feat: Implement admin dashboard with user management, statistics, and role-based access control.

lib/admin-stats.ts

@@ -0,0 +1,81 @@
+import { unstable_cache } from 'next/cache';
+import { db } from '@/lib/db';
+import { r2Client, R2_BUCKET_NAME } from '@/lib/r2';
+import { ListObjectsV2Command } from '@aws-sdk/client-s3';
+
+// Cache for 10 minutes (600 seconds)
+export const getCachedTotalStorage = unstable_cache(
+    async () => {
+        let totalStorageBytes = 0;
+        try {
+            let isTruncated = true;
+            let continuationToken: string | undefined = undefined;
+
+            while (isTruncated) {
+                const commandParams: any = { Bucket: R2_BUCKET_NAME };
+                if (continuationToken) commandParams.ContinuationToken = continuationToken;
+
+                const data = await r2Client.send(new ListObjectsV2Command(commandParams));
+                if (data.Contents) {
+                    for (const item of data.Contents) {
+                        totalStorageBytes += item.Size || 0;
+                    }
+                }
+                isTruncated = data.IsTruncated ?? false;
+                continuationToken = data.NextContinuationToken;
+            }
+        } catch (err) {
+            console.error('Failed to fetch total storage stats:', err);
+            return -1;
+        }
+        return totalStorageBytes;
+    },
+    ['admin-total-storage'],
+    { revalidate: 600 }
+);
+
+export const getCachedUserVoiceStorage = unstable_cache(
+    async () => {
+        // Return a plain object so it maps cleanly out of unstable_cache across requests
+        const userStorage: Record<string, number> = {};
+        try {
+            const fileSizes = new Map<string, number>();
+            let isTruncated = true;
+            let continuationToken: string | undefined = undefined;
+
+            while (isTruncated) {
+                const commandParams: any = { Bucket: R2_BUCKET_NAME };
+                if (continuationToken) commandParams.ContinuationToken = continuationToken;
+
+                const data = await r2Client.send(new ListObjectsV2Command(commandParams));
+                if (data.Contents) {
+                    for (const item of data.Contents) {
+                        if (item.Key) fileSizes.set(item.Key, item.Size || 0);
+                    }
+                }
+                isTruncated = data.IsTruncated ?? false;
+                continuationToken = data.NextContinuationToken;
+            }
+
+            const voiceComments = await db.comment.findMany({
+                where: { voiceUrl: { not: null }, authorId: { not: null } },
+                select: { authorId: true, voiceUrl: true }
+            });
+
+            for (const comment of voiceComments) {
+                if (!comment.authorId || !comment.voiceUrl) continue;
+                const keyParts = comment.voiceUrl.split('/');
+                const filename = keyParts[keyParts.length - 1];
+                const r2Key = `voice/${filename}`;
+                const size = fileSizes.get(r2Key) || 0;
+
+                userStorage[comment.authorId] = (userStorage[comment.authorId] || 0) + size;
+            }
+        } catch (err) {
+            console.error('Failed to parse user storage:', err);
+        }
+        return userStorage;
+    },
+    ['admin-user-voice-storage'],
+    { revalidate: 600 }
+);

lib/auth.ts

@@ -63,6 +63,7 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
       if (token.sub && session.user) {
         session.user.id = token.sub;
         session.user.name = token.name || null;
+        session.user.isAdmin = token.isAdmin as boolean;
       }
       return session;
     },
@@ -70,7 +71,17 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
       if (user) {
         token.sub = user.id;
         token.name = user.name;
+        token.email = user.email; // explicitly ensure email is in the token
       }
+
+      // Check if user is admin based on emails list on EVERY request to ensure env changes are picked up
+      if (token.email) {
+        const adminEmails = process.env.ADMIN_EMAILS
+          ? process.env.ADMIN_EMAILS.split(',').map((e: string) => e.trim().toLowerCase())
+          : [];
+        token.isAdmin = adminEmails.includes((token.email as string).toLowerCase());
+      }
+
       return token;
     },
   },
@@ -87,8 +98,8 @@ export async function checkProjectAccess(
   // Get project membership
   const projectMember = userId
     ? await db.projectMember.findUnique({
-        where: { projectId_userId: { projectId: project.id, userId } },
-      })
+      where: { projectId_userId: { projectId: project.id, userId } },
+    })
     : null;
   const isProjectMember = !!projectMember;
   const isProjectAdmin = projectMember?.role === ProjectMemberRole.ADMIN;
@@ -138,8 +149,8 @@ export async function checkWorkspaceAccess(
   // Get workspace membership
   const workspaceMember = userId
     ? await db.workspaceMember.findUnique({
-        where: { workspaceId_userId: { workspaceId: workspace.id, userId } },
-      })
+      where: { workspaceId_userId: { workspaceId: workspace.id, userId } },
+    })
     : null;
   const isMember = !!workspaceMember;
   const isAdmin = workspaceMember?.role === WorkspaceMemberRole.ADMIN;