Legal257 Finance Platform

import { NextRequest, NextResponse } from "next/server";
import { getUserRoleAndAssignment } from "@/lib/auth";

export async function verifyDocumentAccess(req: NextRequest, documentId: string, userId: string) {
  const user = await getUserRoleAndAssignment(userId);
  
  if (user.role === "admin") return true;
  
  if (user.role === "advisor") {
    // Check if advisor is assigned to the case containing the target document
    const isAssigned = await checkIfAssigned(userId, documentId);
    return isAssigned;
  }
  
  if (user.role === "client") {
    // Check if client owns the target document
    const isOwner = await checkIfOwner(userId, documentId);
    return isOwner;
  }
  
  return false;
}

import { db } from "./db";

export async function logAuditEvent(userId: string, eventType: string, details: string) {
  await db.query(
    `INSERT INTO audit_logs (user_id, event_type, details, logged_at) 
     VALUES ($1, $2, $3, NOW())`,
    [userId, eventType, details]
  );
}