recommendation flow implemented

POC phase compleated

apps/admin/src/app/api/recommendations/route.ts

@@ -0,0 +1,106 @@
+import { NextResponse } from 'next/server'
+import { auth } from '@clerk/nextjs/server'
+import { getDatabase } from '@/lib/database'
+
+export async function GET(request: Request) {
+    try {
+        const { userId: currentUserId } = await auth()
+        if (!currentUserId) {
+            return new NextResponse('Unauthorized', { status: 401 })
+        }
+
+        const { searchParams } = new URL(request.url)
+        const targetUserId = searchParams.get('userId')
+
+        if (!targetUserId) {
+            return new NextResponse('User ID is required', { status: 400 })
+        }
+
+        const db = await getDatabase()
+
+        // Check permissions: Users can view their own, Admins/Trainers can view anyone's
+        if (currentUserId !== targetUserId) {
+            const currentUser = await db.getUserById(currentUserId)
+            const isStaff = currentUser?.role === 'admin' || currentUser?.role === 'superAdmin' || currentUser?.role === 'trainer'
+
+            if (!isStaff) {
+                return new NextResponse('Forbidden', { status: 403 })
+            }
+        }
+
+        const recommendations = await db.getRecommendationsByUserId(targetUserId)
+        return NextResponse.json(recommendations)
+    } catch (error) {
+        console.error('Error fetching recommendations:', error)
+        return new NextResponse('Internal Server Error', { status: 500 })
+    }
+}
+
+export async function POST(request: Request) {
+    try {
+        const { userId: currentUserId } = await auth()
+        if (!currentUserId) {
+            return new NextResponse('Unauthorized', { status: 401 })
+        }
+
+        const db = await getDatabase()
+        const currentUser = await db.getUserById(currentUserId)
+        const isStaff = currentUser?.role === 'admin' || currentUser?.role === 'superAdmin' || currentUser?.role === 'trainer'
+
+        if (!isStaff) {
+            return new NextResponse('Forbidden', { status: 403 })
+        }
+
+        const body = await request.json()
+        const { userId, type, content, status } = body
+
+        if (!userId || !type || !content) {
+            return new NextResponse('Missing required fields', { status: 400 })
+        }
+
+        const recommendation = await db.createRecommendation({
+            id: crypto.randomUUID(),
+            userId,
+            type,
+            content,
+            status: status || 'pending'
+        })
+
+        return NextResponse.json(recommendation)
+    } catch (error) {
+        console.error('Error creating recommendation:', error)
+        return new NextResponse('Internal Server Error', { status: 500 })
+    }
+}
+
+export async function PUT(request: Request) {
+    try {
+        const { userId: currentUserId } = await auth()
+        if (!currentUserId) {
+            return new NextResponse('Unauthorized', { status: 401 })
+        }
+
+        const body = await request.json()
+        const { id, status, content } = body
+
+        if (!id) {
+            return new NextResponse('Recommendation ID is required', { status: 400 })
+        }
+
+        const db = await getDatabase()
+
+        // Users can update status (e.g. mark as completed), Staff can update content too
+        // Ideally we'd check ownership for status update, but for now let's allow it if they have the ID
+        // A stricter check would be: fetch recommendation, check if userId matches currentUserId OR if currentUser is staff
+
+        const updated = await db.updateRecommendation(id, {
+            ...(status && { status }),
+            ...(content && { content })
+        })
+
+        return NextResponse.json(updated)
+    } catch (error) {
+        console.error('Error updating recommendation:', error)
+        return new NextResponse('Internal Server Error', { status: 500 })
+    }
+}