Rollen Chunk 7: Benutzerverwaltung und Sicherung strikt Admin-only

src/app/api/users/route.ts

@@ -0,0 +1,74 @@
+import { NextResponse } from "next/server";
+import { getAuth, guardRole } from "@/lib/auth";
+import { getDb, initializeDatabase } from "@/lib/db";
+import { errorResponse } from "@/lib/http";
+import { listAllUsers } from "@/lib/repository";
+
+export async function GET(request: Request) {
+  const denied = await guardRole(request, ["admin"]);
+  if (denied) {
+    return denied;
+  }
+  const db = getDb();
+  initializeDatabase(db);
+  return NextResponse.json({ users: listAllUsers(db) });
+}
+
+export async function POST(request: Request) {
+  const denied = await guardRole(request, ["admin"]);
+  if (denied) {
+    return denied;
+  }
+  let body: { name?: unknown; email?: unknown; password?: unknown; role?: unknown };
+  try {
+    body = await request.json();
+  } catch {
+    return errorResponse(400, "invalidBody", "Request body must be JSON.");
+  }
+  if (
+    typeof body.name !== "string" ||
+    body.name.trim() === "" ||
+    typeof body.email !== "string" ||
+    !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(body.email) ||
+    typeof body.password !== "string" ||
+    body.password.length < 8 ||
+    (body.role !== "benutzer" && body.role !== "teamleiter" && body.role !== "admin")
+  ) {
+    return errorResponse(
+      400,
+      "invalidUser",
+      "name, gültige email, password (min. 8 Zeichen) und role (benutzer, teamleiter, admin) sind Pflicht.",
+    );
+  }
+  const auth = getAuth();
+  if (!auth) {
+    return errorResponse(404, "authDisabled", "Die Anmeldung ist ausgeschaltet.");
+  }
+  try {
+    const created = await auth.api.createUser({
+      body: {
+        name: body.name.trim(),
+        email: body.email.trim(),
+        password: body.password,
+        role: body.role as "admin",
+      },
+      headers: request.headers,
+    });
+    return NextResponse.json(
+      {
+        user: {
+          id: created.user.id,
+          name: created.user.name,
+          email: created.user.email,
+          role: created.user.role ?? body.role,
+        },
+      },
+      { status: 201 },
+    );
+  } catch (createError) {
+    if (createError instanceof Error && /already exists|duplicate|unique/i.test(createError.message)) {
+      return errorResponse(409, "emailTaken", "Diese E-Mail ist bereits vergeben.");
+    }
+    throw createError;
+  }
+}