← back to Norma

app/api/pulse/profile/route.ts

88 lines

import { NextRequest, NextResponse } from 'next/server';
import { query } from '@/lib/db';
import { requireRole } from '@/lib/require-role';
import type { AuthSession } from '@/lib/auth';

/**
 * GET /api/pulse/profile
 * Returns the authenticated user's profile data from tier_credentials.
 * Requires any authenticated role.
 */
export async function GET(request: NextRequest) {
  const result = requireRole(request, 'admin', 'staff', 'pulse');
  if (result instanceof NextResponse) return result;
  const session = result as AuthSession;

  try {
    const res = await query(
      `SELECT username, display_name, role, org_id, created_at, updated_at
       FROM tier_credentials
       WHERE username = $1`,
      [session.username],
    );

    if (res.rows.length === 0) {
      return NextResponse.json({ error: 'User not found' }, { status: 404 });
    }

    return NextResponse.json(res.rows[0]);
  } catch (err) {
    console.error('[api/pulse/profile] GET error:', (err as Error).message);
    return NextResponse.json(
      { error: 'Failed to fetch profile' },
      { status: 500 },
    );
  }
}

/**
 * PUT /api/pulse/profile
 * Update the authenticated user's display name.
 * Body: { display_name: string }
 */
export async function PUT(request: NextRequest) {
  const result = requireRole(request, 'admin', 'staff', 'pulse');
  if (result instanceof NextResponse) return result;
  const session = result as AuthSession;

  try {
    const body = await request.json();
    const displayName = body.display_name;

    if (!displayName || typeof displayName !== 'string') {
      return NextResponse.json(
        { error: 'display_name is required' },
        { status: 400 },
      );
    }

    const trimmed = displayName.trim();
    if (trimmed.length < 1 || trimmed.length > 50) {
      return NextResponse.json(
        { error: 'Display name must be between 1 and 50 characters' },
        { status: 400 },
      );
    }

    const updateRes = await query(
      `UPDATE tier_credentials
       SET display_name = $1, updated_at = NOW()
       WHERE username = $2
       RETURNING username, display_name, role, created_at, updated_at`,
      [trimmed, session.username],
    );

    if (updateRes.rows.length === 0) {
      return NextResponse.json({ error: 'User not found' }, { status: 404 });
    }

    return NextResponse.json(updateRes.rows[0]);
  } catch (err) {
    console.error('[api/pulse/profile] PUT error:', (err as Error).message);
    return NextResponse.json(
      { error: 'Failed to update profile' },
      { status: 500 },
    );
  }
}