Add self-hosted auth, admin API, and owner web dashboard

- Replace Clerk with self-hosted JWT auth (register/login/verify, bcrypt passwords, Gmail OTP with console fallback) - Add lib/db.ts pg pool + transaction helpers; seed script migrates legacy Clerk-era schema (drop clerk_id, enforce UUID ids and unique email) - Add owner-gated admin API: stats, users, drivers CRUD, rides - Add dashboard/ Vite React owner dashboard (login, overview, users, fleet, rides) with dev-server proxy to avoid Expo CORS middleware - Add scripts/set-owner.mjs for role management
2026-08-23 16:38:41 +03:00
parent fbe92c9d16
commit a0b297285a
75 changed files with 5158 additions and 2837 deletions
@@ -0,0 +1,86 @@
+import { requireOwner, withCors, preflight } from "@/lib/admin";
+import { sql } from "@/lib/db";
+
+export async function OPTIONS() {
+  return preflight();
+}
+
+type DriverBody = {
+  first_name?: string;
+  last_name?: string;
+  profile_image_url?: string;
+  car_image_url?: string;
+  car_seats?: number;
+  rating?: number;
+};
+
+export async function PATCH(request: Request, { id }: { id: string }) {
+  const auth = await requireOwner(request);
+  if ("error" in auth) return withCors(auth.error);
+
+  try {
+    const body = (await request.json()) as DriverBody;
+
+    const rows = await sql`
+      UPDATE drivers SET
+        first_name = COALESCE(${body.first_name ?? null}, first_name),
+        last_name = COALESCE(${body.last_name ?? null}, last_name),
+        profile_image_url = COALESCE(${body.profile_image_url ?? null}, profile_image_url),
+        car_image_url = COALESCE(${body.car_image_url ?? null}, car_image_url),
+        car_seats = COALESCE(${body.car_seats ?? null}, car_seats),
+        rating = COALESCE(${body.rating ?? null}, rating)
+      WHERE id = ${id}
+      RETURNING *
+    `;
+
+    if (!rows[0]) {
+      return withCors(
+        Response.json({ error: "Driver not found." }, { status: 404 }),
+      );
+    }
+
+    return withCors(Response.json({ data: rows[0] }));
+  } catch (error) {
+    console.error("[ADMIN_DRIVER_PATCH]: ", error);
+    return withCors(
+      Response.json({ error: "Internal Server Error" }, { status: 500 }),
+    );
+  }
+}
+
+export async function DELETE(request: Request, { id }: { id: string }) {
+  const auth = await requireOwner(request);
+  if ("error" in auth) return withCors(auth.error);
+
+  try {
+    const used = await sql<{ n: number }>`
+      SELECT COUNT(*)::int AS n FROM rides WHERE driver_id = ${id}
+    `;
+
+    if (used[0].n > 0) {
+      return withCors(
+        Response.json(
+          { error: "Driver has recorded rides and cannot be deleted." },
+          { status: 409 },
+        ),
+      );
+    }
+
+    const rows = await sql`
+      DELETE FROM drivers WHERE id = ${id} RETURNING id
+    `;
+
+    if (!rows[0]) {
+      return withCors(
+        Response.json({ error: "Driver not found." }, { status: 404 }),
+      );
+    }
+
+    return withCors(Response.json({ data: rows[0] }));
+  } catch (error) {
+    console.error("[ADMIN_DRIVER_DELETE]: ", error);
+    return withCors(
+      Response.json({ error: "Internal Server Error" }, { status: 500 }),
+    );
+  }
+}