Initial commit: Lageplan v1.0 - Next.js 15.5, React 19

2026-02-21 11:57:44 +01:00
commit adf3dc8c1d
167 changed files with 34265 additions and 0 deletions
--- a/src/app/api/admin/users/route.ts
+++ b/src/app/api/admin/users/route.ts
@@ -0,0 +1,101 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { prisma } from '@/lib/db'
+import { getSession, hashPassword, isAdmin } from '@/lib/auth'
+import { z } from 'zod'
+
+const createUserSchema = z.object({
+  email: z.string().email(),
+  name: z.string().min(1).max(100),
+  password: z.string().min(6),
+  role: z.enum(['SERVER_ADMIN', 'TENANT_ADMIN', 'OPERATOR', 'VIEWER']),
+  tenantId: z.string().optional(),
+})
+
+export async function GET() {
+  try {
+    const user = await getSession()
+    if (!user || !isAdmin(user.role)) {
+      return NextResponse.json({ error: 'Nicht autorisiert' }, { status: 403 })
+    }
+
+    const where = user.role === 'SERVER_ADMIN' ? {} : {
+      memberships: { some: { tenantId: user.tenantId } },
+    }
+
+    const users = await (prisma as any).user.findMany({
+      where,
+      orderBy: { createdAt: 'desc' },
+      select: {
+        id: true,
+        email: true,
+        name: true,
+        role: true,
+        emailVerified: true,
+        createdAt: true,
+        updatedAt: true,
+        memberships: {
+          include: { tenant: { select: { id: true, name: true, slug: true } } },
+        },
+        _count: { select: { projects: true } },
+      },
+    })
+    return NextResponse.json({ users })
+  } catch (error) {
+    console.error('Error fetching users:', error)
+    return NextResponse.json({ error: 'Interner Fehler' }, { status: 500 })
+  }
+}
+
+export async function POST(req: NextRequest) {
+  try {
+    const session = await getSession()
+    if (!session || !isAdmin(session.role)) {
+      return NextResponse.json({ error: 'Nicht autorisiert' }, { status: 403 })
+    }
+
+    const body = await req.json()
+    const data = createUserSchema.parse(body)
+
+    // Only SERVER_ADMIN can create SERVER_ADMIN users
+    if (data.role === 'SERVER_ADMIN' && session.role !== 'SERVER_ADMIN') {
+      return NextResponse.json({ error: 'Keine Berechtigung' }, { status: 403 })
+    }
+
+    const existing = await (prisma as any).user.findUnique({ where: { email: data.email } })
+    if (existing) {
+      return NextResponse.json({ error: 'E-Mail bereits vergeben' }, { status: 400 })
+    }
+
+    const hashedPassword = await hashPassword(data.password)
+    const tenantId = data.tenantId || session.tenantId
+
+    const user = await (prisma as any).user.create({
+      data: {
+        email: data.email,
+        name: data.name,
+        password: hashedPassword,
+        role: data.role as any,
+        ...(tenantId && data.role !== 'SERVER_ADMIN' ? {
+          memberships: {
+            create: { tenantId, role: data.role as any },
+          },
+        } : {}),
+      },
+      select: {
+        id: true,
+        email: true,
+        name: true,
+        role: true,
+        createdAt: true,
+      },
+    })
+
+    return NextResponse.json({ user }, { status: 201 })
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Ungültige Daten' }, { status: 400 })
+    }
+    console.error('Error creating user:', error)
+    return NextResponse.json({ error: 'Interner Fehler' }, { status: 500 })
+  }
+}