56 lines
1.7 KiB
TypeScript
56 lines
1.7 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { getDb } from "@/lib/db";
|
|
import { getViewer } from "@/lib/viewer";
|
|
|
|
/**
|
|
* Nutzerliste:
|
|
* - Server-Admin: alle Nutzer mit Haushaltszuordnung.
|
|
* - Haushalts-Admin: nur Mitglieder des eigenen Haushalts.
|
|
* - Andere: keine Einsicht.
|
|
*/
|
|
export async function GET() {
|
|
const viewer = await getViewer();
|
|
if (!viewer) return NextResponse.json({ error: "unauthorized" }, { status: 401 });
|
|
const db = getDb();
|
|
if (viewer.role === "admin") {
|
|
const users = await db.user.findMany({
|
|
orderBy: { createdAt: "asc" },
|
|
include: { membership: { include: { household: true } } },
|
|
});
|
|
return NextResponse.json(
|
|
users.map((u) => ({
|
|
id: u.id,
|
|
name: u.name,
|
|
email: u.email,
|
|
role: u.role,
|
|
oidcVerknuepft: u.oidcSubject !== null,
|
|
createdAt: u.createdAt,
|
|
householdId: u.membership?.householdId ?? null,
|
|
householdName: u.membership?.household.name ?? null,
|
|
householdRole: u.membership?.role ?? null,
|
|
}))
|
|
);
|
|
}
|
|
if (viewer.householdId === null || viewer.householdRole !== "admin") {
|
|
return NextResponse.json({ error: "forbidden" }, { status: 403 });
|
|
}
|
|
const members = await db.householdMember.findMany({
|
|
where: { householdId: viewer.householdId },
|
|
include: { user: true },
|
|
orderBy: { createdAt: "asc" },
|
|
});
|
|
return NextResponse.json(
|
|
members.map((m) => ({
|
|
id: m.user.id,
|
|
name: m.user.name,
|
|
email: m.user.email,
|
|
role: m.user.role,
|
|
oidcVerknuepft: m.user.oidcSubject !== null,
|
|
createdAt: m.user.createdAt,
|
|
householdId: viewer.householdId,
|
|
householdName: viewer.householdName,
|
|
householdRole: m.role,
|
|
}))
|
|
);
|
|
}
|