
+    if (!currentUser) {
+      return forbiddenResponse("User not found");
+    }
+
     const { searchParams } = new URL(request.url);
     const targetUserId = searchParams.get("userId");
 
-    const db = await getDatabase();
-
-    // If no userId provided, check if staff and return all recommendations
+    // If no userId provided, staff gets gym-scoped recommendations
     if (!targetUserId) {
-      const currentUser = await db.getUserById(currentUserId);
       const isStaff =
-        currentUser?.role === "admin" ||
-        currentUser?.role === "superAdmin" ||
-        currentUser?.role === "trainer";
+        currentUser.role === "admin" ||
+        currentUser.role === "superAdmin" ||
+        currentUser.role === "trainer";
 
       if (!isStaff) {
         return badRequestResponse("User ID is required");
       }
 
-      const recommendations = await db.getAllRecommendations();
+      // Get target gym based on role
+      const targetGymId =
+        currentUser.role === "superAdmin"
+          ? (searchParams.get("gymId") ?? undefined)
+          : (currentUser.gymId ?? undefined);
+
+      // Get recommendations filtered by gym
+      const recommendations = targetGymId
+        ? await getRecommendationsByGym(targetGymId)
+        : await db.getAllRecommendations();
+
       return successResponse({ recommendations });
     }
 
-    // Check permissions: Users can view their own, Admins/Trainers can view anyone's
-    const currentUser = await db.getUserById(currentUserId);
+    // Check permissions: Users can view their own, Admins/Trainers can view anyone's in their gym
     const isStaff =
-      currentUser?.role === "admin" ||
-      currentUser?.role === "superAdmin" ||
-      currentUser?.role === "trainer";
+      currentUser.role === "admin" ||
+      currentUser.role === "superAdmin" ||
+      currentUser.role === "trainer";
 
     if (currentUserId !== targetUserId) {
       if (!isStaff) {
         return forbiddenResponse();
       }
+
+      // Staff need to verify target user is in same gym
+      if (currentUser.role !== "superAdmin") {
+        const targetUser = await db.getUserById(targetUserId);
+        if (!targetUser || targetUser.gymId !== currentUser.gymId) {
+          return forbiddenResponse("Cannot access users from other gyms");
+        }
+      }
     }
 
     let recommendations = await db.getRecommendationsByUserId(targetUserId);