Add self-hosted auth, admin API, and owner web dashboard

- Replace Clerk with self-hosted JWT auth (register/login/verify, bcrypt passwords, Gmail OTP with console fallback) - Add lib/db.ts pg pool + transaction helpers; seed script migrates legacy Clerk-era schema (drop clerk_id, enforce UUID ids and unique email) - Add owner-gated admin API: stats, users, drivers CRUD, rides - Add dashboard/ Vite React owner dashboard (login, overview, users, fleet, rides) with dev-server proxy to avoid Expo CORS middleware - Add scripts/set-owner.mjs for role management
2026-08-23 16:38:41 +03:00
parent fbe92c9d16
commit a0b297285a
75 changed files with 5158 additions and 2837 deletions
@@ -0,0 +1,79 @@
+import { requireOwner, withCors, preflight } from "@/lib/admin";
+import { sql } from "@/lib/db";
+
+export async function OPTIONS() {
+  return preflight();
+}
+
+export async function GET(request: Request) {
+  const auth = await requireOwner(request);
+  if ("error" in auth) return withCors(auth.error);
+
+  try {
+    const rows = await sql`
+      SELECT
+        d.*,
+        (SELECT COUNT(*)::int FROM rides r WHERE r.driver_id = d.id) AS total_rides,
+        COALESCE((
+          SELECT SUM(r.fare_price)::int FROM rides r
+          WHERE r.driver_id = d.id AND r.payment_status = 'paid'
+        ), 0) AS revenue
+      FROM drivers d
+      ORDER BY d.id
+    `;
+
+    return withCors(Response.json({ data: rows }));
+  } catch (error) {
+    console.error("[ADMIN_DRIVERS]: ", error);
+    return withCors(
+      Response.json({ error: "Internal Server Error" }, { status: 500 }),
+    );
+  }
+}
+
+type DriverBody = {
+  first_name?: string;
+  last_name?: string;
+  profile_image_url?: string;
+  car_image_url?: string;
+  car_seats?: number;
+  rating?: number;
+};
+
+export async function POST(request: Request) {
+  const auth = await requireOwner(request);
+  if ("error" in auth) return withCors(auth.error);
+
+  try {
+    const body = (await request.json()) as DriverBody;
+
+    if (!body.first_name?.trim() || !body.last_name?.trim()) {
+      return withCors(
+        Response.json(
+          { error: "first_name and last_name are required." },
+          { status: 400 },
+        ),
+      );
+    }
+
+    const [driver] = await sql`
+      INSERT INTO drivers
+        (first_name, last_name, profile_image_url, car_image_url, car_seats, rating)
+      VALUES
+        (${body.first_name.trim()},
+         ${body.last_name.trim()},
+         ${body.profile_image_url ?? null},
+         ${body.car_image_url ?? null},
+         ${body.car_seats ?? 4},
+         ${body.rating ?? 4.5})
+      RETURNING *
+    `;
+
+    return withCors(Response.json({ data: driver }, { status: 201 }));
+  } catch (error) {
+    console.error("[ADMIN_DRIVER_CREATE]: ", error);
+    return withCors(
+      Response.json({ error: "Internal Server Error" }, { status: 500 }),
+    );
+  }
+}
@@ -0,0 +1,86 @@
+import { requireOwner, withCors, preflight } from "@/lib/admin";
+import { sql } from "@/lib/db";
+
+export async function OPTIONS() {
+  return preflight();
+}
+
+type DriverBody = {
+  first_name?: string;
+  last_name?: string;
+  profile_image_url?: string;
+  car_image_url?: string;
+  car_seats?: number;
+  rating?: number;
+};
+
+export async function PATCH(request: Request, { id }: { id: string }) {
+  const auth = await requireOwner(request);
+  if ("error" in auth) return withCors(auth.error);
+
+  try {
+    const body = (await request.json()) as DriverBody;
+
+    const rows = await sql`
+      UPDATE drivers SET
+        first_name = COALESCE(${body.first_name ?? null}, first_name),
+        last_name = COALESCE(${body.last_name ?? null}, last_name),
+        profile_image_url = COALESCE(${body.profile_image_url ?? null}, profile_image_url),
+        car_image_url = COALESCE(${body.car_image_url ?? null}, car_image_url),
+        car_seats = COALESCE(${body.car_seats ?? null}, car_seats),
+        rating = COALESCE(${body.rating ?? null}, rating)
+      WHERE id = ${id}
+      RETURNING *
+    `;
+
+    if (!rows[0]) {
+      return withCors(
+        Response.json({ error: "Driver not found." }, { status: 404 }),
+      );
+    }
+
+    return withCors(Response.json({ data: rows[0] }));
+  } catch (error) {
+    console.error("[ADMIN_DRIVER_PATCH]: ", error);
+    return withCors(
+      Response.json({ error: "Internal Server Error" }, { status: 500 }),
+    );
+  }
+}
+
+export async function DELETE(request: Request, { id }: { id: string }) {
+  const auth = await requireOwner(request);
+  if ("error" in auth) return withCors(auth.error);
+
+  try {
+    const used = await sql<{ n: number }>`
+      SELECT COUNT(*)::int AS n FROM rides WHERE driver_id = ${id}
+    `;
+
+    if (used[0].n > 0) {
+      return withCors(
+        Response.json(
+          { error: "Driver has recorded rides and cannot be deleted." },
+          { status: 409 },
+        ),
+      );
+    }
+
+    const rows = await sql`
+      DELETE FROM drivers WHERE id = ${id} RETURNING id
+    `;
+
+    if (!rows[0]) {
+      return withCors(
+        Response.json({ error: "Driver not found." }, { status: 404 }),
+      );
+    }
+
+    return withCors(Response.json({ data: rows[0] }));
+  } catch (error) {
+    console.error("[ADMIN_DRIVER_DELETE]: ", error);
+    return withCors(
+      Response.json({ error: "Internal Server Error" }, { status: 500 }),
+    );
+  }
+}
@@ -0,0 +1,70 @@
+import { requireOwner, withCors, preflight } from "@/lib/admin";
+import { sql } from "@/lib/db";
+
+export async function OPTIONS() {
+  return preflight();
+}
+
+export async function GET(request: Request) {
+  const auth = await requireOwner(request);
+  if ("error" in auth) return withCors(auth.error);
+
+  try {
+    const url = new URL(request.url);
+    const status = url.searchParams.get("status")?.trim().toLowerCase() ?? "";
+
+    const rows = status
+      ? await sql`
+        SELECT
+          r.ride_id,
+          r.origin_address,
+          r.destination_address,
+          r.ride_time,
+          r.fare_price,
+          r.payment_status,
+          r.created_at,
+          u.id AS user_id,
+          u.email AS user_email,
+          json_build_object(
+            'driver_id', d.id,
+            'name', d.first_name || ' ' || d.last_name,
+            'rating', d.rating
+          ) AS driver
+        FROM rides r
+        INNER JOIN drivers d ON d.id = r.driver_id
+        INNER JOIN users u ON u.id = r.user_id
+        WHERE LOWER(r.payment_status) = ${status}
+        ORDER BY r.created_at DESC
+        LIMIT 500
+      `
+      : await sql`
+        SELECT
+          r.ride_id,
+          r.origin_address,
+          r.destination_address,
+          r.ride_time,
+          r.fare_price,
+          r.payment_status,
+          r.created_at,
+          u.id AS user_id,
+          u.email AS user_email,
+          json_build_object(
+            'driver_id', d.id,
+            'name', d.first_name || ' ' || d.last_name,
+            'rating', d.rating
+          ) AS driver
+        FROM rides r
+        INNER JOIN drivers d ON d.id = r.driver_id
+        INNER JOIN users u ON u.id = r.user_id
+        ORDER BY r.created_at DESC
+        LIMIT 500
+      `;
+
+    return withCors(Response.json({ data: rows }));
+  } catch (error) {
+    console.error("[ADMIN_RIDES]: ", error);
+    return withCors(
+      Response.json({ error: "Internal Server Error" }, { status: 500 }),
+    );
+  }
+}
@@ -0,0 +1,66 @@
+import { requireOwner, withCors, preflight } from "@/lib/admin";
+import { sql } from "@/lib/db";
+
+export async function OPTIONS() {
+  return preflight();
+}
+
+export async function GET(request: Request) {
+  const auth = await requireOwner(request);
+  if ("error" in auth) return withCors(auth.error);
+
+  try {
+    const [totals] = await sql<{
+      users: number;
+      drivers: number;
+      rides: number;
+      revenue: number;
+    }>`
+      SELECT
+        (SELECT COUNT(*)::int FROM users) AS users,
+        (SELECT COUNT(*)::int FROM drivers) AS drivers,
+        (SELECT COUNT(*)::int FROM rides) AS rides,
+        (SELECT COALESCE(SUM(fare_price), 0)::int FROM rides WHERE payment_status = 'paid') AS revenue
+    `;
+
+    const trend = await sql<{ day: string; rides: number; revenue: number }>`
+      SELECT
+        TO_CHAR(DAY, 'YYYY-MM-DD') AS day,
+        COUNT(r.ride_id)::int AS rides,
+        COALESCE(SUM(r.fare_price) FILTER (WHERE r.payment_status = 'paid'), 0)::int AS revenue
+      FROM generate_series(
+        CURRENT_DATE - INTERVAL '13 days',
+        CURRENT_DATE,
+        INTERVAL '1 day'
+      ) AS DAY
+      LEFT JOIN rides r ON r.created_at >= DAY AND r.created_at < DAY + INTERVAL '1 day'
+      GROUP BY DAY
+      ORDER BY DAY
+    `;
+
+    const topDrivers = await sql<{
+      driver_id: number;
+      name: string;
+      rides: number;
+      revenue: number;
+    }>`
+      SELECT
+        d.id AS driver_id,
+        d.first_name || ' ' || d.last_name AS name,
+        COUNT(r.ride_id)::int AS rides,
+        COALESCE(SUM(r.fare_price) FILTER (WHERE r.payment_status = 'paid'), 0)::int AS revenue
+      FROM drivers d
+      LEFT JOIN rides r ON r.driver_id = d.id
+      GROUP BY d.id, d.first_name, d.last_name
+      ORDER BY revenue DESC, rides DESC
+      LIMIT 5
+    `;
+
+    return withCors(Response.json({ data: { totals, trend, topDrivers } }));
+  } catch (error) {
+    console.error("[ADMIN_STATS]: ", error);
+    return withCors(
+      Response.json({ error: "Internal Server Error" }, { status: 500 }),
+    );
+  }
+}
@@ -0,0 +1,68 @@
+import { requireOwner, withCors, preflight } from "@/lib/admin";
+import { sql } from "@/lib/db";
+
+export async function OPTIONS() {
+  return preflight();
+}
+
+export async function GET(request: Request) {
+  const auth = await requireOwner(request);
+  if ("error" in auth) return withCors(auth.error);
+
+  try {
+    const url = new URL(request.url);
+    const search = url.searchParams.get("q")?.trim().toLowerCase() ?? "";
+
+    const rows = search
+      ? await sql<{
+          id: string;
+          name: string;
+          email: string;
+          role: string | null;
+          email_verified: boolean;
+          created_at: string;
+          rides: number;
+        }>`
+        SELECT
+          u.id,
+          u.name,
+          u.email,
+          u.role,
+          u.email_verified,
+          u.created_at,
+          (SELECT COUNT(*)::int FROM rides r WHERE r.user_id = u.id) AS rides
+        FROM users u
+        WHERE (LOWER(u.email) LIKE ${`%${search}%`} OR LOWER(u.name) LIKE ${`%${search}%`})
+        ORDER BY u.created_at DESC
+        LIMIT 500
+      `
+      : await sql<{
+          id: string;
+          name: string;
+          email: string;
+          role: string | null;
+          email_verified: boolean;
+          created_at: string;
+          rides: number;
+        }>`
+        SELECT
+          u.id,
+          u.name,
+          u.email,
+          u.role,
+          u.email_verified,
+          u.created_at,
+          (SELECT COUNT(*)::int FROM rides r WHERE r.user_id = u.id) AS rides
+        FROM users u
+        ORDER BY u.created_at DESC
+        LIMIT 500
+      `;
+
+    return withCors(Response.json({ data: rows }));
+  } catch (error) {
+    console.error("[ADMIN_USERS]: ", error);
+    return withCors(
+      Response.json({ error: "Internal Server Error" }, { status: 500 }),
+    );
+  }
+}
@@ -0,0 +1,60 @@
+import { requireOwner, withCors, preflight } from "@/lib/admin";
+import { sql } from "@/lib/db";
+
+type Body = {
+  role?: string | null;
+  email_verified?: boolean;
+};
+
+export async function OPTIONS() {
+  return preflight();
+}
+
+export async function PATCH(request: Request, { id }: { id: string }) {
+  const auth = await requireOwner(request);
+  if ("error" in auth) return withCors(auth.error);
+
+  try {
+    const body = (await request.json()) as Body;
+
+    if (body.role !== undefined) {
+      const allowed = ["rider", "driver", "owner", null];
+      if (!allowed.includes(body.role)) {
+        return withCors(
+          Response.json(
+            { error: "Role must be rider, driver, owner or null." },
+            { status: 400 },
+          ),
+        );
+      }
+
+      if (id === auth.userId && body.role !== "owner") {
+        return withCors(
+          Response.json(
+            { error: "You cannot remove your own owner role." },
+            { status: 400 },
+          ),
+        );
+      }
+    }
+
+    const rows = await sql<{ id: string; role: string | null; email_verified: boolean }>`
+      UPDATE users SET
+        role = COALESCE(${body.role ?? null}, role),
+        email_verified = COALESCE(${body.email_verified ?? null}, email_verified)
+      WHERE id = ${id}
+      RETURNING id, role, email_verified
+    `;
+
+    if (!rows[0]) {
+      return withCors(Response.json({ error: "User not found." }, { status: 404 }));
+    }
+
+    return withCors(Response.json({ data: rows[0] }));
+  } catch (error) {
+    console.error("[ADMIN_USER_PATCH]: ", error);
+    return withCors(
+      Response.json({ error: "Internal Server Error" }, { status: 500 }),
+    );
+  }
+}