`app/api/users/route.ts`

37 lines
// GET /api/users — list of staff/admin/intern users for assignment dropdowns.
// Admin-only. Returns id, name (display_name fallback to username), role.

import { NextRequest, NextResponse } from 'next/server';
import { query } from '@/lib/db';
import { requireRole } from '@/lib/require-role';

export const runtime = 'nodejs';
export const dynamic = 'force-dynamic';

export async function GET(request: NextRequest) {
  const auth = requireRole(request, 'admin', 'staff');
  if (auth instanceof NextResponse) return auth;

  const result = await query<{
    id: string;
    username: string;
    display_name: string | null;
    role: string;
  }>(
    `SELECT id, username, display_name, role
       FROM tier_credentials
      WHERE role IN ('admin', 'staff', 'intern')
      ORDER BY COALESCE(display_name, username) ASC`,
  );

  return NextResponse.json({
    users: result.rows.map(r => ({
      id: r.id,
      username: r.username,
      name: r.display_name || r.username,
      email: r.username.includes('@') ? r.username : null,
      role: r.role,
    })),
  });
}