Admin-Bereich: Benutzerverwaltung (Service-Role, serverseitig), Farben und Logo-Upload

app/admin/design/page.tsx

@@ -0,0 +1,5 @@
+import DesignEditor from "@/components/DesignEditor";
+
+export default function DesignPage() {
+  return <DesignEditor />;
+}

app/admin/layout.tsx

@@ -0,0 +1,59 @@
+import Link from "next/link";
+import { redirect } from "next/navigation";
+import { createClient } from "@/lib/supabase/server";
+
+export default async function AdminLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) redirect("/login");
+
+  const { data: profile } = await supabase
+    .from("profiles")
+    .select("role, full_name")
+    .eq("id", user.id)
+    .single();
+  if (profile?.role !== "admin") redirect("/intern");
+
+  return (
+    <div className="flex-1 flex flex-col">
+      <header className="bg-[var(--c-primary-dark)] text-white">
+        <div className="max-w-[1600px] mx-auto w-full px-4 py-3 flex flex-wrap items-center gap-x-5 gap-y-2">
+          <span className="font-bold">Verwaltung</span>
+          <nav className="flex flex-wrap gap-x-4 gap-y-1 text-sm">
+            <Link href="/admin" className="hover:underline">
+              Benutzer
+            </Link>
+            <Link href="/admin/design" className="hover:underline">
+              Design
+            </Link>
+            <Link href="/intern" className="hover:underline">
+              Kantinen-Bereich
+            </Link>
+            <Link href="/" className="hover:underline">
+              Zur Speisekarte
+            </Link>
+          </nav>
+          <div className="ml-auto flex items-center gap-3 text-sm">
+            <span className="text-white/70">
+              {profile.full_name || user.email}
+            </span>
+            <form action="/logout" method="post">
+              <button type="submit" className="btn btn-del">
+                Abmelden
+              </button>
+            </form>
+          </div>
+        </div>
+      </header>
+      <main className="max-w-[1600px] mx-auto w-full px-4 py-6 flex-1">
+        {children}
+      </main>
+    </div>
+  );
+}

app/admin/page.tsx

@@ -0,0 +1,5 @@
+import UserManager from "@/components/UserManager";
+
+export default function AdminPage() {
+  return <UserManager />;
+}

app/api/admin/users/route.ts

@@ -0,0 +1,117 @@
+import { NextResponse } from "next/server";
+import { createClient } from "@/lib/supabase/server";
+import { createAdminClient } from "@/lib/supabase/admin";
+
+// Benutzerverwaltung (nur Admin). Läuft serverseitig mit dem
+// Service-Role-Key, da das Anlegen/Löschen von Auth-Benutzern
+// nicht über den anon key möglich ist.
+
+async function requireAdmin() {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (!user) return null;
+
+  const admin = createAdminClient();
+  const { data: profile } = await admin
+    .from("profiles")
+    .select("role")
+    .eq("id", user.id)
+    .single();
+  if (profile?.role !== "admin") return null;
+  return { user, admin };
+}
+
+export async function POST(request: Request) {
+  const ctx = await requireAdmin();
+  if (!ctx) return NextResponse.json({ error: "Nicht berechtigt." }, { status: 403 });
+
+  const body = await request.json().catch(() => null);
+  const { email, password, full_name, role } = body ?? {};
+  if (!email || !password || !["admin", "staff"].includes(role)) {
+    return NextResponse.json({ error: "Ungültige Eingaben." }, { status: 400 });
+  }
+  if (String(password).length < 8) {
+    return NextResponse.json(
+      { error: "Das Passwort muss mindestens 8 Zeichen lang sein." },
+      { status: 400 }
+    );
+  }
+
+  const { data, error } = await ctx.admin.auth.admin.createUser({
+    email,
+    password,
+    email_confirm: true,
+    user_metadata: { full_name: full_name ?? "", role },
+  });
+  if (error) {
+    return NextResponse.json(
+      {
+        error: /already been registered/i.test(error.message)
+          ? "Diese E-Mail-Adresse ist bereits registriert."
+          : error.message,
+      },
+      { status: 400 }
+    );
+  }
+  return NextResponse.json({ id: data.user?.id });
+}
+
+export async function PATCH(request: Request) {
+  const ctx = await requireAdmin();
+  if (!ctx) return NextResponse.json({ error: "Nicht berechtigt." }, { status: 403 });
+
+  const body = await request.json().catch(() => null);
+  const { id, full_name, role, password } = body ?? {};
+  if (!id || (role && !["admin", "staff"].includes(role))) {
+    return NextResponse.json({ error: "Ungültige Eingaben." }, { status: 400 });
+  }
+  // Der Admin darf sich nicht selbst die Admin-Rolle entziehen,
+  // sonst sperrt er sich aus der Verwaltung aus.
+  if (id === ctx.user.id && role === "staff") {
+    return NextResponse.json(
+      { error: "Du kannst dir nicht selbst die Admin-Rolle entziehen." },
+      { status: 400 }
+    );
+  }
+
+  if (password) {
+    if (String(password).length < 8) {
+      return NextResponse.json(
+        { error: "Das Passwort muss mindestens 8 Zeichen lang sein." },
+        { status: 400 }
+      );
+    }
+    const { error } = await ctx.admin.auth.admin.updateUserById(id, { password });
+    if (error) return NextResponse.json({ error: error.message }, { status: 400 });
+  }
+
+  const updates: Record<string, string> = {};
+  if (typeof full_name === "string") updates.full_name = full_name;
+  if (role) updates.role = role;
+  if (Object.keys(updates).length > 0) {
+    const { error } = await ctx.admin.from("profiles").update(updates).eq("id", id);
+    if (error) return NextResponse.json({ error: error.message }, { status: 400 });
+  }
+  return NextResponse.json({ ok: true });
+}
+
+export async function DELETE(request: Request) {
+  const ctx = await requireAdmin();
+  if (!ctx) return NextResponse.json({ error: "Nicht berechtigt." }, { status: 403 });
+
+  const body = await request.json().catch(() => null);
+  const { id } = body ?? {};
+  if (!id) return NextResponse.json({ error: "Ungültige Eingaben." }, { status: 400 });
+  if (id === ctx.user.id) {
+    return NextResponse.json(
+      { error: "Du kannst dich nicht selbst löschen." },
+      { status: 400 }
+    );
+  }
+
+  const { error } = await ctx.admin.auth.admin.deleteUser(id);
+  if (error) return NextResponse.json({ error: error.message }, { status: 400 });
+  return NextResponse.json({ ok: true });
+}