Add rooms, menu, places, reviews APIs and site config bulk endpoint

2026-06-27 18:06:31 -05:00
parent 3294471a94
commit 4bb3596412
13 changed files with 454 additions and 2 deletions
@@ -0,0 +1,38 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireRole } from '@/lib/auth';
+import { db } from '@/lib/db';
+
+export async function PUT(request: NextRequest, { params }: { params: { id: string } }) {
+  try {
+    await requireRole('admin');
+    const id = parseInt(params.id, 10);
+    const body = await request.json();
+    const { approved } = body;
+
+    const { rows } = await db.query(
+      'UPDATE reviews SET approved = $1 WHERE id = $2 RETURNING *',
+      [approved, id]
+    );
+
+    if (rows.length === 0) {
+      return NextResponse.json({ error: 'Review not found' }, { status: 404 });
+    }
+
+    return NextResponse.json({ data: rows[0] });
+  } catch (error: any) {
+    console.error('PUT /api/admin/reviews/:id error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to update review' }, { status: 500 });
+  }
+}
+
+export async function DELETE(request: NextRequest, { params }: { params: { id: string } }) {
+  try {
+    await requireRole('admin');
+    const id = parseInt(params.id, 10);
+    await db.query('DELETE FROM reviews WHERE id = $1', [id]);
+    return NextResponse.json({ ok: true });
+  } catch (error: any) {
+    console.error('DELETE /api/admin/reviews/:id error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to delete review' }, { status: 500 });
+  }
+}
@@ -0,0 +1,14 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireRole } from '@/lib/auth';
+import { db } from '@/lib/db';
+
+export async function GET() {
+  try {
+    await requireRole('admin');
+    const { rows } = await db.query('SELECT * FROM reviews ORDER BY created_at DESC');
+    return NextResponse.json({ data: rows });
+  } catch (error: any) {
+    console.error('GET /api/admin/reviews error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to fetch reviews' }, { status: 500 });
+  }
+}
@@ -0,0 +1,63 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireRole } from '@/lib/auth';
+import { db } from '@/lib/db';
+import bcrypt from 'bcryptjs';
+
+export async function PUT(request: NextRequest, { params }: { params: { id: string } }) {
+  try {
+    await requireRole('admin');
+    const id = parseInt(params.id, 10);
+    const body = await request.json();
+    const { username, password, role } = body;
+
+    if (role && role !== 'admin' && role !== 'user') {
+      return NextResponse.json({ error: 'Role must be admin or user' }, { status: 400 });
+    }
+
+    const updates: string[] = [];
+    const values: any[] = [];
+    let idx = 1;
+
+    if (username) {
+      updates.push(`username = $${idx++}`);
+      values.push(username);
+    }
+    if (role) {
+      updates.push(`role = $${idx++}`);
+      values.push(role);
+    }
+    if (password) {
+      updates.push(`password_hash = $${idx++}`);
+      values.push(bcrypt.hashSync(password, 10));
+    }
+
+    if (updates.length === 0) {
+      return NextResponse.json({ error: 'No fields to update' }, { status: 400 });
+    }
+
+    values.push(id);
+    const { rows } = await db.query(
+      `UPDATE users SET ${updates.join(', ')} WHERE id = $${idx} RETURNING id, username, role`,
+      values
+    );
+
+    if (rows.length === 0) {
+      return NextResponse.json({ error: 'User not found' }, { status: 404 });
+    }
+
+    return NextResponse.json({ data: rows[0] });
+  } catch (err: any) {
+    return NextResponse.json({ error: err.message || 'Failed to update user' }, { status: 500 });
+  }
+}
+
+export async function DELETE(request: NextRequest, { params }: { params: { id: string } }) {
+  try {
+    await requireRole('admin');
+    const id = parseInt(params.id, 10);
+    await db.query('DELETE FROM users WHERE id = $1', [id]);
+    return NextResponse.json({ ok: true });
+  } catch (err: any) {
+    return NextResponse.json({ error: err.message || 'Failed to delete user' }, { status: 500 });
+  }
+}
@@ -1,5 +1,16 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { requireRole, createUser } from '@/lib/auth';
+import { db } from '@/lib/db';
+
+export async function GET() {
+  try {
+    await requireRole('admin');
+    const { rows } = await db.query('SELECT id, username, role, created_at FROM users ORDER BY created_at DESC');
+    return NextResponse.json({ data: rows });
+  } catch (err: any) {
+    return NextResponse.json({ error: err.message || 'Failed to fetch users' }, { status: err.message === 'Unauthorized' ? 401 : 500 });
+  }
+}

 export async function POST(request: NextRequest) {
  try {
@@ -0,0 +1,39 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireRole } from '@/lib/auth';
+import { db } from '@/lib/db';
+
+export async function PUT(request: NextRequest, { params }: { params: { id: string } }) {
+  try {
+    await requireRole('admin');
+    const id = parseInt(params.id, 10);
+    const body = await request.json();
+    const { category, name, description, price, is_daily_special, active, sort_order } = body;
+
+    const { rows } = await db.query(
+      `UPDATE menu_items SET category = $1, name = $2, description = $3, price = $4, is_daily_special = $5, active = $6, sort_order = $7
+       WHERE id = $8 RETURNING *`,
+      [category, name, description || '', price, is_daily_special, active, sort_order || 0, id]
+    );
+
+    if (rows.length === 0) {
+      return NextResponse.json({ error: 'Menu item not found' }, { status: 404 });
+    }
+
+    return NextResponse.json({ data: rows[0] });
+  } catch (error: any) {
+    console.error('PUT /api/menu/:id error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to update menu item' }, { status: 500 });
+  }
+}
+
+export async function DELETE(request: NextRequest, { params }: { params: { id: string } }) {
+  try {
+    await requireRole('admin');
+    const id = parseInt(params.id, 10);
+    await db.query('DELETE FROM menu_items WHERE id = $1', [id]);
+    return NextResponse.json({ ok: true });
+  } catch (error: any) {
+    console.error('DELETE /api/menu/:id error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to delete menu item' }, { status: 500 });
+  }
+}
@@ -0,0 +1,39 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireRole } from '@/lib/auth';
+import { db } from '@/lib/db';
+
+export async function GET() {
+  try {
+    const { rows } = await db.query(
+      'SELECT * FROM menu_items WHERE active = TRUE ORDER BY category, sort_order, id'
+    );
+    return NextResponse.json({ data: rows });
+  } catch (error: any) {
+    console.error('GET /api/menu error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to fetch menu' }, { status: 500 });
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    await requireRole('admin');
+    const body = await request.json();
+    const { category, name, description, price, is_daily_special, sort_order } = body;
+
+    if (!category || !name || price === undefined) {
+      return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });
+    }
+
+    const { rows } = await db.query(
+      `INSERT INTO menu_items (category, name, description, price, is_daily_special, sort_order)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       RETURNING *`,
+      [category, name, description || '', price, is_daily_special || false, sort_order || 0]
+    );
+
+    return NextResponse.json({ data: rows[0] });
+  } catch (error: any) {
+    console.error('POST /api/menu error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to create menu item' }, { status: 500 });
+  }
+}
@@ -0,0 +1,39 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireRole } from '@/lib/auth';
+import { db } from '@/lib/db';
+
+export async function PUT(request: NextRequest, { params }: { params: { id: string } }) {
+  try {
+    await requireRole('admin');
+    const id = parseInt(params.id, 10);
+    const body = await request.json();
+    const { name, description, photo, distance_km, visit_time, suggestion, active, sort_order } = body;
+
+    const { rows } = await db.query(
+      `UPDATE places SET name = $1, description = $2, photo = $3, distance_km = $4, visit_time = $5, suggestion = $6, active = $7, sort_order = $8
+       WHERE id = $9 RETURNING *`,
+      [name, description, photo || null, distance_km || null, visit_time || null, suggestion || null, active, sort_order || 0, id]
+    );
+
+    if (rows.length === 0) {
+      return NextResponse.json({ error: 'Place not found' }, { status: 404 });
+    }
+
+    return NextResponse.json({ data: rows[0] });
+  } catch (error: any) {
+    console.error('PUT /api/places/:id error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to update place' }, { status: 500 });
+  }
+}
+
+export async function DELETE(request: NextRequest, { params }: { params: { id: string } }) {
+  try {
+    await requireRole('admin');
+    const id = parseInt(params.id, 10);
+    await db.query('DELETE FROM places WHERE id = $1', [id]);
+    return NextResponse.json({ ok: true });
+  } catch (error: any) {
+    console.error('DELETE /api/places/:id error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to delete place' }, { status: 500 });
+  }
+}
@@ -0,0 +1,37 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireRole } from '@/lib/auth';
+import { db } from '@/lib/db';
+
+export async function GET() {
+  try {
+    const { rows } = await db.query('SELECT * FROM places WHERE active = TRUE ORDER BY sort_order, id');
+    return NextResponse.json({ data: rows });
+  } catch (error: any) {
+    console.error('GET /api/places error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to fetch places' }, { status: 500 });
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    await requireRole('admin');
+    const body = await request.json();
+    const { name, description, photo, distance_km, visit_time, suggestion, sort_order } = body;
+
+    if (!name || !description) {
+      return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });
+    }
+
+    const { rows } = await db.query(
+      `INSERT INTO places (name, description, photo, distance_km, visit_time, suggestion, sort_order)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       RETURNING *`,
+      [name, description, photo || null, distance_km || null, visit_time || null, suggestion || null, sort_order || 0]
+    );
+
+    return NextResponse.json({ data: rows[0] });
+  } catch (error: any) {
+    console.error('POST /api/places error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to create place' }, { status: 500 });
+  }
+}
@@ -0,0 +1,37 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+
+export async function GET() {
+  try {
+    const { rows } = await db.query(
+      'SELECT * FROM reviews WHERE approved = TRUE ORDER BY created_at DESC'
+    );
+    return NextResponse.json({ data: rows });
+  } catch (error: any) {
+    console.error('GET /api/reviews error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to fetch reviews' }, { status: 500 });
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json();
+    const { author_name, rating, text } = body;
+
+    if (!author_name || !rating || !text) {
+      return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });
+    }
+
+    const { rows } = await db.query(
+      `INSERT INTO reviews (author_name, rating, text, approved)
+       VALUES ($1, $2, $3, FALSE)
+       RETURNING *`,
+      [author_name, rating, text]
+    );
+
+    return NextResponse.json({ data: rows[0] });
+  } catch (error: any) {
+    console.error('POST /api/reviews error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to submit review' }, { status: 500 });
+  }
+}
@@ -0,0 +1,39 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireRole } from '@/lib/auth';
+import { db } from '@/lib/db';
+
+export async function PUT(request: NextRequest, { params }: { params: { id: string } }) {
+  try {
+    await requireRole('admin');
+    const id = parseInt(params.id, 10);
+    const body = await request.json();
+    const { name, description, price, photos, active, sort_order } = body;
+
+    const { rows } = await db.query(
+      `UPDATE rooms SET name = $1, description = $2, price = $3, photos = $4, active = $5, sort_order = $6, updated_at = NOW()
+       WHERE id = $7 RETURNING *`,
+      [name, description, price, photos || [], active, sort_order || 0, id]
+    );
+
+    if (rows.length === 0) {
+      return NextResponse.json({ error: 'Room not found' }, { status: 404 });
+    }
+
+    return NextResponse.json({ data: rows[0] });
+  } catch (error: any) {
+    console.error('PUT /api/rooms/:id error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to update room' }, { status: 500 });
+  }
+}
+
+export async function DELETE(request: NextRequest, { params }: { params: { id: string } }) {
+  try {
+    await requireRole('admin');
+    const id = parseInt(params.id, 10);
+    await db.query('DELETE FROM rooms WHERE id = $1', [id]);
+    return NextResponse.json({ ok: true });
+  } catch (error: any) {
+    console.error('DELETE /api/rooms/:id error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to delete room' }, { status: 500 });
+  }
+}
@@ -0,0 +1,37 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireRole } from '@/lib/auth';
+import { db } from '@/lib/db';
+
+export async function GET() {
+  try {
+    const { rows } = await db.query('SELECT * FROM rooms WHERE active = TRUE ORDER BY sort_order, id');
+    return NextResponse.json({ data: rows });
+  } catch (error: any) {
+    console.error('GET /api/rooms error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to fetch rooms' }, { status: 500 });
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    await requireRole('admin');
+    const body = await request.json();
+    const { name, description, price, photos, sort_order } = body;
+
+    if (!name || !description || price === undefined) {
+      return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });
+    }
+
+    const { rows } = await db.query(
+      `INSERT INTO rooms (name, description, price, photos, sort_order)
+       VALUES ($1, $2, $3, $4, $5)
+       RETURNING *`,
+      [name, description, price, photos || [], sort_order || 0]
+    );
+
+    return NextResponse.json({ data: rows[0] });
+  } catch (error: any) {
+    console.error('POST /api/rooms error:', error);
+    return NextResponse.json({ error: error.message || 'Failed to create room' }, { status: 500 });
+  }
+}
@@ -5,7 +5,12 @@ import { db } from '@/lib/db';
 export async function GET(request: NextRequest) {
  const key = request.nextUrl.searchParams.get('key');
  if (!key) {
-    return NextResponse.json({ error: 'Missing key' }, { status: 400 });
+    const { rows } = await db.query(
+      `SELECT key, value FROM config WHERE key IN ('logo','facebook_url','instagram_url','whatsapp_url','address','phone','email','wifi_password')`
+    );
+    const config: Record<string, string> = {};
+    rows.forEach((r: any) => config[r.key] = r.value);
+    return NextResponse.json({ data: config });
  }

  const { rows } = await db.query('SELECT value FROM config WHERE key = $1', [key]);