deckhearth/api/admin/promote-user.js

const { Pool } = require('pg');

const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
  ssl: process.env.NODE_ENV === 'production' ? { rejectUnauthorized: false } : false,
});

export default async function handler(req, res) {
  if (req.method !== 'POST') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  try {
    const body = JSON.parse(req.body || '{}');
    const { username, userId } = body;

    if (!username && !userId) {
      return res.status(400).json({ 
        error: 'Either username or userId is required' 
      });
    }

    const client = await pool.connect();

    try {
      // Find the user
      let userQuery;
      let userParams;
      
      if (userId) {
        userQuery = 'SELECT id, username, email FROM users WHERE id = $1';
        userParams = [userId];
      } else {
        userQuery = 'SELECT id, username, email FROM users WHERE username = $1';
        userParams = [username];
      }

      const userResult = await client.query(userQuery, userParams);
      
      if (userResult.rows.length === 0) {
        return res.status(404).json({ 
          error: 'User not found' 
        });
      }

      const user = userResult.rows[0];

      // Check if user is already an admin
      const adminCheckQuery = `
        SELECT ur.user_id 
        FROM user_roles ur 
        JOIN roles r ON ur.role_id = r.id 
        WHERE ur.user_id = $1 AND r.name = 'admin'
      `;
      
      const adminCheck = await client.query(adminCheckQuery, [user.id]);
      
      if (adminCheck.rows.length > 0) {
        return res.status(200).json({
          success: true,
          message: 'User is already an admin',
          user: {
            id: user.id,
            username: user.username,
            email: user.email
          }
        });
      }

      // Get admin role ID
      const roleResult = await client.query(
        'SELECT id FROM roles WHERE name = $1',
        ['admin']
      );

      if (roleResult.rows.length === 0) {
        return res.status(500).json({ 
          error: 'Admin role not found in database' 
        });
      }

      const adminRoleId = roleResult.rows[0].id;

      // Add user to admin role
      await client.query(
        'INSERT INTO user_roles (user_id, role_id) VALUES ($1, $2)',
        [user.id, adminRoleId]
      );

      // Get updated user info with roles
      const updatedUserQuery = `
        SELECT 
          u.id, u.username, u.email, u.first_name, u.last_name,
          ARRAY_AGG(DISTINCT r.name) as roles
        FROM users u
        LEFT JOIN user_roles ur ON u.id = ur.user_id
        LEFT JOIN roles r ON ur.role_id = r.id
        WHERE u.id = $1
        GROUP BY u.id, u.username, u.email, u.first_name, u.last_name
      `;

      const updatedUser = await client.query(updatedUserQuery, [user.id]);

      res.status(200).json({
        success: true,
        message: 'User successfully promoted to admin',
        user: {
          id: updatedUser.rows[0].id,
          username: updatedUser.rows[0].username,
          email: updatedUser.rows[0].email,
          firstName: updatedUser.rows[0].first_name,
          lastName: updatedUser.rows[0].last_name,
          roles: updatedUser.rows[0].roles || []
        }
      });

    } finally {
      client.release();
    }

  } catch (error) {
    console.error('Promote user error:', error);
    res.status(500).json({ 
      error: 'Internal server error',
      details: error.message 
    });
  }
}