peworkshop/app/(main)/team/[teamId]/members/route.js

import { query } from "../../../../lib/db";
import { cookies } from "next/headers";
import { verifyToken } from "@/app/api/auth/[...nextauth]/route";

export async function GET(request, context) {
  // Use cookie-based verification instead of getServerSession
  const cookieStore = await cookies();
  const sessionToken =
    cookieStore.get("next-auth.session-token")?.value ||
    cookieStore.get("__Secure-next-auth.session-token")?.value;

  if (!sessionToken) {
    return Response.json({ error: "Unauthorized" }, { status: 401 });
  }

  const userData = verifyToken(sessionToken);
  if (!userData) {
    return Response.json({ error: "Invalid session" }, { status: 401 });
  }

  try {
    const { teamId } = context.params;

    // Convert teamId to number for proper comparison
    const requestedTeamId = parseInt(teamId, 10);
    const userTeamId = parseInt(userData.teamId, 10);

    // Log for debugging
    console.log("Requested team:", requestedTeamId);
    console.log("User team:", userTeamId);
    console.log("User role:", userData.role);

    // Ensure the user is requesting their own team or is an admin
    if (userTeamId !== requestedTeamId && userData.role !== "admin") {
      return Response.json(
        { error: "Not authorized to view this team" },
        { status: 403 }
      );
    }

    const teamMembers = await query("SELECT * FROM users WHERE team_id = ?", [
      requestedTeamId,
    ]);

    if (!teamMembers) {
      return Response.json(
        { error: "Team members not found" },
        { status: 404 }
      );
    }

    return Response.json(teamMembers);
  } catch (error) {
    console.error("Team members fetch error:", error);
    return Response.json(
      { error: "Failed to fetch team members" },
      { status: 500 }
    );
  }
}