rb fine tune

apps/admin/src/app/api/users/route.ts

@@ -331,8 +331,17 @@ export async function PUT(request: NextRequest) {
       return validationErrorResponse(validation.errors);
     }
 
-    const { id, email, firstName, lastName, role, phone, gymId } =
-      validation.data;
+    const {
+      id,
+      email,
+      firstName,
+      lastName,
+      role,
+      phone,
+      gymId,
+      membershipType,
+      membershipStatus,
+    } = validation.data;
 
     log.debug("Updating user", {
       id,
@@ -342,6 +351,8 @@ export async function PUT(request: NextRequest) {
       role,
       phone,
       gymId,
+      membershipType,
+      membershipStatus,
     });
 
     const db = await getDatabase();
@@ -363,6 +374,27 @@ export async function PUT(request: NextRequest) {
       return notFoundResponse("User not found");
     }
 
+    log.debug("Edit authorization check", {
+      requesterId,
+      requesterRole: requester.role,
+      requesterGymId: requester.gymId,
+      targetUserId: id,
+      targetRole: existingUser.role,
+      targetGymId: existingUser.gymId,
+      requestedRole: role,
+    });
+
+    // Authorization: check gym-based permissions
+    // Non-superAdmins can only edit users in their own gym
+    if (requester.role !== "superAdmin") {
+      if (!requester.gymId) {
+        return forbiddenResponse("No gym assigned to requester");
+      }
+      if (existingUser.gymId !== requester.gymId) {
+        return forbiddenResponse("Cannot edit users from other gyms");
+      }
+    }
+
     // Authorization: determine allowed role changes
     const requesterRole = requester.role;
     const allowedByRole: Record<string, string[]> = {
@@ -373,10 +405,26 @@ export async function PUT(request: NextRequest) {
       generalUser: [], // general users cannot change roles
     };
 
-    if (role && !allowedByRole[requesterRole]?.includes(role)) {
+    // Only check authorization if the role is actually being changed
+    if (
+      role &&
+      role !== existingUser.role &&
+      !allowedByRole[requesterRole]?.includes(role)
+    ) {
       return forbiddenResponse(`Not authorized to assign role '${role}'`);
     }
 
+    // Authorization: trainers cannot reassign users to different gyms
+    if (
+      requesterRole === "trainer" &&
+      gymId !== undefined &&
+      gymId !== existingUser.gymId
+    ) {
+      return forbiddenResponse(
+        "Trainers cannot reassign users to different gyms",
+      );
+    }
+
     // Check if email is being changed and if it's already taken
     if (email && email !== existingUser.email) {
       const userWithEmail = await db.getUserByEmail(email);
@@ -451,6 +499,43 @@ export async function PUT(request: NextRequest) {
     );
     log.debug("User updated in database", { updatedRow });
 
+    // If the user is a client, update membership fields in clients table
+    const finalRole = role ?? existingUser.role;
+    if (
+      finalRole === "client" &&
+      (membershipType !== undefined || membershipStatus !== undefined)
+    ) {
+      log.debug("Updating client membership fields", {
+        userId: id,
+        membershipType,
+        membershipStatus,
+      });
+
+      // Check if client record exists
+      const existingClient = await rawDb.get(
+        sql`SELECT * FROM clients WHERE user_id = ${id}`,
+      );
+
+      if (existingClient) {
+        // Update existing client record
+        await rawDb.run(
+          sql`UPDATE clients
+              SET membership_type = ${membershipType ?? (existingClient as any).membership_type},
+                  membership_status = ${membershipStatus ?? (existingClient as any).membership_status},
+                  updated_at = ${Date.now()}
+              WHERE user_id = ${id}`,
+        );
+        log.debug("Client membership updated");
+      } else {
+        // Create client record if it doesn't exist
+        await rawDb.run(
+          sql`INSERT INTO clients (id, user_id, membership_type, membership_status, join_date, created_at, updated_at)
+              VALUES (${`client_${id}_${Date.now()}`}, ${id}, ${membershipType ?? "basic"}, ${membershipStatus ?? "active"}, ${Date.now()}, ${Date.now()}, ${Date.now()})`,
+        );
+        log.debug("Client record created");
+      }
+    }
+
     const updatedUser = {
       ...existingUser,
       email: email ?? existingUser.email,