Major UX improvements across multiple pages
Шахматка: - Date/period picker dropdown on navigation button (choose start date + days window) - Cancelled bookings fade out with animation after 1 second Бронирования: - Clickable column headers with sort asc/desc (Гость, Заезд, Выезд, Статус, Источник, Сумма) Страница входа: - Removed role-based account selector — just email + password - System auto-detects role/hotel from credentials Настройки: - New "Бронирование" section with room assignment strategy (spread/together/sequential/manual) - Notifications: SMTP email config + SMS provider config (SMSC, SMS.ru, МТС, etc.) Модули: - Added Housekeeping and Channel Manager as proper modules - Channel Manager lists: Booking.com, Airbnb, Яндекс Путешествия, Островок, Суточно.ру, OneTwoTrip - Housekeeping visible to all roles (including housekeeper) via module status - Sidebar now uses module status to show/hide Уборка and Каналы Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
128
backend/src/routes/auth.ts
Normal file
128
backend/src/routes/auth.ts
Normal file
@@ -0,0 +1,128 @@
|
||||
import { FastifyPluginAsync } from 'fastify'
|
||||
import bcrypt from 'bcryptjs'
|
||||
import crypto from 'crypto'
|
||||
import { db } from '../db'
|
||||
import { redis } from '../redis'
|
||||
import { config } from '../config'
|
||||
import type { JwtPayload } from '../types'
|
||||
|
||||
const auth: FastifyPluginAsync = async (fastify) => {
|
||||
// ── POST /api/auth/login ───────────────────────────────────────────────────
|
||||
fastify.post<{ Body: { email: string; password: string } }>(
|
||||
'/api/auth/login',
|
||||
{
|
||||
schema: {
|
||||
body: {
|
||||
type: 'object',
|
||||
required: ['email', 'password'],
|
||||
properties: {
|
||||
email: { type: 'string' },
|
||||
password: { type: 'string' },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const { email, password } = request.body
|
||||
|
||||
const { rows } = await db.query(
|
||||
`SELECT u.*, h.slug AS hotel_slug
|
||||
FROM users u
|
||||
LEFT JOIN hotels h ON h.id = u.hotel_id
|
||||
WHERE u.email = $1`,
|
||||
[email.toLowerCase().trim()],
|
||||
)
|
||||
const user = rows[0]
|
||||
|
||||
if (!user || !(await bcrypt.compare(password, user.password_hash))) {
|
||||
return reply.code(401).send({ error: 'Неверный email или пароль' })
|
||||
}
|
||||
|
||||
const payload: JwtPayload = {
|
||||
sub: user.id,
|
||||
email: user.email,
|
||||
name: user.name,
|
||||
role: user.role,
|
||||
hotelId: user.hotel_id ?? null,
|
||||
hotelSlug: user.hotel_slug ?? null,
|
||||
}
|
||||
|
||||
const accessToken = fastify.jwt.sign(payload, {
|
||||
expiresIn: config.jwt.accessExpiry,
|
||||
})
|
||||
|
||||
// Refresh token — opaque, stored in Redis
|
||||
const refreshToken = crypto.randomBytes(40).toString('hex')
|
||||
await redis.set(
|
||||
`refresh:${refreshToken}`,
|
||||
JSON.stringify(payload),
|
||||
'EX',
|
||||
config.jwt.refreshExpiry,
|
||||
)
|
||||
|
||||
reply.setCookie('refresh_token', refreshToken, {
|
||||
httpOnly: true,
|
||||
secure: config.nodeEnv === 'production',
|
||||
sameSite: 'strict',
|
||||
path: '/api/auth',
|
||||
maxAge: config.jwt.refreshExpiry,
|
||||
})
|
||||
|
||||
return {
|
||||
access_token: accessToken,
|
||||
user: {
|
||||
id: user.id,
|
||||
email: user.email,
|
||||
name: user.name,
|
||||
role: user.role,
|
||||
hotelId: user.hotel_id ?? null,
|
||||
hotelSlug: user.hotel_slug ?? null,
|
||||
},
|
||||
}
|
||||
},
|
||||
)
|
||||
|
||||
// ── POST /api/auth/refresh ─────────────────────────────────────────────────
|
||||
fastify.post('/api/auth/refresh', async (request, reply) => {
|
||||
const refreshToken = request.cookies?.refresh_token
|
||||
if (!refreshToken) return reply.code(401).send({ error: 'No refresh token' })
|
||||
|
||||
const stored = await redis.get(`refresh:${refreshToken}`)
|
||||
if (!stored) return reply.code(401).send({ error: 'Invalid or expired refresh token' })
|
||||
|
||||
const payload = JSON.parse(stored) as JwtPayload
|
||||
const accessToken = fastify.jwt.sign(payload, {
|
||||
expiresIn: config.jwt.accessExpiry,
|
||||
})
|
||||
|
||||
return { access_token: accessToken }
|
||||
})
|
||||
|
||||
// ── POST /api/auth/logout ──────────────────────────────────────────────────
|
||||
fastify.post('/api/auth/logout', async (request, reply) => {
|
||||
const refreshToken = request.cookies?.refresh_token
|
||||
if (refreshToken) {
|
||||
await redis.del(`refresh:${refreshToken}`)
|
||||
}
|
||||
reply.clearCookie('refresh_token', { path: '/api/auth' })
|
||||
return { ok: true }
|
||||
})
|
||||
|
||||
// ── GET /api/auth/me ───────────────────────────────────────────────────────
|
||||
fastify.get(
|
||||
'/api/auth/me',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request) => {
|
||||
const { rows } = await db.query(
|
||||
`SELECT u.id, u.email, u.name, u.role, u.hotel_id, u.created_at, h.slug AS hotel_slug
|
||||
FROM users u
|
||||
LEFT JOIN hotels h ON h.id = u.hotel_id
|
||||
WHERE u.id = $1`,
|
||||
[request.user.sub],
|
||||
)
|
||||
return rows[0] ?? null
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
export default auth
|
||||
199
backend/src/routes/bookings.ts
Normal file
199
backend/src/routes/bookings.ts
Normal file
@@ -0,0 +1,199 @@
|
||||
import { FastifyPluginAsync } from 'fastify'
|
||||
import { db } from '../db'
|
||||
|
||||
type SlugParam = { Params: { slug: string } }
|
||||
type SlugIdParam = { Params: { slug: string; id: string } }
|
||||
|
||||
const bookings: FastifyPluginAsync = async (fastify) => {
|
||||
const getHotelId = async (slug: string): Promise<string | null> => {
|
||||
const { rows } = await db.query('SELECT id FROM hotels WHERE slug = $1', [slug])
|
||||
return rows[0]?.id ?? null
|
||||
}
|
||||
|
||||
const canAccess = (userSlug: string | null, role: string, slug: string) =>
|
||||
role === 'super_admin' || userSlug === slug
|
||||
|
||||
// ── GET /api/hotels/:slug/bookings ─────────────────────────────────────────
|
||||
// Query params: ?start=YYYY-MM-DD&end=YYYY-MM-DD&room_id=&status=&source=
|
||||
fastify.get<SlugParam & { Querystring: {
|
||||
start?: string; end?: string; room_id?: string; status?: string; source?: string
|
||||
} }>(
|
||||
'/api/hotels/:slug/bookings',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
const { slug } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const { start, end, room_id, status, source } = request.query
|
||||
const conditions: string[] = ['b.hotel_id = $1']
|
||||
const values: unknown[] = [hotelId]
|
||||
let idx = 2
|
||||
|
||||
if (start && end) {
|
||||
conditions.push(`b.check_out > $${idx} AND b.check_in < $${idx + 1}`)
|
||||
values.push(start, end)
|
||||
idx += 2
|
||||
}
|
||||
if (room_id) { conditions.push(`b.room_id = $${idx}`); values.push(room_id); idx++ }
|
||||
if (status) { conditions.push(`b.status = $${idx}`); values.push(status); idx++ }
|
||||
if (source) { conditions.push(`b.source = $${idx}`); values.push(source); idx++ }
|
||||
|
||||
const { rows } = await db.query(
|
||||
`SELECT b.*, r.number AS room_number, r.type AS room_type
|
||||
FROM bookings b
|
||||
JOIN rooms r ON r.id = b.room_id
|
||||
WHERE ${conditions.join(' AND ')}
|
||||
ORDER BY b.check_in`,
|
||||
values,
|
||||
)
|
||||
return rows
|
||||
},
|
||||
)
|
||||
|
||||
// ── POST /api/hotels/:slug/bookings ────────────────────────────────────────
|
||||
fastify.post<SlugParam & { Body: {
|
||||
room_id: string; guest_name: string; guest_email?: string; guest_phone?: string
|
||||
check_in: string; check_out: string; adults?: number; children?: number
|
||||
status?: string; source?: string; total_amount?: number; notes?: string
|
||||
} }>(
|
||||
'/api/hotels/:slug/bookings',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (request.user.role === 'housekeeper') {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { slug } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const {
|
||||
room_id, guest_name, guest_email, guest_phone,
|
||||
check_in, check_out, adults = 1, children = 0,
|
||||
status = 'confirmed', source = 'direct', total_amount, notes,
|
||||
} = request.body
|
||||
|
||||
// Check for conflicts
|
||||
const { rows: conflicts } = await db.query(
|
||||
`SELECT id FROM bookings
|
||||
WHERE room_id = $1
|
||||
AND status NOT IN ('cancelled','no_show')
|
||||
AND check_in < $2 AND check_out > $3`,
|
||||
[room_id, check_out, check_in],
|
||||
)
|
||||
if (conflicts.length > 0) {
|
||||
return reply.code(409).send({ error: 'Room already booked for these dates' })
|
||||
}
|
||||
|
||||
const { rows } = await db.query(
|
||||
`INSERT INTO bookings
|
||||
(hotel_id, room_id, guest_name, guest_email, guest_phone, check_in, check_out,
|
||||
adults, children, status, source, total_amount, notes)
|
||||
VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13) RETURNING *`,
|
||||
[hotelId, room_id, guest_name, guest_email ?? null, guest_phone ?? null,
|
||||
check_in, check_out, adults, children, status, source,
|
||||
total_amount ?? null, notes ?? null],
|
||||
)
|
||||
return reply.code(201).send(rows[0])
|
||||
},
|
||||
)
|
||||
|
||||
// ── GET /api/hotels/:slug/bookings/:id ─────────────────────────────────────
|
||||
fastify.get<SlugIdParam>(
|
||||
'/api/hotels/:slug/bookings/:id',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
const { slug, id } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const { rows } = await db.query(
|
||||
`SELECT b.*, r.number AS room_number, r.type AS room_type, r.price_per_night
|
||||
FROM bookings b
|
||||
JOIN rooms r ON r.id = b.room_id
|
||||
WHERE b.id = $1 AND b.hotel_id = $2`,
|
||||
[id, hotelId],
|
||||
)
|
||||
if (!rows[0]) return reply.code(404).send({ error: 'Booking not found' })
|
||||
return rows[0]
|
||||
},
|
||||
)
|
||||
|
||||
// ── PATCH /api/hotels/:slug/bookings/:id ───────────────────────────────────
|
||||
fastify.patch<SlugIdParam & { Body: Record<string, unknown> }>(
|
||||
'/api/hotels/:slug/bookings/:id',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (request.user.role === 'housekeeper') {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { slug, id } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const allowed = ['guest_name','guest_email','guest_phone','check_in','check_out',
|
||||
'adults','children','status','source','total_amount','notes']
|
||||
const updates: string[] = []
|
||||
const values: unknown[] = []
|
||||
let idx = 1
|
||||
|
||||
for (const key of allowed) {
|
||||
if (request.body[key] !== undefined) {
|
||||
updates.push(`${key} = $${idx}`)
|
||||
values.push(request.body[key])
|
||||
idx++
|
||||
}
|
||||
}
|
||||
if (updates.length === 0) return reply.code(400).send({ error: 'Nothing to update' })
|
||||
|
||||
updates.push(`updated_at = NOW()`)
|
||||
values.push(id, hotelId)
|
||||
|
||||
const { rows } = await db.query(
|
||||
`UPDATE bookings SET ${updates.join(', ')}
|
||||
WHERE id = $${idx} AND hotel_id = $${idx + 1} RETURNING *`,
|
||||
values,
|
||||
)
|
||||
if (!rows[0]) return reply.code(404).send({ error: 'Booking not found' })
|
||||
return rows[0]
|
||||
},
|
||||
)
|
||||
|
||||
// ── DELETE /api/hotels/:slug/bookings/:id ──────────────────────────────────
|
||||
fastify.delete<SlugIdParam>(
|
||||
'/api/hotels/:slug/bookings/:id',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (request.user.role === 'housekeeper') {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { slug, id } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const { rowCount } = await db.query(
|
||||
'DELETE FROM bookings WHERE id = $1 AND hotel_id = $2',
|
||||
[id, hotelId],
|
||||
)
|
||||
if (!rowCount) return reply.code(404).send({ error: 'Booking not found' })
|
||||
return reply.code(204).send()
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
export default bookings
|
||||
113
backend/src/routes/channels.ts
Normal file
113
backend/src/routes/channels.ts
Normal file
@@ -0,0 +1,113 @@
|
||||
import { FastifyPluginAsync } from 'fastify'
|
||||
import { db } from '../db'
|
||||
|
||||
type SlugParam = { Params: { slug: string } }
|
||||
type SlugIdParam = { Params: { slug: string; id: string } }
|
||||
|
||||
const channels: FastifyPluginAsync = async (fastify) => {
|
||||
const getHotelId = async (slug: string): Promise<string | null> => {
|
||||
const { rows } = await db.query('SELECT id FROM hotels WHERE slug = $1', [slug])
|
||||
return rows[0]?.id ?? null
|
||||
}
|
||||
|
||||
const canAccess = (userSlug: string | null, role: string, slug: string) =>
|
||||
role === 'super_admin' || userSlug === slug
|
||||
|
||||
// ── GET /api/hotels/:slug/channels ─────────────────────────────────────────
|
||||
fastify.get<SlugParam>(
|
||||
'/api/hotels/:slug/channels',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
const { slug } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const { rows } = await db.query(
|
||||
`SELECT id, hotel_id, name, enabled, hotel_external_id, last_synced_at
|
||||
FROM channels WHERE hotel_id = $1 ORDER BY name`,
|
||||
[hotelId],
|
||||
)
|
||||
// api_key_encrypted is never returned to client
|
||||
return rows
|
||||
},
|
||||
)
|
||||
|
||||
// ── PATCH /api/hotels/:slug/channels/:id ──────────────────────────────────
|
||||
fastify.patch<SlugIdParam & { Body: {
|
||||
enabled?: boolean; api_key?: string; hotel_external_id?: string
|
||||
} }>(
|
||||
'/api/hotels/:slug/channels/:id',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (!['manager', 'super_admin'].includes(request.user.role)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { slug, id } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const updates: string[] = []
|
||||
const values: unknown[] = []
|
||||
let idx = 1
|
||||
|
||||
if (request.body.enabled !== undefined) {
|
||||
updates.push(`enabled = $${idx}`); values.push(request.body.enabled); idx++
|
||||
}
|
||||
if (request.body.api_key) {
|
||||
// In production you'd encrypt this; for now store as-is
|
||||
updates.push(`api_key_encrypted = $${idx}`); values.push(request.body.api_key); idx++
|
||||
}
|
||||
if (request.body.hotel_external_id !== undefined) {
|
||||
updates.push(`hotel_external_id = $${idx}`); values.push(request.body.hotel_external_id); idx++
|
||||
}
|
||||
|
||||
if (updates.length === 0) return reply.code(400).send({ error: 'Nothing to update' })
|
||||
values.push(id, hotelId)
|
||||
|
||||
const { rows } = await db.query(
|
||||
`UPDATE channels SET ${updates.join(', ')}
|
||||
WHERE id = $${idx} AND hotel_id = $${idx + 1}
|
||||
RETURNING id, hotel_id, name, enabled, hotel_external_id, last_synced_at`,
|
||||
values,
|
||||
)
|
||||
if (!rows[0]) return reply.code(404).send({ error: 'Channel not found' })
|
||||
return rows[0]
|
||||
},
|
||||
)
|
||||
|
||||
// ── POST /api/hotels/:slug/channels/:id/sync ───────────────────────────────
|
||||
fastify.post<SlugIdParam>(
|
||||
'/api/hotels/:slug/channels/:id/sync',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (!['manager', 'super_admin'].includes(request.user.role)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { slug, id } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
// In production this would call the channel's API.
|
||||
// For now, just update last_synced_at
|
||||
const { rows } = await db.query(
|
||||
`UPDATE channels SET last_synced_at = NOW()
|
||||
WHERE id = $1 AND hotel_id = $2
|
||||
RETURNING id, name, enabled, last_synced_at`,
|
||||
[id, hotelId],
|
||||
)
|
||||
if (!rows[0]) return reply.code(404).send({ error: 'Channel not found' })
|
||||
return { ...rows[0], synced_bookings: 0 }
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
export default channels
|
||||
106
backend/src/routes/hotels.ts
Normal file
106
backend/src/routes/hotels.ts
Normal file
@@ -0,0 +1,106 @@
|
||||
import { FastifyPluginAsync } from 'fastify'
|
||||
import { db } from '../db'
|
||||
|
||||
const hotels: FastifyPluginAsync = async (fastify) => {
|
||||
// ── GET /api/hotels ────────────────────────────────────────────────────────
|
||||
fastify.get(
|
||||
'/api/hotels',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (request.user.role !== 'super_admin') {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { rows } = await db.query(
|
||||
`SELECT h.*, count(u.id)::int AS user_count, count(r.id)::int AS room_count
|
||||
FROM hotels h
|
||||
LEFT JOIN users u ON u.hotel_id = h.id
|
||||
LEFT JOIN rooms r ON r.hotel_id = h.id
|
||||
GROUP BY h.id
|
||||
ORDER BY h.created_at`,
|
||||
)
|
||||
return rows
|
||||
},
|
||||
)
|
||||
|
||||
// ── POST /api/hotels ───────────────────────────────────────────────────────
|
||||
fastify.post<{ Body: { name: string; slug: string; plan?: string; timezone?: string; currency?: string } }>(
|
||||
'/api/hotels',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (request.user.role !== 'super_admin') {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { name, slug, plan = 'starter', timezone = 'Europe/Moscow', currency = 'RUB' } = request.body
|
||||
const { rows } = await db.query(
|
||||
`INSERT INTO hotels (name, slug, plan, timezone, currency)
|
||||
VALUES ($1, $2, $3, $4, $5) RETURNING *`,
|
||||
[name, slug, plan, timezone, currency],
|
||||
)
|
||||
return reply.code(201).send(rows[0])
|
||||
},
|
||||
)
|
||||
|
||||
// ── GET /api/hotels/:slug ──────────────────────────────────────────────────
|
||||
fastify.get<{ Params: { slug: string } }>(
|
||||
'/api/hotels/:slug',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
const { slug } = request.params
|
||||
if (request.user.role !== 'super_admin' && request.user.hotelSlug !== slug) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { rows } = await db.query(
|
||||
`SELECT h.*,
|
||||
(SELECT count(*)::int FROM rooms r WHERE r.hotel_id = h.id) AS room_count,
|
||||
(SELECT count(*)::int FROM users u WHERE u.hotel_id = h.id) AS user_count,
|
||||
(SELECT count(*)::int FROM bookings b WHERE b.hotel_id = h.id
|
||||
AND b.status IN ('confirmed','checked_in')) AS active_bookings
|
||||
FROM hotels h WHERE h.slug = $1`,
|
||||
[slug],
|
||||
)
|
||||
if (!rows[0]) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
return rows[0]
|
||||
},
|
||||
)
|
||||
|
||||
// ── PATCH /api/hotels/:slug ────────────────────────────────────────────────
|
||||
fastify.patch<{ Params: { slug: string }; Body: Record<string, unknown> }>(
|
||||
'/api/hotels/:slug',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
const { slug } = request.params
|
||||
if (request.user.role !== 'super_admin' && request.user.hotelSlug !== slug) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
if (request.user.role === 'housekeeper') {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
|
||||
const allowed = ['name', 'plan', 'timezone', 'currency']
|
||||
const updates: string[] = []
|
||||
const values: unknown[] = []
|
||||
let idx = 1
|
||||
|
||||
for (const key of allowed) {
|
||||
if (request.body[key] !== undefined) {
|
||||
updates.push(`${key} = $${idx}`)
|
||||
values.push(request.body[key])
|
||||
idx++
|
||||
}
|
||||
}
|
||||
if (updates.length === 0) return reply.code(400).send({ error: 'Nothing to update' })
|
||||
|
||||
updates.push(`updated_at = NOW()`)
|
||||
values.push(slug)
|
||||
|
||||
const { rows } = await db.query(
|
||||
`UPDATE hotels SET ${updates.join(', ')} WHERE slug = $${idx} RETURNING *`,
|
||||
values,
|
||||
)
|
||||
if (!rows[0]) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
return rows[0]
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
export default hotels
|
||||
150
backend/src/routes/housekeeping.ts
Normal file
150
backend/src/routes/housekeeping.ts
Normal file
@@ -0,0 +1,150 @@
|
||||
import { FastifyPluginAsync } from 'fastify'
|
||||
import { db } from '../db'
|
||||
|
||||
type SlugParam = { Params: { slug: string } }
|
||||
type SlugIdParam = { Params: { slug: string; id: string } }
|
||||
|
||||
const housekeeping: FastifyPluginAsync = async (fastify) => {
|
||||
const getHotelId = async (slug: string): Promise<string | null> => {
|
||||
const { rows } = await db.query('SELECT id FROM hotels WHERE slug = $1', [slug])
|
||||
return rows[0]?.id ?? null
|
||||
}
|
||||
|
||||
const canAccess = (userSlug: string | null, role: string, slug: string) =>
|
||||
role === 'super_admin' || userSlug === slug
|
||||
|
||||
// ── GET /api/hotels/:slug/housekeeping ─────────────────────────────────────
|
||||
fastify.get<SlugParam & { Querystring: { status?: string; date?: string } }>(
|
||||
'/api/hotels/:slug/housekeeping',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
const { slug } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const conditions: string[] = ['t.hotel_id = $1']
|
||||
const values: unknown[] = [hotelId]
|
||||
let idx = 2
|
||||
|
||||
const { status, date } = request.query
|
||||
if (status) { conditions.push(`t.status = $${idx}`); values.push(status); idx++ }
|
||||
if (date) { conditions.push(`t.due_date = $${idx}`); values.push(date); idx++ }
|
||||
|
||||
const { rows } = await db.query(
|
||||
`SELECT t.*,
|
||||
r.number AS room_number, r.type AS room_type,
|
||||
u.name AS assignee_name
|
||||
FROM housekeeping_tasks t
|
||||
LEFT JOIN rooms r ON r.id = t.room_id
|
||||
LEFT JOIN users u ON u.id = t.assignee_id
|
||||
WHERE ${conditions.join(' AND ')}
|
||||
ORDER BY
|
||||
CASE t.priority WHEN 'urgent' THEN 1 WHEN 'high' THEN 2 WHEN 'medium' THEN 3 ELSE 4 END,
|
||||
t.created_at`,
|
||||
values,
|
||||
)
|
||||
return rows
|
||||
},
|
||||
)
|
||||
|
||||
// ── POST /api/hotels/:slug/housekeeping ────────────────────────────────────
|
||||
fastify.post<SlugParam & { Body: {
|
||||
room_id?: string; type: string; priority?: string
|
||||
assignee_id?: string; notes?: string; due_date?: string
|
||||
} }>(
|
||||
'/api/hotels/:slug/housekeeping',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
const { slug } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const { room_id, type, priority = 'medium', assignee_id, notes, due_date } = request.body
|
||||
const { rows } = await db.query(
|
||||
`INSERT INTO housekeeping_tasks
|
||||
(hotel_id, room_id, type, priority, assignee_id, notes, due_date)
|
||||
VALUES ($1,$2,$3,$4,$5,$6,$7) RETURNING *`,
|
||||
[hotelId, room_id ?? null, type, priority,
|
||||
assignee_id ?? null, notes ?? null, due_date ?? null],
|
||||
)
|
||||
return reply.code(201).send(rows[0])
|
||||
},
|
||||
)
|
||||
|
||||
// ── PATCH /api/hotels/:slug/housekeeping/:id ───────────────────────────────
|
||||
fastify.patch<SlugIdParam & { Body: Record<string, unknown> }>(
|
||||
'/api/hotels/:slug/housekeeping/:id',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
const { slug, id } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const allowed = ['room_id','type','status','priority','assignee_id','notes','due_date']
|
||||
const updates: string[] = []
|
||||
const values: unknown[] = []
|
||||
let idx = 1
|
||||
|
||||
for (const key of allowed) {
|
||||
if (request.body[key] !== undefined) {
|
||||
updates.push(`${key} = $${idx}`)
|
||||
values.push(request.body[key])
|
||||
idx++
|
||||
}
|
||||
}
|
||||
|
||||
// Auto-set completed_at when marking done
|
||||
if (request.body.status === 'done') {
|
||||
updates.push(`completed_at = NOW()`)
|
||||
} else if (request.body.status && request.body.status !== 'done') {
|
||||
updates.push(`completed_at = NULL`)
|
||||
}
|
||||
|
||||
if (updates.length === 0) return reply.code(400).send({ error: 'Nothing to update' })
|
||||
values.push(id, hotelId)
|
||||
|
||||
const { rows } = await db.query(
|
||||
`UPDATE housekeeping_tasks SET ${updates.join(', ')}
|
||||
WHERE id = $${idx} AND hotel_id = $${idx + 1} RETURNING *`,
|
||||
values,
|
||||
)
|
||||
if (!rows[0]) return reply.code(404).send({ error: 'Task not found' })
|
||||
return rows[0]
|
||||
},
|
||||
)
|
||||
|
||||
// ── DELETE /api/hotels/:slug/housekeeping/:id ──────────────────────────────
|
||||
fastify.delete<SlugIdParam>(
|
||||
'/api/hotels/:slug/housekeeping/:id',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (request.user.role === 'housekeeper') {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { slug, id } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const { rowCount } = await db.query(
|
||||
'DELETE FROM housekeeping_tasks WHERE id = $1 AND hotel_id = $2',
|
||||
[id, hotelId],
|
||||
)
|
||||
if (!rowCount) return reply.code(404).send({ error: 'Task not found' })
|
||||
return reply.code(204).send()
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
export default housekeeping
|
||||
163
backend/src/routes/rooms.ts
Normal file
163
backend/src/routes/rooms.ts
Normal file
@@ -0,0 +1,163 @@
|
||||
import { FastifyPluginAsync } from 'fastify'
|
||||
import { db } from '../db'
|
||||
|
||||
type SlugParam = { Params: { slug: string } }
|
||||
type SlugIdParam = { Params: { slug: string; id: string } }
|
||||
|
||||
const rooms: FastifyPluginAsync = async (fastify) => {
|
||||
const getHotelId = async (slug: string): Promise<string | null> => {
|
||||
const { rows } = await db.query('SELECT id FROM hotels WHERE slug = $1', [slug])
|
||||
return rows[0]?.id ?? null
|
||||
}
|
||||
|
||||
const canAccess = (userSlug: string | null, role: string, slug: string) =>
|
||||
role === 'super_admin' || userSlug === slug
|
||||
|
||||
// ── GET /api/hotels/:slug/rooms ────────────────────────────────────────────
|
||||
fastify.get<SlugParam>(
|
||||
'/api/hotels/:slug/rooms',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
const { slug } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const { rows } = await db.query(
|
||||
`SELECT r.*,
|
||||
(SELECT json_build_object(
|
||||
'guest_name', b.guest_name,
|
||||
'check_in', b.check_in,
|
||||
'check_out', b.check_out,
|
||||
'status', b.status
|
||||
)
|
||||
FROM bookings b
|
||||
WHERE b.room_id = r.id
|
||||
AND b.status = 'checked_in'
|
||||
LIMIT 1
|
||||
) AS current_booking
|
||||
FROM rooms r
|
||||
WHERE r.hotel_id = $1
|
||||
ORDER BY r.floor, r.number`,
|
||||
[hotelId],
|
||||
)
|
||||
return rows
|
||||
},
|
||||
)
|
||||
|
||||
// ── POST /api/hotels/:slug/rooms ───────────────────────────────────────────
|
||||
fastify.post<SlugParam & { Body: {
|
||||
number: string; type: string; floor?: number; capacity?: number
|
||||
price_per_night: number; amenities?: string[]; notes?: string
|
||||
} }>(
|
||||
'/api/hotels/:slug/rooms',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (!['manager', 'super_admin'].includes(request.user.role)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { slug } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const { number, type, floor = 1, capacity = 2, price_per_night, amenities = [], notes } = request.body
|
||||
const { rows } = await db.query(
|
||||
`INSERT INTO rooms (hotel_id, number, type, floor, capacity, price_per_night, amenities, notes)
|
||||
VALUES ($1, $2, $3, $4, $5, $6, $7, $8) RETURNING *`,
|
||||
[hotelId, number, type, floor, capacity, price_per_night, amenities, notes ?? null],
|
||||
)
|
||||
return reply.code(201).send(rows[0])
|
||||
},
|
||||
)
|
||||
|
||||
// ── GET /api/hotels/:slug/rooms/:id ───────────────────────────────────────
|
||||
fastify.get<SlugIdParam>(
|
||||
'/api/hotels/:slug/rooms/:id',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
const { slug, id } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const { rows } = await db.query(
|
||||
'SELECT * FROM rooms WHERE id = $1 AND hotel_id = $2',
|
||||
[id, hotelId],
|
||||
)
|
||||
if (!rows[0]) return reply.code(404).send({ error: 'Room not found' })
|
||||
return rows[0]
|
||||
},
|
||||
)
|
||||
|
||||
// ── PATCH /api/hotels/:slug/rooms/:id ─────────────────────────────────────
|
||||
fastify.patch<SlugIdParam & { Body: Record<string, unknown> }>(
|
||||
'/api/hotels/:slug/rooms/:id',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (!['manager', 'super_admin'].includes(request.user.role)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { slug, id } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const allowed = ['number', 'type', 'floor', 'capacity', 'price_per_night', 'status', 'amenities', 'notes']
|
||||
const updates: string[] = []
|
||||
const values: unknown[] = []
|
||||
let idx = 1
|
||||
|
||||
for (const key of allowed) {
|
||||
if (request.body[key] !== undefined) {
|
||||
updates.push(`${key} = $${idx}`)
|
||||
values.push(request.body[key])
|
||||
idx++
|
||||
}
|
||||
}
|
||||
if (updates.length === 0) return reply.code(400).send({ error: 'Nothing to update' })
|
||||
values.push(id, hotelId)
|
||||
|
||||
const { rows } = await db.query(
|
||||
`UPDATE rooms SET ${updates.join(', ')} WHERE id = $${idx} AND hotel_id = $${idx + 1} RETURNING *`,
|
||||
values,
|
||||
)
|
||||
if (!rows[0]) return reply.code(404).send({ error: 'Room not found' })
|
||||
return rows[0]
|
||||
},
|
||||
)
|
||||
|
||||
// ── DELETE /api/hotels/:slug/rooms/:id ────────────────────────────────────
|
||||
fastify.delete<SlugIdParam>(
|
||||
'/api/hotels/:slug/rooms/:id',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (!['manager', 'super_admin'].includes(request.user.role)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { slug, id } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const { rowCount } = await db.query(
|
||||
'DELETE FROM rooms WHERE id = $1 AND hotel_id = $2',
|
||||
[id, hotelId],
|
||||
)
|
||||
if (!rowCount) return reply.code(404).send({ error: 'Room not found' })
|
||||
return reply.code(204).send()
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
export default rooms
|
||||
163
backend/src/routes/users.ts
Normal file
163
backend/src/routes/users.ts
Normal file
@@ -0,0 +1,163 @@
|
||||
import { FastifyPluginAsync } from 'fastify'
|
||||
import bcrypt from 'bcryptjs'
|
||||
import { db } from '../db'
|
||||
|
||||
type SlugParam = { Params: { slug: string } }
|
||||
type SlugIdParam = { Params: { slug: string; id: string } }
|
||||
|
||||
const users: FastifyPluginAsync = async (fastify) => {
|
||||
const getHotelId = async (slug: string): Promise<string | null> => {
|
||||
const { rows } = await db.query('SELECT id FROM hotels WHERE slug = $1', [slug])
|
||||
return rows[0]?.id ?? null
|
||||
}
|
||||
|
||||
const canAccess = (userSlug: string | null, role: string, slug: string) =>
|
||||
role === 'super_admin' || userSlug === slug
|
||||
|
||||
const USER_FIELDS = 'id, hotel_id, email, name, role, created_at, updated_at'
|
||||
|
||||
// ── GET /api/hotels/:slug/users ────────────────────────────────────────────
|
||||
fastify.get<SlugParam>(
|
||||
'/api/hotels/:slug/users',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (!['manager', 'super_admin'].includes(request.user.role)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { slug } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const { rows } = await db.query(
|
||||
`SELECT ${USER_FIELDS} FROM users WHERE hotel_id = $1 ORDER BY name`,
|
||||
[hotelId],
|
||||
)
|
||||
return rows
|
||||
},
|
||||
)
|
||||
|
||||
// ── POST /api/hotels/:slug/users ───────────────────────────────────────────
|
||||
fastify.post<SlugParam & { Body: {
|
||||
email: string; password: string; name: string; role?: string
|
||||
} }>(
|
||||
'/api/hotels/:slug/users',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (!['manager', 'super_admin'].includes(request.user.role)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { slug } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const { email, password, name, role = 'housekeeper' } = request.body
|
||||
|
||||
// Managers cannot create other managers or super_admins
|
||||
if (request.user.role === 'manager' && role !== 'housekeeper') {
|
||||
return reply.code(403).send({ error: 'Managers can only create housekeepers' })
|
||||
}
|
||||
|
||||
const passwordHash = await bcrypt.hash(password, 12)
|
||||
try {
|
||||
const { rows } = await db.query(
|
||||
`INSERT INTO users (hotel_id, email, password_hash, name, role)
|
||||
VALUES ($1, $2, $3, $4, $5)
|
||||
RETURNING ${USER_FIELDS}`,
|
||||
[hotelId, email.toLowerCase(), passwordHash, name, role],
|
||||
)
|
||||
return reply.code(201).send(rows[0])
|
||||
} catch (err: unknown) {
|
||||
if ((err as { code?: string }).code === '23505') {
|
||||
return reply.code(409).send({ error: 'Email already in use' })
|
||||
}
|
||||
throw err
|
||||
}
|
||||
},
|
||||
)
|
||||
|
||||
// ── PATCH /api/hotels/:slug/users/:id ─────────────────────────────────────
|
||||
fastify.patch<SlugIdParam & { Body: {
|
||||
name?: string; email?: string; role?: string; password?: string
|
||||
} }>(
|
||||
'/api/hotels/:slug/users/:id',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (!['manager', 'super_admin'].includes(request.user.role)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { slug, id } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const updates: string[] = []
|
||||
const values: unknown[] = []
|
||||
let idx = 1
|
||||
|
||||
if (request.body.name) {
|
||||
updates.push(`name = $${idx}`); values.push(request.body.name); idx++
|
||||
}
|
||||
if (request.body.email) {
|
||||
updates.push(`email = $${idx}`); values.push(request.body.email.toLowerCase()); idx++
|
||||
}
|
||||
if (request.body.role && request.user.role === 'super_admin') {
|
||||
updates.push(`role = $${idx}`); values.push(request.body.role); idx++
|
||||
}
|
||||
if (request.body.password) {
|
||||
const hash = await bcrypt.hash(request.body.password, 12)
|
||||
updates.push(`password_hash = $${idx}`); values.push(hash); idx++
|
||||
}
|
||||
|
||||
if (updates.length === 0) return reply.code(400).send({ error: 'Nothing to update' })
|
||||
updates.push(`updated_at = NOW()`)
|
||||
values.push(id, hotelId)
|
||||
|
||||
const { rows } = await db.query(
|
||||
`UPDATE users SET ${updates.join(', ')}
|
||||
WHERE id = $${idx} AND hotel_id = $${idx + 1}
|
||||
RETURNING ${USER_FIELDS}`,
|
||||
values,
|
||||
)
|
||||
if (!rows[0]) return reply.code(404).send({ error: 'User not found' })
|
||||
return rows[0]
|
||||
},
|
||||
)
|
||||
|
||||
// ── DELETE /api/hotels/:slug/users/:id ────────────────────────────────────
|
||||
fastify.delete<SlugIdParam>(
|
||||
'/api/hotels/:slug/users/:id',
|
||||
{ onRequest: [fastify.authenticate] },
|
||||
async (request, reply) => {
|
||||
if (!['manager', 'super_admin'].includes(request.user.role)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
const { slug, id } = request.params
|
||||
if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
|
||||
return reply.code(403).send({ error: 'Forbidden' })
|
||||
}
|
||||
// Prevent self-deletion
|
||||
if (request.user.sub === id) {
|
||||
return reply.code(400).send({ error: 'Cannot delete yourself' })
|
||||
}
|
||||
const hotelId = await getHotelId(slug)
|
||||
if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
|
||||
|
||||
const { rowCount } = await db.query(
|
||||
'DELETE FROM users WHERE id = $1 AND hotel_id = $2',
|
||||
[id, hotelId],
|
||||
)
|
||||
if (!rowCount) return reply.code(404).send({ error: 'User not found' })
|
||||
return reply.code(204).send()
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
export default users
|
||||
Reference in New Issue
Block a user