Rollen Chunk 4: Benutzerkonto, Abmelde-Icon und fremde Einstellungen

src/app/api/settings/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { authedUser } from "@/lib/auth";
+import { authedRole, authedUser, type SessionUser } from "@/lib/auth";
 import { getDb, initializeDatabase } from "@/lib/db";
 import { isGermanStateCode } from "@/lib/domain/holidays";
 import { errorResponse, isValidYear } from "@/lib/http";
@@ -10,6 +10,7 @@ import {
   savePreference,
   saveWeeklyTargets,
   saveYearSettings,
+  userExists,
   type WeekdayTargets,
 } from "@/lib/repository";
 
@@ -21,6 +22,35 @@ function readYear(request: Request): number | null {
   return Number(yearParam);
 }
 
+/**
+ * Zielkonto aufloesen: ohne ?user= das eigene (alle Rollen), mit ?user=
+ * ein fremdes (nur Teamleiter und Admin). Gibt die Benutzer-ID oder die
+ * Fehlerantwort zurueck.
+ */
+async function targetUserId(
+  request: Request,
+  user: SessionUser,
+): Promise<string | NextResponse> {
+  const target = new URL(request.url).searchParams.get("user");
+  if (!target || target === user.id) {
+    return user.id;
+  }
+  const role = await authedRole(request, ["admin", "teamleiter"]);
+  if (role instanceof NextResponse) {
+    return role;
+  }
+  const db = getDb();
+  initializeDatabase(db);
+  if (!userExists(db, target)) {
+    return errorResponse(
+      404,
+      "notFound",
+      "Kein Benutzer mit dieser ID.",
+    );
+  }
+  return target;
+}
+
 export async function GET(request: Request) {
   const user = await authedUser(request);
   if (user instanceof NextResponse) {
@@ -30,16 +60,20 @@ export async function GET(request: Request) {
   if (year === null) {
     return errorResponse(400, "invalidYear", "Query parameter year must be YYYY.");
   }
+  const target = await targetUserId(request, user);
+  if (target instanceof NextResponse) {
+    return target;
+  }
   const db = getDb();
   initializeDatabase(db);
-  const settings = ensureYearSettings(db, user.id, year);
+  const settings = ensureYearSettings(db, target, year);
   return NextResponse.json({
     year,
     entitlementUnits: settings.entitlementUnits,
     carryoverUnits: settings.carryoverUnits,
     carryoverAuto: settings.carryoverAuto,
-    federalState: getFederalState(db, user.id),
-    weekdayTargets: getWeeklyTargets(db, user.id),
+    federalState: getFederalState(db, target),
+    weekdayTargets: getWeeklyTargets(db, target),
   });
 }
 
@@ -52,6 +86,10 @@ export async function PUT(request: Request) {
   if (year === null) {
     return errorResponse(400, "invalidYear", "Query parameter year must be YYYY.");
   }
+  const target = await targetUserId(request, user);
+  if (target instanceof NextResponse) {
+    return target;
+  }
   let body: {
     weekdayTargets?: WeekdayTargets;
     entitlementUnits?: number;
@@ -67,7 +105,7 @@ export async function PUT(request: Request) {
   initializeDatabase(db);
   if (body.weekdayTargets !== undefined) {
     try {
-      saveWeeklyTargets(db, user.id, body.weekdayTargets);
+      saveWeeklyTargets(db, target, body.weekdayTargets);
     } catch {
       return errorResponse(
         400,
@@ -76,7 +114,7 @@ export async function PUT(request: Request) {
       );
     }
   }
-  const current = ensureYearSettings(db, user.id, year);
+  const current = ensureYearSettings(db, target, year);
   const entitlementUnits = body.entitlementUnits ?? current.entitlementUnits;
   const carryoverUnits = body.carryoverUnits ?? current.carryoverUnits;
   if (
@@ -93,7 +131,7 @@ export async function PUT(request: Request) {
   }
   saveYearSettings(
     db,
-    user.id,
+    target,
     year,
     {
       entitlementUnits,
@@ -111,15 +149,15 @@ export async function PUT(request: Request) {
         "federalState must be a German state code.",
       );
     }
-    savePreference(db, user.id, "federal_state", body.federalState);
+    savePreference(db, target, "federal_state", body.federalState);
   }
-  const saved = ensureYearSettings(db, user.id, year);
+  const saved = ensureYearSettings(db, target, year);
   return NextResponse.json({
     year,
     entitlementUnits: saved.entitlementUnits,
     carryoverUnits: saved.carryoverUnits,
     carryoverAuto: saved.carryoverAuto,
-    federalState: getFederalState(db, user.id),
-    weekdayTargets: getWeeklyTargets(db, user.id),
+    federalState: getFederalState(db, target),
+    weekdayTargets: getWeeklyTargets(db, target),
   });
 }