chore: upload parte 1 - logica

app/api/auth/login/route.ts

@@ -0,0 +1,105 @@
+import { NextResponse } from "next/server";
+import { getDb } from "@/lib/db";
+import bcrypt from "bcryptjs";
+import { cookies } from "next/headers";
+import { randomUUID } from "crypto";
+
+export async function POST(request: Request) {
+  try {
+    const sql = getDb();
+    const { email, password } = await request.json();
+
+    if (!email || !password) {
+      return NextResponse.json(
+        { error: "Email and password are required" },
+        { status: 400 }
+      );
+    }
+
+    // Find user
+    const users = await sql(
+      `SELECT u.*, 
+              up.can_view_financial, up.can_edit, up.can_create, up.can_delete, up.can_download,
+              up.can_view_dashboard, up.can_view_components, up.can_view_products, up.can_view_customers,
+              up.can_view_suppliers, up.can_view_production, up.can_view_stock_history, up.can_view_logistics,
+              up.can_view_stock_take, up.can_view_settings
+       FROM users u
+       LEFT JOIN user_permissions up ON u.id = up.user_id
+       WHERE u.email = $1 AND u.is_active = true`,
+      [email.toLowerCase()]
+    );
+
+    if (users.length === 0) {
+      return NextResponse.json(
+        { error: "Invalid email or password" },
+        { status: 401 }
+      );
+    }
+
+    const user = users[0];
+
+    // Verify password
+    const isValid = await bcrypt.compare(password, user.password_hash);
+    if (!isValid) {
+      return NextResponse.json(
+        { error: "Invalid email or password" },
+        { status: 401 }
+      );
+    }
+
+    // Create session
+    const sessionToken = randomUUID();
+    const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000); // 7 days
+
+    await sql(
+      `INSERT INTO sessions (user_id, token, expires_at) VALUES ($1, $2, $3)`,
+      [user.id, sessionToken, expiresAt.toISOString()]
+    );
+
+    // Set cookie
+    const cookieStore = await cookies();
+    cookieStore.set("session_token", sessionToken, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      expires: expiresAt,
+      path: "/",
+    });
+
+    // Build sections array from individual flags
+    const sections: string[] = [];
+    if (user.can_view_dashboard) sections.push("dashboard");
+    if (user.can_view_components) sections.push("components");
+    if (user.can_view_products) sections.push("products");
+    if (user.can_view_customers) sections.push("customers");
+    if (user.can_view_suppliers) sections.push("suppliers");
+    if (user.can_view_production) sections.push("production");
+    if (user.can_view_stock_history) sections.push("stock-history");
+    if (user.can_view_logistics) sections.push("logistics");
+    if (user.can_view_stock_take) sections.push("stock-take");
+    if (user.can_view_settings || user.role === "admin") sections.push("settings");
+
+    return NextResponse.json({
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        role: user.role,
+        permissions: {
+          sections,
+          can_view_financial: user.can_view_financial ?? false,
+          can_edit: user.can_edit ?? false,
+          can_create: user.can_create ?? false,
+          can_delete: user.can_delete ?? false,
+          can_download: user.can_download ?? false,
+        },
+      },
+    });
+  } catch (error) {
+    console.error("Login error:", error);
+    return NextResponse.json(
+      { error: "Internal server error" },
+      { status: 500 }
+    );
+  }
+}

app/api/auth/logout/route.ts

@@ -0,0 +1,25 @@
+import { NextResponse } from "next/server";
+import { getDb } from "@/lib/db";
+import { cookies } from "next/headers";
+
+export async function POST() {
+  try {
+    const sql = getDb();
+    const cookieStore = await cookies();
+    const sessionToken = cookieStore.get("session_token")?.value;
+
+    if (sessionToken) {
+      await sql(`DELETE FROM sessions WHERE token = $1`, [sessionToken]);
+    }
+
+    cookieStore.delete("session_token");
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error("Logout error:", error);
+    return NextResponse.json(
+      { error: "Failed to logout" },
+      { status: 500 }
+    );
+  }
+}

app/api/auth/session/route.ts

@@ -0,0 +1,70 @@
+import { NextResponse } from "next/server";
+import { getDb } from "@/lib/db";
+import { cookies } from "next/headers";
+
+export async function GET() {
+  try {
+    const sql = getDb();
+    const cookieStore = await cookies();
+    const sessionToken = cookieStore.get("session_token")?.value;
+
+    if (!sessionToken) {
+      return NextResponse.json({ user: null });
+    }
+
+    // Find session and user
+    const sessions = await sql(
+      `SELECT s.*, u.id as user_id, u.email, u.name, u.role, u.is_active,
+              up.can_view_financial, up.can_edit, up.can_create, up.can_delete, up.can_download,
+              up.can_view_dashboard, up.can_view_components, up.can_view_products, up.can_view_customers,
+              up.can_view_suppliers, up.can_view_production, up.can_view_stock_history, up.can_view_logistics,
+              up.can_view_stock_take, up.can_view_settings
+       FROM sessions s
+       JOIN users u ON s.user_id = u.id
+       LEFT JOIN user_permissions up ON u.id = up.user_id
+       WHERE s.token = $1 AND s.expires_at > NOW()`,
+      [sessionToken]
+    );
+
+    if (sessions.length === 0 || !sessions[0].is_active) {
+      // Clear invalid session cookie
+      cookieStore.delete("session_token");
+      return NextResponse.json({ user: null });
+    }
+
+    const session = sessions[0];
+
+    // Build sections array from individual flags
+    const sections: string[] = [];
+    if (session.can_view_dashboard) sections.push("dashboard");
+    if (session.can_view_components) sections.push("components");
+    if (session.can_view_products) sections.push("products");
+    if (session.can_view_customers) sections.push("customers");
+    if (session.can_view_suppliers) sections.push("suppliers");
+    if (session.can_view_production) sections.push("production");
+    if (session.can_view_stock_history) sections.push("stock-history");
+    if (session.can_view_logistics) sections.push("logistics");
+    if (session.can_view_stock_take) sections.push("stock-take");
+    if (session.can_view_settings || session.role === "admin") sections.push("settings");
+
+    return NextResponse.json({
+      user: {
+        id: session.user_id,
+        email: session.email,
+        name: session.name,
+        role: session.role,
+        permissions: {
+          sections,
+          can_view_financial: session.can_view_financial ?? false,
+          can_edit: session.can_edit ?? false,
+          can_create: session.can_create ?? false,
+          can_delete: session.can_delete ?? false,
+          can_download: session.can_download ?? false,
+        },
+      },
+    });
+  } catch (error) {
+    console.error("Session error:", error);
+    return NextResponse.json({ user: null });
+  }
+}