Module 9: Admin Panel (අමතර කොටස)

// Inside lib/db.js -> initDb function (or a new migration script)

// Add this command. It will only run if the column doesn't exist, preventing errors.
try {
    db.exec("ALTER TABLE users ADD COLUMN isAdmin INTEGER DEFAULT 0");
} catch (e) {
    // Ignore error if column already exists
    console.log("'isAdmin' column already exists.");
}

// Inside /api/auth/login/route.ts

// First, fetch the isAdmin status from the user object
const user = db.prepare('SELECT id, username, password_hash, isAdmin FROM users WHERE username = ?').get(username) as any;

// ... (after password validation)

// Add isAdmin to the JWT payload
const token = jwt.sign(
  { userId: user.id, username: user.username, isAdmin: user.isAdmin === 1 }, // Check for 1
  secret,
  { expiresIn: '1h' }
);

// Inside middleware.ts
import { jwtVerify } from 'jose'; // A more secure way to verify JWTs on the edge

// ... inside the middleware function
export async function middleware(request: NextRequest) {
    const sessionToken = request.cookies.get('session_token')?.value;
    const { pathname } = request.nextUrl;

    // --- Admin Route Protection ---
    if (pathname.startsWith('/admin')) {
        if (!sessionToken) {
            return NextResponse.redirect(new URL('/auth/login', request.url));
        }

        try {
            const secret = new TextEncoder().encode(process.env.JWT_SECRET!);
            const { payload } = await jwtVerify(sessionToken, secret);
            
            if (!payload.isAdmin) {
                // If not an admin, redirect to the normal notes page
                return NextResponse.redirect(new URL('/notes', request.url));
            }
        } catch (err) {
            // If token is invalid, redirect to login
            return NextResponse.redirect(new URL('/auth/login', request.url));
        }
    }
    
    // ... (existing middleware logic for /notes and /auth)

    return NextResponse.next();
}

export const config = {
  matcher: ['/notes/:path*', '/auth/login', '/auth/register', '/admin/:path*'], // Add admin path
};

// You might need to install jose: npm install jose

import db from '@/lib/db';

interface AdminNote {
  id: number;
  title: string;
  content: string;
  created_at: string;
  username: string; // To show who created the note
}

// This is a Server Component, so we can directly access the database
async function getAllNotes(): Promise<AdminNote[]> {
  // Use a JOIN query to get the username from the users table
  const query = `
    SELECT notes.id, notes.title, notes.content, notes.created_at, users.username
    FROM notes
    JOIN users ON notes.user_id = users.id
    ORDER BY notes.created_at DESC
  `;
  const notes = db.prepare(query).all() as AdminNote[];
  return notes;
}

export default async function AdminDashboardPage() {
  const allNotes = await getAllNotes();

  return (
    <div>
      <h1>Admin Dashboard</h1>
      <p>Viewing all notes from all users.</p>

      <div className="table-responsive mt-4">
        <table className="table table-striped table-bordered">
          <thead>
            <tr>
              <th>Note ID</th>
              <th>Title</th>
              <th>Author (Username)</th>
              <th>Created At</th>
              <th>Actions</th>
            </tr>
          </thead>
          <tbody>
            {allNotes.map(note => (
              <tr key={note.id}>
                <td>{note.id}</td>
                <td>{note.title}</td>
                <td>{note.username}</td>
                <td>{new Date(note.created_at).toLocaleString()}</td>
                <td>
                  {/* Future: Add admin-specific actions like delete any note */}
                  <button className="btn btn-sm btn-danger" disabled>Delete</button>
                </td>
              </tr>
            ))}
          </tbody>
        </table>
      </div>
    </div>
  );
}