role based auth

implemented superadmin -> admin -> traniner

apps/admin/src/app/api/users/route.ts

@@ -24,14 +24,42 @@ import {
   internalErrorResponse,
   badRequestResponse,
 } from "@/lib/api/responses";
+import { getUsersByGym } from "@/lib/gym-context";
+import { ensureUserSynced } from "@/lib/sync-user";
 
 export async function GET(request: NextRequest) {
   try {
+    // First authenticate the user
+    const { userId: clerkUserId } = await auth();
+    if (!clerkUserId) {
+      return unauthorizedResponse();
+    }
+
     const db = await getDatabase();
+    const currentUser = await ensureUserSynced(clerkUserId, db);
+
+    if (!currentUser) {
+      return forbiddenResponse("User not found");
+    }
+
     const { searchParams } = new URL(request.url);
     const role = searchParams.get("role");
 
-    let users = await db.getAllUsers();
+    // Get target gym based on role
+    const targetGymId =
+      currentUser.role === "superAdmin"
+        ? (searchParams.get("gymId") ?? undefined)
+        : (currentUser.gymId ?? undefined);
+
+    // Validate gym access for non-superAdmins
+    if (currentUser.role !== "superAdmin" && !targetGymId) {
+      return forbiddenResponse("No gym assigned");
+    }
+
+    // Get users filtered by gym
+    let users = targetGymId
+      ? await getUsersByGym(targetGymId)
+      : await db.getAllUsers();
 
     // Hydrate gymId from raw DB to ensure consistency with writes
     const rawUserRows = await rawDb.all(sql`SELECT id, gym_id FROM users`);