// /api/admin/users-by-category/route.ts import { type NextRequest, NextResponse } from "next/server" import { executeQuery } from "@/lib/database" export async function POST(request: NextRequest) { // This function uses POST method try { const { category } = await request.json() // Get category from request body if (!category) { return NextResponse.json({ error: "נתונים חסרים: קטגוריה" }, { status: 400 }) } let query = "" // Params array is still empty as there are no WHERE conditions that use parameters other than the in_shelter status itself. // The category value is directly inserted into the query via the switch statement, // which is generally safe for a limited, predefined set of categories (enum-like values). switch (category) { case "no_report": query = "SELECT national_id, name, department, team, field FROM users WHERE in_shelter IS NULL ORDER BY name" break case "in_shelter": query = "SELECT national_id, name, department, team, field FROM users WHERE in_shelter = 'yes' ORDER BY name" break case "not_in_shelter": query = "SELECT national_id, name, department, team, field FROM users WHERE in_shelter = 'no' ORDER BY name" break case "no_alarm": query = "SELECT national_id, name, department, team, field FROM users WHERE in_shelter = 'no_alarm' ORDER BY name" break case "safe_after_exit": query = "SELECT national_id, name, department, team, field FROM users WHERE in_shelter = 'safe_after_exit' ORDER BY name" break default: return NextResponse.json({ error: "קטגוריה לא תקינה" }, { status: 400 }) } const users = (await executeQuery(query)) as any[] // Execute query without explicit params if values are hardcoded return NextResponse.json(users) } catch (error) { console.error("Get users by category error:", error) return NextResponse.json({ error: "שגיאה בטעינת משתמשים לפי קטגוריה" }, { status: 500 }) } }