/**
 * GET /api/users/search?q=... - Benutzer-Suche fuer die
 * Mitgliederverwaltung (nur ADMIN).
 *
 * DB-basierte Suche per E-Mail (case-insensitive, Teilstring).
 * Liefert maximal 8 Treffer mit E-Mail und ID; Passwort-Hashes und
 * andere sensible Felder werden niemals zurueckgegeben.
 */
import { NextRequest, NextResponse } from 'next/server';
import { prisma } from '@/lib/db/client';
import { requireDbUser } from '@/lib/api/context';
import { errorResponse, forbiddenResponse } from '@/lib/api/responses';

export async function GET(
  request: NextRequest,
): Promise<NextResponse> {
  try {
    const user = await requireDbUser();
    if (user.role !== 'ADMIN') {
      return forbiddenResponse();
    }

    const query = request.nextUrl.searchParams.get('q')?.trim() ?? '';
    if (query.length < 2) {
      return NextResponse.json({ users: [] });
    }

    const users = await prisma.user.findMany({
      where: {
        OR: [
          { email: { contains: query, mode: 'insensitive' } },
          { username: { contains: query, mode: 'insensitive' } },
        ],
      },
      orderBy: { email: 'asc' },
      take: 8,
      select: { id: true, email: true, username: true },
    });

    return NextResponse.json({ users });
  } catch (error) {
    return errorResponse(error);
  }
}