ok_r/app/api/templates/route.ts

import { NextRequest, NextResponse } from 'next/server';
import { supabase } from '@/lib/supabase';
import { ensureAdmin, ensureAuthenticated, getAuthContext } from '@/lib/access-control';

export async function GET(request: NextRequest) {
  const ctx = await getAuthContext(request);
  const auth = ensureAuthenticated(ctx);
  if (!auth.ok) {
    return NextResponse.json({ error: auth.error }, { status: auth.status });
  }

  const { searchParams } = new URL(request.url);
  const activeOnly = searchParams.get('active_only') === 'true';
  const projectType = searchParams.get('project_type');

  let query = supabase.from('templates').select('*').order('name', { ascending: true });

  if (!ctx!.isAdmin || activeOnly) query = query.eq('is_active', true);
  if (projectType) query = query.eq('project_type', projectType);

  const { data, error } = await query;

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
  }

  return NextResponse.json(data);
}

export async function POST(request: NextRequest) {
  const ctx = await getAuthContext(request);
  const auth = ensureAdmin(ctx);
  if (!auth.ok) {
    return NextResponse.json({ error: auth.error }, { status: auth.status });
  }

  const body = await request.json();
  const { name, description, project_type, tags, items } = body;

  if (!name || !items || items.length === 0) {
    return NextResponse.json({ error: '名称和至少一个模板项为必填项' }, { status: 400 });
  }

  const { data, error } = await supabase
    .from('templates')
    .insert({
      name,
      description,
      project_type,
      tags: tags || [],
      items,
      is_active: true,
    })
    .select()
    .single();

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
  }

  return NextResponse.json(data, { status: 201 });
}