Add Social Events tab with reservations

src/app/api/social_event_reservations/route.ts

@@ -0,0 +1,63 @@
+import { db } from '@/lib/db';
+import { NextResponse } from 'next/server';
+import { requireAuth, requireRole } from '@/lib/auth';
+
+export async function GET(request: Request) {
+  try {
+    const session = await requireAuth();
+    const { searchParams } = new URL(request.url);
+    const socialEventId = searchParams.get('social_event_id');
+
+    let query = `
+      SELECT ser.*, u.username, u.first_name, u.last_name, se.name as event_name
+      FROM social_event_reservations ser
+      JOIN users u ON u.id = ser.user_id
+      JOIN social_events se ON se.id = ser.social_event_id
+    `;
+    const params: (number | string)[] = [];
+
+    if (session.role === 'admin') {
+      if (socialEventId) {
+        query += ' WHERE ser.social_event_id = $1';
+        params.push(parseInt(socialEventId, 10));
+      }
+    } else {
+      query += ' WHERE ser.user_id = $1';
+      params.push(session.id);
+      if (socialEventId) {
+        query += ' AND ser.social_event_id = $2';
+        params.push(parseInt(socialEventId, 10));
+      }
+    }
+
+    query += ' ORDER BY ser.created_at DESC';
+    const { rows } = await db.query(query, params);
+    return NextResponse.json({ data: rows });
+  } catch (error: any) {
+    console.error('GET /api/social_event_reservations error:', error);
+    return NextResponse.json({ error: error.message || 'Unauthorized' }, { status: 401 });
+  }
+}
+
+export async function POST(request: Request) {
+  try {
+    const session = await requireAuth();
+    const body = await request.json();
+    const { social_event_id, guests, notes } = body;
+    if (!social_event_id || !guests) {
+      return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });
+    }
+    const { rows } = await db.query(
+      `INSERT INTO social_event_reservations (user_id, social_event_id, guests, notes)
+       VALUES ($1, $2, $3, $4)
+       ON CONFLICT (user_id, social_event_id)
+       DO UPDATE SET guests = EXCLUDED.guests, notes = EXCLUDED.notes, status = 'pending'
+       RETURNING *`,
+      [session.id, parseInt(social_event_id, 10), parseInt(guests, 10), notes || '']
+    );
+    return NextResponse.json({ data: rows[0] });
+  } catch (error: any) {
+    console.error('POST /api/social_event_reservations error:', error);
+    return NextResponse.json({ error: error.message || 'Unauthorized' }, { status: 401 });
+  }
+}