backerup-website/frontend/app/api/admin/users/route.ts

import { NextResponse } from 'next/server'
import { listUsers, createUser } from '@/lib/users'
import { getSession } from '@/lib/session'

export async function GET() {
  const session = await getSession()
  if (!session || session.role !== 'admin') {
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
  }
  const users = await listUsers()
  return NextResponse.json(users)
}

export async function POST(request: Request) {
  const session = await getSession()
  if (!session || session.role !== 'admin') {
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
  }

  let body: { username?: string; password?: string; role?: string }
  try {
    body = (await request.json()) as { username?: string; password?: string; role?: string }
  } catch {
    return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })
  }

  const username = String(body.username ?? '').trim()
  const password = String(body.password ?? '')
  const role = body.role === 'admin' ? 'admin' : ('user' as const)

  if (!username || !password) {
    return NextResponse.json({ error: 'Username and password are required' }, { status: 400 })
  }

  try {
    const user = await createUser(username, password, role)
    return NextResponse.json(user, { status: 201 })
  } catch (e) {
    return NextResponse.json({ error: (e as Error).message }, { status: 409 })
  }
}