107 lines
3.7 KiB
TypeScript
107 lines
3.7 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { auth } from '@clerk/nextjs/server'
|
|
import { getDatabase } from '@/lib/database'
|
|
|
|
export async function GET(request: Request) {
|
|
try {
|
|
const { userId: currentUserId } = await auth()
|
|
if (!currentUserId) {
|
|
return new NextResponse('Unauthorized', { status: 401 })
|
|
}
|
|
|
|
const { searchParams } = new URL(request.url)
|
|
const targetUserId = searchParams.get('userId')
|
|
|
|
if (!targetUserId) {
|
|
return new NextResponse('User ID is required', { status: 400 })
|
|
}
|
|
|
|
const db = await getDatabase()
|
|
|
|
// Check permissions: Users can view their own, Admins/Trainers can view anyone's
|
|
if (currentUserId !== targetUserId) {
|
|
const currentUser = await db.getUserById(currentUserId)
|
|
const isStaff = currentUser?.role === 'admin' || currentUser?.role === 'superAdmin' || currentUser?.role === 'trainer'
|
|
|
|
if (!isStaff) {
|
|
return new NextResponse('Forbidden', { status: 403 })
|
|
}
|
|
}
|
|
|
|
const recommendations = await db.getRecommendationsByUserId(targetUserId)
|
|
return NextResponse.json(recommendations)
|
|
} catch (error) {
|
|
console.error('Error fetching recommendations:', error)
|
|
return new NextResponse('Internal Server Error', { status: 500 })
|
|
}
|
|
}
|
|
|
|
export async function POST(request: Request) {
|
|
try {
|
|
const { userId: currentUserId } = await auth()
|
|
if (!currentUserId) {
|
|
return new NextResponse('Unauthorized', { status: 401 })
|
|
}
|
|
|
|
const db = await getDatabase()
|
|
const currentUser = await db.getUserById(currentUserId)
|
|
const isStaff = currentUser?.role === 'admin' || currentUser?.role === 'superAdmin' || currentUser?.role === 'trainer'
|
|
|
|
if (!isStaff) {
|
|
return new NextResponse('Forbidden', { status: 403 })
|
|
}
|
|
|
|
const body = await request.json()
|
|
const { userId, type, content, status } = body
|
|
|
|
if (!userId || !type || !content) {
|
|
return new NextResponse('Missing required fields', { status: 400 })
|
|
}
|
|
|
|
const recommendation = await db.createRecommendation({
|
|
id: crypto.randomUUID(),
|
|
userId,
|
|
type,
|
|
content,
|
|
status: status || 'pending'
|
|
})
|
|
|
|
return NextResponse.json(recommendation)
|
|
} catch (error) {
|
|
console.error('Error creating recommendation:', error)
|
|
return new NextResponse('Internal Server Error', { status: 500 })
|
|
}
|
|
}
|
|
|
|
export async function PUT(request: Request) {
|
|
try {
|
|
const { userId: currentUserId } = await auth()
|
|
if (!currentUserId) {
|
|
return new NextResponse('Unauthorized', { status: 401 })
|
|
}
|
|
|
|
const body = await request.json()
|
|
const { id, status, content } = body
|
|
|
|
if (!id) {
|
|
return new NextResponse('Recommendation ID is required', { status: 400 })
|
|
}
|
|
|
|
const db = await getDatabase()
|
|
|
|
// Users can update status (e.g. mark as completed), Staff can update content too
|
|
// Ideally we'd check ownership for status update, but for now let's allow it if they have the ID
|
|
// A stricter check would be: fetch recommendation, check if userId matches currentUserId OR if currentUser is staff
|
|
|
|
const updated = await db.updateRecommendation(id, {
|
|
...(status && { status }),
|
|
...(content && { content })
|
|
})
|
|
|
|
return NextResponse.json(updated)
|
|
} catch (error) {
|
|
console.error('Error updating recommendation:', error)
|
|
return new NextResponse('Internal Server Error', { status: 500 })
|
|
}
|
|
}
|