// GET /api/admin/users — 用户列表（admin）
import { NextRequest, NextResponse } from 'next/server'
import { verifyJwt } from '@shared/lib/auth/jwt'
import { authConfig } from '@/lib/auth-config'
import { dbQueryParams } from '@/lib/db'
import { hasPermission } from '@/lib/permissions'

export async function GET(request: NextRequest) {
  const token = request.cookies.get('tlyq_session')?.value
  if (!token) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  const payload = verifyJwt(token, authConfig.jwtSecret)
  if (!payload || !hasPermission(String(payload.role || 'viewer'), 'users:view')) {
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
  }

  const { searchParams } = new URL(request.url)
  const username = searchParams.get('username') || ''
  const role = searchParams.get('role') || ''

  let where = 'WHERE 1=1'
  const params: unknown[] = []
  if (username) {
    where += ' AND username LIKE ?'
    params.push(`%${username}%`)
  }
  if (role) {
    where += ' AND role = ?'
    params.push(role)
  }

  const rows = dbQueryParams(`SELECT id, username, display_name, email, role, is_active, last_login_at FROM users ${where} ORDER BY id`, params)
  return NextResponse.json(rows)
}