feat(ADM-018): completed feature

project/apps/admin/src/app/api/[...path]/route.ts

@@ -0,0 +1,99 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+const API = process.env.NEXT_PUBLIC_API_URL ?? 'http://127.0.0.1:3000';
+
+/**
+ * Catch-all proxy: forwards ALL requests to the backend API.
+ * This avoids CORS preflight issues since requests stay within the
+ * same origin (localhost:3004 -> localhost:3004 proxy -> 127.0.0.1:3000 backend).
+ *
+ * More specific routes (e.g. /api/auth/login) take precedence in Next.js,
+ * so they are NOT served by this handler.
+ */
+export async function GET(req: NextRequest) {
+  const path = req.nextUrl.pathname.replace('/api/', '');
+  const cookies = req.headers.get('cookie') ?? '';
+  try {
+    const backendRes = await fetch(`${API}/${path}`, {
+      headers: { Cookie: cookies },
+    });
+    const data = await backendRes.json().catch(() => null);
+    const resp = NextResponse.json(data ?? { error: 'Bad response' }, { status: backendRes.status });
+    return resp;
+  } catch {
+    return NextResponse.json({ error: 'Proxy error' }, { status: 502 });
+  }
+}
+
+export async function POST(req: NextRequest) {
+  const path = req.nextUrl.pathname.replace('/api/', '');
+  const cookies = req.headers.get('cookie') ?? '';
+  const body = await req.text();
+  try {
+    const backendRes = await fetch(`${API}/${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Cookie: cookies },
+      body,
+    });
+    const setCookie = backendRes.headers.get('set-cookie');
+    const data = await backendRes.json().catch(() => null);
+    const resp = NextResponse.json(data ?? { error: 'Bad response' }, { status: backendRes.status });
+    if (setCookie) {
+      resp.headers.set(
+        'Set-Cookie',
+        setCookie.replace(/;\s*Secure/gi, '').replace(/;\s*SameSite=Lax/gi, '').trim(),
+      );
+    }
+    return resp;
+  } catch {
+    return NextResponse.json({ error: 'Proxy error' }, { status: 502 });
+  }
+}
+
+export async function PATCH(req: NextRequest) {
+  const path = req.nextUrl.pathname.replace('/api/', '');
+  const cookies = req.headers.get('cookie') ?? '';
+  const body = await req.text();
+  try {
+    const backendRes = await fetch(`${API}/${path}`, {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json', Cookie: cookies },
+      body,
+    });
+    const data = await backendRes.json().catch(() => null);
+    return NextResponse.json(data ?? { error: 'Bad response' }, { status: backendRes.status });
+  } catch {
+    return NextResponse.json({ error: 'Proxy error' }, { status: 502 });
+  }
+}
+
+export async function PUT(req: NextRequest) {
+  const path = req.nextUrl.pathname.replace('/api/', '');
+  const cookies = req.headers.get('cookie') ?? '';
+  const body = await req.text();
+  try {
+    const backendRes = await fetch(`${API}/${path}`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json', Cookie: cookies },
+      body,
+    });
+    const data = await backendRes.json().catch(() => null);
+    return NextResponse.json(data ?? { error: 'Bad response' }, { status: backendRes.status });
+  } catch {
+    return NextResponse.json({ error: 'Proxy error' }, { status: 502 });
+  }
+}
+
+export async function DELETE(req: NextRequest) {
+  const path = req.nextUrl.pathname.replace('/api/', '');
+  const cookies = req.headers.get('cookie') ?? '';
+  try {
+    const backendRes = await fetch(`${API}/${path}`, {
+      method: 'DELETE',
+      headers: { Cookie: cookies },
+    });
+    return NextResponse.json({ ok: backendRes.ok }, { status: backendRes.status });
+  } catch {
+    return NextResponse.json({ error: 'Proxy error' }, { status: 502 });
+  }
+}

project/apps/admin/src/app/api/auth/login/route.ts

@@ -0,0 +1,46 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+const API = process.env.NEXT_PUBLIC_API_URL ?? 'http://127.0.0.1:3000';
+
+/**
+ * Strip the Secure flag from the backend's Set-Cookie so the browser
+ * (which connects over HTTP) actually stores the session cookie.
+ * Also drop SameSite=Lax to avoid browser restrictions.
+ */
+function makeLocalhostCompatible(cookie: string): string {
+  return cookie
+    .replace(/;\s*Secure/gi, '')
+    .replace(/;\s*SameSite=Lax/gi, '')
+    .trim();
+}
+
+export async function POST(req: NextRequest) {
+  try {
+    const body = await req.json();
+    const { email, password } = body;
+
+    const backendRes = await fetch(`${API}/auth/login`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email, password }),
+    });
+
+    const data = await backendRes.json();
+
+    if (!backendRes.ok) {
+      return NextResponse.json(data, { status: backendRes.status });
+    }
+
+    const setCookie = backendRes.headers.get('set-cookie');
+    const response = NextResponse.json(data, { status: 200 });
+    if (setCookie) {
+      response.headers.set('Set-Cookie', makeLocalhostCompatible(setCookie));
+    }
+    return response;
+  } catch {
+    return NextResponse.json(
+      { statusCode: 500, code: 'SERVER_ERROR', message: 'Error del servidor' },
+      { status: 500 },
+    );
+  }
+}

project/apps/admin/src/app/api/auth/logout/route.ts

@@ -0,0 +1,19 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+const API = process.env.NEXT_PUBLIC_API_URL ?? 'http://127.0.0.1:3000';
+
+export async function POST(req: NextRequest) {
+  try {
+    const cookies = req.headers.get('cookie') ?? '';
+    await fetch(`${API}/auth/logout`, {
+      method: 'POST',
+      headers: { Cookie: cookies },
+    });
+  } catch {
+    // Best-effort
+  }
+
+  const response = NextResponse.json({ ok: true });
+  response.cookies.delete('mdv_session');
+  return response;
+}

project/apps/admin/src/app/api/auth/me/route.ts

@@ -0,0 +1,16 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+const API = process.env.NEXT_PUBLIC_API_URL ?? 'http://127.0.0.1:3000';
+
+export async function GET(req: NextRequest) {
+  const cookies = req.headers.get('cookie') ?? '';
+  try {
+    const backendRes = await fetch(`${API}/auth/me`, {
+      headers: { Cookie: cookies },
+    });
+    if (!backendRes.ok) return NextResponse.json({ user: null });
+    return NextResponse.json(await backendRes.json());
+  } catch {
+    return NextResponse.json({ user: null });
+  }
+}

project/apps/admin/src/app/api/upload/route.ts

@@ -0,0 +1,44 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { writeFile, mkdir } from 'fs/promises';
+import path from 'path';
+
+const ALLOWED_TYPES = ['image/jpeg', 'image/png', 'image/webp', 'image/avif', 'image/gif'];
+const MAX_SIZE = 10 * 1024 * 1024; // 10MB
+
+export async function POST(request: NextRequest) {
+  try {
+    const formData = await request.formData();
+    const file = formData.get('file') as File | null;
+
+    if (!file) {
+      return NextResponse.json({ error: 'No file provided' }, { status: 400 });
+    }
+
+    if (!ALLOWED_TYPES.includes(file.type)) {
+      return NextResponse.json(
+        { error: `Tipo no permitido. Usa: ${ALLOWED_TYPES.join(', ')}` },
+        { status: 400 },
+      );
+    }
+
+    if (file.size > MAX_SIZE) {
+      return NextResponse.json({ error: 'El archivo excede 10MB' }, { status: 400 });
+    }
+
+    // Unique filename
+    const ext = file.name.split('.').pop() ?? 'jpg';
+    const filename = `${Date.now()}-${Math.random().toString(36).slice(2)}.${ext}`;
+    const uploadDir = path.join(process.cwd(), 'public', 'uploads');
+    const filePath = path.join(uploadDir, filename);
+
+    await mkdir(uploadDir, { recursive: true });
+    const buffer = Buffer.from(await file.arrayBuffer());
+    await writeFile(filePath, buffer);
+
+    const url = `/uploads/${filename}`;
+    return NextResponse.json({ url, filename, size: file.size });
+  } catch (error) {
+    console.error('Upload error:', error);
+    return NextResponse.json({ error: 'Error al subir el archivo' }, { status: 500 });
+  }
+}