website-secure/app/api/users/[id]/route.ts

import { NextResponse } from "next/server";
import { getDb } from "@/lib/db";
import bcrypt from "bcryptjs";

export async function PUT(
  request: Request,
  { params }: { params: Promise<{ id: string }> }
) {
  try {
    const sql = getDb();
    const { id } = await params;
    const body = await request.json();
    const { email, name, role, is_active, permissions, password, new_password } = body;
    const passwordToUpdate = password || new_password;

    // Update user
    await sql(
      `UPDATE users SET email = $1, name = $2, role = $3, is_active = $4, updated_at = NOW()
       WHERE id = $5`,
      [email?.toLowerCase(), name, role || "user", is_active ?? true, Number(id)]
    );

    // Update password if provided
    if (passwordToUpdate) {
      const passwordHash = await bcrypt.hash(passwordToUpdate, 10);
      await sql(`UPDATE users SET password_hash = $1 WHERE id = $2`, [
        passwordHash,
        Number(id),
      ]);
    }

    // Upsert permissions - convert sections array to individual flags
    if (permissions) {
      const sections: string[] = permissions.sections || [];
      
      // First check if user_permissions record exists
      const existingPerms = await sql(
        `SELECT id FROM user_permissions WHERE user_id = $1`,
        [Number(id)]
      );
      
      if (existingPerms.length === 0) {
        // Insert new permissions record
        await sql(
          `INSERT INTO user_permissions (
            user_id, can_view_financial, can_edit, can_create, can_delete, can_download,
            can_view_dashboard, can_view_components, can_view_products, can_view_customers,
            can_view_suppliers, can_view_production, can_view_stock_history, can_view_logistics,
            can_view_stock_take, can_view_settings
          ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)`,
          [
            Number(id),
            permissions.can_view_financial ?? false,
            permissions.can_edit ?? false,
            permissions.can_create ?? false,
            permissions.can_delete ?? false,
            permissions.can_download ?? false,
            sections.includes("dashboard"),
            sections.includes("components"),
            sections.includes("products"),
            sections.includes("customers"),
            sections.includes("suppliers"),
            sections.includes("production"),
            sections.includes("stock-history"),
            sections.includes("logistics"),
            sections.includes("stock-take"),
            sections.includes("settings") || role === "admin",
          ]
        );
      } else {
        // Update existing permissions record
        await sql(
          `UPDATE user_permissions 
           SET can_view_financial = $1, can_edit = $2, can_create = $3, can_delete = $4, can_download = $5,
               can_view_dashboard = $6, can_view_components = $7, can_view_products = $8, can_view_customers = $9,
               can_view_suppliers = $10, can_view_production = $11, can_view_stock_history = $12, can_view_logistics = $13,
               can_view_stock_take = $14, can_view_settings = $15, updated_at = NOW()
           WHERE user_id = $16`,
          [
            permissions.can_view_financial ?? false,
            permissions.can_edit ?? false,
            permissions.can_create ?? false,
            permissions.can_delete ?? false,
            permissions.can_download ?? false,
            sections.includes("dashboard"),
            sections.includes("components"),
            sections.includes("products"),
            sections.includes("customers"),
            sections.includes("suppliers"),
            sections.includes("production"),
            sections.includes("stock-history"),
            sections.includes("logistics"),
            sections.includes("stock-take"),
            sections.includes("settings") || role === "admin",
            Number(id),
          ]
        );
      }
    }

    // Fetch updated user
    const users = await sql(
      `SELECT u.id, u.email, u.name, u.role, u.is_active, u.created_at,
              up.can_view_financial, up.can_edit, up.can_create, up.can_delete, up.can_download,
              up.can_view_dashboard, up.can_view_components, up.can_view_products, up.can_view_customers,
              up.can_view_suppliers, up.can_view_production, up.can_view_stock_history, up.can_view_logistics,
              up.can_view_stock_take, up.can_view_settings
       FROM users u
       LEFT JOIN user_permissions up ON u.id = up.user_id
       WHERE u.id = $1`,
      [Number(id)]
    );

    return NextResponse.json(users[0]);
  } catch (error) {
    console.error("PUT user error:", error);
    return NextResponse.json({ error: "Failed to update user" }, { status: 500 });
  }
}

export async function DELETE(
  request: Request,
  { params }: { params: Promise<{ id: string }> }
) {
  try {
    const sql = getDb();
    const { id } = await params;

    // Delete sessions first
    await sql(`DELETE FROM sessions WHERE user_id = $1`, [Number(id)]);
    
    // Delete permissions
    await sql(`DELETE FROM user_permissions WHERE user_id = $1`, [Number(id)]);
    
    // Delete user
    await sql(`DELETE FROM users WHERE id = $1`, [Number(id)]);

    return NextResponse.json({ success: true });
  } catch (error) {
    console.error("DELETE user error:", error);
    return NextResponse.json({ error: "Failed to delete user" }, { status: 500 });
  }
}