website-secure/app/api/users/route.ts

import { NextResponse } from "next/server";
import { getDb } from "@/lib/db";
import bcrypt from "bcryptjs";

export async function GET() {
  try {
    const sql = getDb();
    const rows = await sql(
      `SELECT u.id, u.email, u.name, u.role, u.is_active, u.created_at,
              up.can_view_financial, up.can_edit, up.can_create, up.can_delete, up.can_download,
              up.can_view_dashboard, up.can_view_components, up.can_view_products, up.can_view_customers,
              up.can_view_suppliers, up.can_view_production, up.can_view_stock_history, up.can_view_logistics,
              up.can_view_stock_take, up.can_view_settings
       FROM users u
       LEFT JOIN user_permissions up ON u.id = up.user_id
       ORDER BY u.created_at DESC`
    );
    
    // Transform rows to include permissions object with sections array
    const users = rows.map((row: Record<string, unknown>) => {
      const sections: string[] = [];
      if (row.can_view_dashboard) sections.push("dashboard");
      if (row.can_view_components) sections.push("components");
      if (row.can_view_products) sections.push("products");
      if (row.can_view_customers) sections.push("customers");
      if (row.can_view_suppliers) sections.push("suppliers");
      if (row.can_view_production) sections.push("production");
      if (row.can_view_stock_history) sections.push("stock-history");
      if (row.can_view_logistics) sections.push("logistics");
      if (row.can_view_stock_take) sections.push("stock-take");
      if (row.can_view_settings) sections.push("settings");
      
      return {
        id: row.id,
        email: row.email,
        name: row.name,
        role: row.role,
        is_active: row.is_active,
        created_at: row.created_at,
        permissions: {
          sections,
          can_view_financial: row.can_view_financial ?? false,
          can_edit: row.can_edit ?? false,
          can_create: row.can_create ?? false,
          can_delete: row.can_delete ?? false,
          can_download: row.can_download ?? false,
        },
      };
    });
    
    return NextResponse.json(users);
  } catch (error) {
    console.error("GET users error:", error);
    return NextResponse.json({ error: "Failed to fetch users" }, { status: 500 });
  }
}

export async function POST(request: Request) {
  try {
    const sql = getDb();
    const body = await request.json();
    const { email, name, password, role, permissions } = body;

    if (!email || !name || !password) {
      return NextResponse.json(
        { error: "Email, name, and password are required" },
        { status: 400 }
      );
    }

    // Check if email exists
    const existing = await sql(`SELECT id FROM users WHERE email = $1`, [
      email.toLowerCase(),
    ]);
    if (existing.length > 0) {
      return NextResponse.json(
        { error: "Email already exists" },
        { status: 400 }
      );
    }

    // Hash password
    const passwordHash = await bcrypt.hash(password, 10);

    // Create user
    const users = await sql(
      `INSERT INTO users (email, name, password_hash, role) 
       VALUES ($1, $2, $3, $4) 
       RETURNING id, email, name, role, is_active, created_at`,
      [email.toLowerCase(), name, passwordHash, role || "user"]
    );

    const user = users[0];

    // Create permissions - convert sections array to individual flags
    const sections: string[] = permissions?.sections || [];
    await sql(
      `INSERT INTO user_permissions (
        user_id, can_view_financial, can_edit, can_create, can_delete, can_download,
        can_view_dashboard, can_view_components, can_view_products, can_view_customers,
        can_view_suppliers, can_view_production, can_view_stock_history, can_view_logistics,
        can_view_stock_take, can_view_settings
      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)`,
      [
        user.id,
        permissions?.can_view_financial ?? false,
        permissions?.can_edit ?? false,
        permissions?.can_create ?? false,
        permissions?.can_delete ?? false,
        permissions?.can_download ?? false,
        sections.includes("dashboard"),
        sections.includes("components"),
        sections.includes("products"),
        sections.includes("customers"),
        sections.includes("suppliers"),
        sections.includes("production"),
        sections.includes("stock-history"),
        sections.includes("logistics"),
        sections.includes("stock-take"),
        sections.includes("settings") || role === "admin",
      ]
    );

    return NextResponse.json({
      ...user,
      permissions: permissions || {
        can_view_financial: false,
        can_edit: false,
        can_create: false,
        can_delete: false,
        can_download: false,
      },
    });
  } catch (error) {
    console.error("POST user error:", error);
    return NextResponse.json({ error: "Failed to create user" }, { status: 500 });
  }
}