pfandsystem-demo/backend/routes/mitarbeiter.js

import express from 'express';
import bcrypt from 'bcrypt';
import { body, validationResult } from 'express-validator';
import pool from '../config/database.js';
import { authenticateToken, requireTenant, requireRole } from '../middleware/auth.js';

const router = express.Router();
router.use(authenticateToken, requireTenant);

router.get('/', requireRole(['admin', 'superadmin']), async (req, res) => {
  try {
    const [rows] = await pool.query(
      `SELECT id, email, name, rolle, aktiv, erstellt_am FROM mitarbeiter
       WHERE tenant_id = ? ORDER BY name ASC`,
      [req.user.tenant_id]
    );
    res.json(rows);
  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
});

router.post('/', requireRole(['admin']), [
  body('email').isEmail().normalizeEmail(),
  body('password').isLength({ min: 6 }),
  body('name').notEmpty().trim(),
  body('rolle').isIn(['user', 'admin', 'fahrer'])
], async (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
  try {
    // Prüfe Limit
    const [[t]] = await pool.query('SELECT max_users FROM tenants WHERE id = ?', [req.user.tenant_id]);
    const [[c]] = await pool.query('SELECT COUNT(*) AS n FROM mitarbeiter WHERE tenant_id = ?',
                                   [req.user.tenant_id]);
    if (c.n >= t.max_users) return res.status(403).json({ error: `Limit erreicht (${t.max_users} User)` });

    const [[ex]] = await pool.query(
      'SELECT id FROM mitarbeiter WHERE email = ? AND tenant_id = ?',
      [req.body.email, req.user.tenant_id]
    );
    if (ex) return res.status(400).json({ error: 'Email bereits vergeben' });

    const hash = await bcrypt.hash(req.body.password, 10);
    await pool.query(
      `INSERT INTO mitarbeiter (id, tenant_id, email, password_hash, name, rolle, aktiv)
       VALUES (UUID(), ?, ?, ?, ?, ?, 1)`,
      [req.user.tenant_id, req.body.email, hash, req.body.name, req.body.rolle]
    );
    res.status(201).json({ message: 'Mitarbeiter angelegt' });
  } catch (e) {
    console.error('POST mitarbeiter:', e);
    res.status(500).json({ error: 'Serverfehler' });
  }
});

router.put('/:id', [
  body('name').optional().trim(),
  body('rolle').optional().isIn(['user', 'admin', 'fahrer']),
  body('aktiv').optional().isBoolean()
], async (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });

  if (req.params.id !== req.user.id && req.user.rolle !== 'admin') {
    return res.status(403).json({ error: 'Keine Berechtigung' });
  }
  if ((req.body.rolle || req.body.aktiv !== undefined) && req.user.rolle !== 'admin') {
    return res.status(403).json({ error: 'Nur Admin darf Rolle/Aktiv ändern' });
  }

  const updates = [];
  const values = [];
  if (req.body.name) { updates.push('name = ?'); values.push(req.body.name); }
  if (req.body.rolle) { updates.push('rolle = ?'); values.push(req.body.rolle); }
  if (req.body.aktiv !== undefined) { updates.push('aktiv = ?'); values.push(req.body.aktiv ? 1 : 0); }
  if (updates.length === 0) return res.status(400).json({ error: 'Keine Änderungen' });
  values.push(req.params.id, req.user.tenant_id);

  try {
    const [r] = await pool.query(
      `UPDATE mitarbeiter SET ${updates.join(', ')} WHERE id = ? AND tenant_id = ?`,
      values
    );
    if (r.affectedRows === 0) return res.status(404).json({ error: 'Mitarbeiter nicht gefunden' });
    const [rows] = await pool.query(
      'SELECT id, email, name, rolle, aktiv FROM mitarbeiter WHERE id = ? AND tenant_id = ?',
      [req.params.id, req.user.tenant_id]
    );
    res.json(rows[0]);
  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
});

router.delete('/:id', requireRole(['admin']), async (req, res) => {
  if (req.params.id === req.user.id) return res.status(400).json({ error: 'Sie können sich nicht selbst löschen' });
  try {
    const [r] = await pool.query('DELETE FROM mitarbeiter WHERE id=? AND tenant_id=?',
                                 [req.params.id, req.user.tenant_id]);
    if (r.affectedRows === 0) return res.status(404).json({ error: 'Mitarbeiter nicht gefunden' });
    res.json({ message: 'Mitarbeiter gelöscht' });
  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
});

export default router;