feat: implement user authentication and authorization with NextAuth, including user schema, password hashing, and role-based access control.

src/features/snapshots/api/delete-snapshot.ts

@@ -2,11 +2,20 @@
 
 import { db } from "@/db";
 import { sessionSnapshots } from "@/db/schema";
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
+import { auth } from "@/lib/auth";
 
 export async function deleteSnapshot(id: number) {
+    const session = await auth();
+    const userId = session?.user ? Number((session.user as any).id) : null;
+
+    if (!userId) {
+        return { success: false, error: "Non autorisé" };
+    }
+
     try {
-        await db.delete(sessionSnapshots).where(eq(sessionSnapshots.id, id));
+        await db.delete(sessionSnapshots)
+            .where(and(eq(sessionSnapshots.id, id), eq(sessionSnapshots.userId, userId)));
         return { success: true };
     } catch (err) {
         console.error(err);

src/features/snapshots/api/get-snapshots.ts

@@ -2,14 +2,20 @@
 
 import { db } from "@/db";
 import { sessionSnapshots } from "@/db/schema";
-import { desc, eq } from "drizzle-orm";
+import { auth } from "@/lib/auth";
+import { and, desc, eq } from "drizzle-orm";
 
 export async function getSnapshots(type?: "snapshot" | "export") {
-    let query = db.select().from(sessionSnapshots);
+    const session = await auth();
+    const userId = session?.user ? Number((session.user as any).id) : null;
 
-    if (type) {
-        // @ts-ignore - type column added dynamically
-        return query.where(eq(sessionSnapshots.type, type)).orderBy(desc(sessionSnapshots.createdAt));
+    let query = db.select().from(sessionSnapshots);
+    const conditions = [];
+    if (userId) conditions.push(eq(sessionSnapshots.userId, userId));
+    if (type) conditions.push(eq(sessionSnapshots.type, type));
+
+    if (conditions.length > 0) {
+        return query.where(and(...conditions)).orderBy(desc(sessionSnapshots.createdAt));
     }
 
     return query.orderBy(desc(sessionSnapshots.createdAt));

src/features/snapshots/api/save-snapshot.ts

@@ -3,7 +3,8 @@
 import { db } from "@/db";
 import { sessionSnapshots } from "@/db/schema";
 import { z } from "zod";
-import { sql } from "drizzle-orm";
+import { sql, and, eq } from "drizzle-orm";
+import { auth } from "@/lib/auth";
 
 const SaveSnapshotSchema = z.object({
     codeFournisseur: z.string(),
@@ -31,11 +32,14 @@ export async function saveSnapshot(raw: unknown) {
     }
 
     const { codeFournisseur, nomFournisseur, magasin, label, changes, summary, type } = parsed.data;
+    const session = await auth();
+    const userId = session?.user ? Number((session.user as any).id) : null;
 
     try {
         const [created] = await db
             .insert(sessionSnapshots)
             .values({
+                userId,
                 codeFournisseur,
                 nomFournisseur: nomFournisseur ?? null,
                 magasin,
@@ -55,6 +59,7 @@ export async function saveSnapshot(raw: unknown) {
             await db.execute(sql`
                 CREATE TABLE IF NOT EXISTS session_snapshots (
                     id SERIAL PRIMARY KEY,
+                    user_id INTEGER,
                     code_fournisseur VARCHAR(20) NOT NULL,
                     nom_fournisseur VARCHAR(255),
                     magasin VARCHAR(20) NOT NULL,
@@ -66,17 +71,19 @@ export async function saveSnapshot(raw: unknown) {
                 );
             `);
 
-            // Si la table existait déjà mais sans la colonne 'type', on l'ajoute
+            // Si la table existait déjà mais sans la colonne 'type' ou 'user_id', on les ajoute
             try {
                 await db.execute(sql`ALTER TABLE session_snapshots ADD COLUMN IF NOT EXISTS type VARCHAR(20) DEFAULT 'snapshot'`);
+                await db.execute(sql`ALTER TABLE session_snapshots ADD COLUMN IF NOT EXISTS user_id INTEGER`);
             } catch (e) {
-                // Ignore if column already exists or other alter errors
+                // Ignore
             }
 
             // Deuxième tentative d'insertion
             const [retryCreated] = await db
                 .insert(sessionSnapshots)
                 .values({
+                    userId,
                     codeFournisseur,
                     nomFournisseur: nomFournisseur ?? null,
                     magasin,