spb/spb-cloud

1import { NextRequest, NextResponse } from "next/server";2import { getIronSession } from "iron-session";3import { SessionData, sessionOptions } from "@/lib/session";4import { prisma } from "@/lib/prisma";5import { hashPassword, requireAdmin } from "@/lib/auth";67export async function GET(request: NextRequest) {8  const response = NextResponse.next();9  const session = await getIronSession<SessionData>(request, response, sessionOptions);10  if (!session.userId || !(await requireAdmin(session.userId))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });1112  const users = await prisma.user.findMany({13    select: { id: true, username: true, email: true, name: true, role: true, twoFactorEnabled: true, createdAt: true, _count: { select: { files: true, folders: true } } },14    orderBy: { createdAt: "asc" },15  });16  return NextResponse.json(users);17}1819export async function POST(request: NextRequest) {20  const response = NextResponse.next();21  const session = await getIronSession<SessionData>(request, response, sessionOptions);22  if (!session.userId || !(await requireAdmin(session.userId))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });2324  const body = await request.json();25  const { username, name, password, role } = body;26  if (!username || !password) return NextResponse.json({ error: "Nom d'utilisateur et mot de passe requis" }, { status: 400 });2728  const existing = await prisma.user.findUnique({ where: { username } });29  if (existing) return NextResponse.json({ error: "Nom d'utilisateur déjà utilisé" }, { status: 409 });3031  const user = await prisma.user.create({32    data: { username, name: name || null, passwordHash: await hashPassword(password), role: role || "user" },33    select: { id: true, username: true, name: true, role: true, createdAt: true },34  });35  return NextResponse.json(user, { status: 201 });36}37