Add database integration, auth API, admin/user portals, and deploy-db.sh

src/app/api/admin/images/route.ts

@@ -0,0 +1,63 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { requireRole } from '@/lib/auth';
+import { db } from '@/lib/db';
+
+export async function GET() {
+  try {
+    await requireRole('admin');
+    const { rows } = await db.query('SELECT id, filename, uploaded_at FROM images ORDER BY uploaded_at DESC');
+    return NextResponse.json({ images: rows, count: rows.length });
+  } catch (error) {
+    if ((error as Error).message === 'Unauthorized') {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+    console.error('List images error:', error);
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    await requireRole('admin');
+    const body = await request.json();
+    const { filename, data } = body;
+
+    if (!filename || !data) {
+      return NextResponse.json({ error: 'Missing filename or data' }, { status: 400 });
+    }
+
+    const { rows } = await db.query(
+      'INSERT INTO images (filename, data) VALUES ($1, $2) RETURNING id, filename, uploaded_at',
+      [filename, data]
+    );
+
+    return NextResponse.json({ image: rows[0] });
+  } catch (error) {
+    if ((error as Error).message === 'Unauthorized') {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+    console.error('Upload image error:', error);
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}
+
+export async function DELETE(request: NextRequest) {
+  try {
+    await requireRole('admin');
+    const { searchParams } = new URL(request.url);
+    const id = searchParams.get('id');
+
+    if (!id) {
+      return NextResponse.json({ error: 'Missing id' }, { status: 400 });
+    }
+
+    await db.query('DELETE FROM images WHERE id = $1', [id]);
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    if ((error as Error).message === 'Unauthorized') {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+    console.error('Delete image error:', error);
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}

src/app/api/auth/login/route.ts

@@ -0,0 +1,25 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { authenticateUser, createSession } from '@/lib/auth';
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json();
+    const { username, password } = body;
+
+    if (!username || !password) {
+      return NextResponse.json({ error: 'Missing username or password' }, { status: 400 });
+    }
+
+    const user = await authenticateUser(username, password);
+    if (!user) {
+      return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 });
+    }
+
+    await createSession(user);
+
+    return NextResponse.json({ role: user.role, username: user.username });
+  } catch (error) {
+    console.error('Login error:', error);
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}

src/app/api/auth/logout/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+import { clearSession } from '@/lib/auth';
+
+export async function POST() {
+  await clearSession();
+  return NextResponse.json({ ok: true });
+}

src/app/api/auth/me/route.ts

@@ -0,0 +1,10 @@
+import { NextResponse } from 'next/server';
+import { getSession } from '@/lib/auth';
+
+export async function GET() {
+  const session = await getSession();
+  if (!session) {
+    return NextResponse.json({ authenticated: false }, { status: 401 });
+  }
+  return NextResponse.json({ authenticated: true, role: session.role, username: session.username });
+}

src/app/api/db/init/route.ts

@@ -0,0 +1,21 @@
+import { NextResponse } from 'next/server';
+import { initSchema, seed, resetDatabase } from '@/lib/schema';
+
+export async function POST(request: Request) {
+  try {
+    const { searchParams } = new URL(request.url);
+    const reset = searchParams.get('reset') === 'true';
+
+    if (reset) {
+      await resetDatabase();
+      return NextResponse.json({ ok: true, reset: true });
+    }
+
+    await initSchema();
+    await seed();
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    console.error('DB init error:', error);
+    return NextResponse.json({ error: 'Database initialization failed' }, { status: 500 });
+  }
+}

src/app/api/user/portal/route.ts

@@ -0,0 +1,47 @@
+import { NextResponse } from 'next/server';
+import { requireRole } from '@/lib/auth';
+import { db } from '@/lib/db';
+
+export async function GET() {
+  try {
+    const session = await requireRole('user');
+    const userId = session.id;
+
+    const { rows: reservations } = await db.query(
+      'SELECT id, date, time, guests, table_name FROM reservations WHERE user_id = $1 ORDER BY date, time',
+      [userId]
+    );
+
+    const { rows: coupons } = await db.query(
+      'SELECT id, code, discount FROM coupons WHERE user_id = $1 ORDER BY created_at',
+      [userId]
+    );
+
+    const { rows: offers } = await db.query(
+      'SELECT id, title, description FROM offers WHERE active = TRUE ORDER BY created_at'
+    );
+
+    const { rows: benefits } = await db.query(
+      'SELECT id, text FROM benefits ORDER BY id'
+    );
+
+    const { rows: configRows } = await db.query(
+      "SELECT value FROM config WHERE key = 'wifi_password'"
+    );
+    const wifiPassword = configRows[0]?.value || '';
+
+    return NextResponse.json({
+      reservations,
+      coupons,
+      offers,
+      benefits: benefits.map((b: { text: string }) => b.text),
+      wifiPassword,
+    });
+  } catch (error) {
+    if ((error as Error).message === 'Unauthorized') {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+    console.error('User portal error:', error);
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
+  }
+}