customerUsers.js

Go to the documentation of this file.

/**
 * @file customerUsers.js
 * @description Customer Portal User Management Routes
 * 
 * Provides admin interface for managing customer portal users. Allows MSP/tenant admins
 * to create, view, update, and delete customer portal login accounts.
 * 
 * **Permission Model:**
 * - Admin only: All operations require admin role
 * - Tenant isolation: Admins can only manage users in their tenant
 * - Root MSP: Can manage users across all tenants
 * 
 * **Features:**
 * - Create customer portal users with bcrypt password hashing
 * - Reset passwords (admin-initiated)
 * - Toggle user active status (soft delete)
 * - List users by customer
 * - Update user details
 * 
 * **Security:**
 * - Passwords hashed with bcrypt (10 rounds)
 * - Email uniqueness enforced globally
 * - Audit logging for all actions
 * - Admin-only access with tenant filtering
 * 
 * @module routes/customerUsers
 * @requires express
 * @requires bcrypt
 * @requires services/db
 * @requires middleware/auth
 * @requires middleware/tenant
 * @author Independent Business Group
 * @since 1.0.0
 * @see module:routes/portalAuth
 * @see module:routes/portalCustomer
 */
 
const express = require('express');
const router = express.Router();
const bcrypt = require('bcrypt');
const pool = require('../services/db');
const authenticateToken = require('../middleware/auth');
const { setTenantContext } = require('../middleware/tenant');
 
/**
 * @api {get} /customer-users List Customer Portal Users
 * @apiName ListCustomerUsers
 * @apiGroup CustomerPortalUsers
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Returns all portal users for specified customer. Admin only.
 * Filtered by tenant for non-root users.
 * 
 * @apiPermission admin
 * 
 * @apiHeader {String} Authorization Bearer JWT token (admin required)
 * 
 * @apiParam {Number} customer_id Customer ID (query parameter, required)
 * 
 * @apiSuccess {Object[]} users Array of customer portal users
 * @apiSuccess {Number} users.customer_user_id User ID
 * @apiSuccess {Number} users.customer_id Customer ID
 * @apiSuccess {String} users.email Email address (login username)
 * @apiSuccess {String} users.first_name First name
 * @apiSuccess {String} users.last_name Last name
 * @apiSuccess {String} users.phone Phone number
 * @apiSuccess {Boolean} users.is_primary Primary contact flag
 * @apiSuccess {Boolean} users.is_active Account active status
 * @apiSuccess {Date} users.last_login Last login timestamp
 * @apiSuccess {Date} users.created_at Account creation timestamp
 * @apiSuccess {String} users.customer_name Customer name
 * @apiSuccess {String} users.tenant_name Tenant name
 * 
 * @apiError (400) {String} error customer_id is required
 * @apiError (403) {String} error Admin access required
 * @apiError (404) {String} error Customer not found or access denied
 * @apiError (500) {String} error Failed to fetch customer users
 * 
 * @apiExample {curl} Example Request:
 *   curl -X GET \
 *        -H "Authorization: Bearer eyJhbGc..." \
 *        "https://api.everydaytech.au/customer-users?customer_id=123"
 * 
 * @apiSuccessExample {json} Success Response:
 *   HTTP/1.1 200 OK
 *   {
 *     "users": [
 *       {
 *         "customer_user_id": 45,
 *         "customer_id": 123,
 *         "email": "user@example.com",
 *         "first_name": "John",
 *         "last_name": "Doe",
 *         "phone": "1234567890",
 *         "is_primary": true,
 *         "is_active": true,
 *         "last_login": "2026-03-23T02:30:00Z",
 *         "created_at": "2026-03-20T10:00:00Z",
 *         "customer_name": "Acme Corp",
 *         "tenant_name": "IBG MSP"
 *       }
 *     ]
 *   }
 */
router.get('/', authenticateToken, setTenantContext, async (req, res) => {
    try {
        // Admin only
        if (!req.user || req.user.role !== 'admin') {
            return res.status(403).json({ error: 'Admin access required' });
        }
 
        const { customer_id } = req.query;
 
        if (!customer_id) {
            return res.status(400).json({ error: 'customer_id is required' });
        }
 
        // Verify customer exists and belongs to tenant
        let customerCheck;
        if (req.tenant?.isMsp) {
            customerCheck = await pool.query(
                'SELECT customer_id FROM customers WHERE customer_id = $1',
                [customer_id]
            );
        } else {
            customerCheck = await pool.query(
                'SELECT customer_id FROM customers WHERE customer_id = $1 AND tenant_id = $2',
                [customer_id, req.tenant?.id || req.user?.tenantId]
            );
        }
 
        if (customerCheck.rows.length === 0) {
            return res.status(404).json({ error: 'Customer not found or access denied' });
        }
 
        // Get customer portal users
        const result = await pool.query(
            `SELECT 
                cu.customer_user_id,
                cu.customer_id,
                cu.email,
                cu.first_name,
                cu.last_name,
                cu.phone,
                cu.is_primary,
                cu.is_active,
                cu.last_login,
                cu.created_at,
                c.name as customer_name,
                t.name as tenant_name
             FROM customer_users cu
             JOIN customers c ON cu.customer_id = c.customer_id
             JOIN tenants t ON cu.tenant_id = t.tenant_id
             WHERE cu.customer_id = $1
             ORDER BY cu.is_primary DESC, cu.created_at ASC`,
            [customer_id]
        );
 
        res.json({ users: result.rows });
    } catch (err) {
        console.error('Error fetching customer users:', err);
        res.status(500).json({ error: 'Failed to fetch customer users' });
    }
});
 
/**
 * @api {post} /customer-users Create Customer Portal User
 * @apiName CreateCustomerUser
 * @apiGroup CustomerPortalUsers
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Creates portal login for customer. Admin only.
 * Password is bcrypt-hashed. Sets tenant_id from customer record.
 * Logs creation to customer_audit_log.
 * 
 * @apiPermission admin
 * 
 * @apiHeader {String} Authorization Bearer JWT token (admin required)
 * @apiHeader {String} Content-Type application/json
 * 
 * @apiParam {Number} customer_id Customer ID (required)
 * @apiParam {String} email Email address (required, unique globally)
 * @apiParam {String} password Plain text password (required, will be hashed)
 * @apiParam {String} [first_name] First name (optional)
 * @apiParam {String} [last_name] Last name (optional)
 * @apiParam {String} [phone] Phone number (optional)
 * @apiParam {Boolean} [is_primary=false] Set as primary contact
 * 
 * @apiSuccess (201) {Number} customer_user_id Generated user ID
 * @apiSuccess (201) {String} tenant_id Tenant UUID
 * @apiSuccess (201) {Number} customer_id Customer ID
 * @apiSuccess (201) {String} email Email address
 * @apiSuccess (201) {String} first_name First name
 * @apiSuccess (201) {String} last_name Last name
 * @apiSuccess (201) {String} phone Phone number
 * @apiSuccess (201) {Boolean} is_primary Primary flag
 * @apiSuccess (201) {Boolean} is_active Active status (always true)
 * @apiSuccess (201) {Date} created_at Creation timestamp
 * 
 * @apiError (400) {String} error customer_id, email, and password are required
 * @apiError (403) {String} error Admin access required
 * @apiError (404) {String} error Customer not found or access denied
 * @apiError (409) {String} error Email already exists
 * @apiError (500) {String} error Failed to create customer user
 * 
 * @apiExample {curl} Example Request:
 *   curl -X POST \
 *        -H "Authorization: Bearer eyJhbGc..." \
 *        -H "Content-Type: application/json" \
 *        -d '{
 *          "customer_id": 123,
 *          "email": "user@example.com",
 *          "password": "SecurePass123",
 *          "first_name": "John",
 *          "last_name": "Doe"
 *        }' \
 *        "https://api.everydaytech.au/customer-users"
 * 
 * @apiSuccessExample {json} Success Response:
 *   HTTP/1.1 201 Created
 *   {
 *     "customer_user_id": 45,
 *     "tenant_id": "...",
 *     "customer_id": 123,
 *     "email": "user@example.com",
 *     "first_name": "John",
 *     "last_name": "Doe",
 *     "phone": null,
 *     "is_primary": false,
 *     "is_active": true,
 *     "created_at": "2026-03-23T02:30:00Z"
 *   }
 */
router.post('/', authenticateToken, setTenantContext, async (req, res) => {
    try {
        // Admin only
        if (!req.user || req.user.role !== 'admin') {
            return res.status(403).json({ error: 'Admin access required' });
        }
 
        const { 
            customer_id, 
            email, 
            password, 
            first_name, 
            last_name, 
            phone, 
            is_primary 
        } = req.body;
 
        // Validation
        if (!customer_id || !email || !password) {
            return res.status(400).json({ 
                error: 'customer_id, email, and password are required' 
            });
        }
 
        // Verify customer exists and belongs to tenant
        let customerCheck;
        if (req.tenant?.isMsp) {
            customerCheck = await pool.query(
                'SELECT customer_id, tenant_id FROM customers WHERE customer_id = $1',
                [customer_id]
            );
        } else {
            customerCheck = await pool.query(
                'SELECT customer_id, tenant_id FROM customers WHERE customer_id = $1 AND tenant_id = $2',
                [customer_id, req.tenant?.id || req.user?.tenantId]
            );
        }
 
        if (customerCheck.rows.length === 0) {
            return res.status(404).json({ error: 'Customer not found or access denied' });
        }
 
        const tenantId = customerCheck.rows[0].tenant_id;
 
        // Check if email already exists
        const emailCheck = await pool.query(
            'SELECT customer_user_id FROM customer_users WHERE email = $1',
            [email.toLowerCase()]
        );
 
        if (emailCheck.rows.length > 0) {
            return res.status(409).json({ error: 'Email already exists' });
        }
 
        // Hash password
        const passwordHash = await bcrypt.hash(password, 10);
 
        // Create customer user
        const result = await pool.query(
            `INSERT INTO customer_users 
                (tenant_id, customer_id, email, password_hash, first_name, last_name, phone, is_primary, is_active)
             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, true)
             RETURNING 
                customer_user_id, 
                tenant_id, 
                customer_id, 
                email, 
                first_name, 
                last_name, 
                phone, 
                is_primary, 
                is_active, 
                created_at`,
            [
                tenantId,
                customer_id,
                email.toLowerCase(),
                passwordHash,
                first_name || null,
                last_name || null,
                phone || null,
                is_primary || false
            ]
        );
 
        // Log action to customer audit log
        await pool.query(
            `INSERT INTO customer_audit_log 
                (customer_user_id, tenant_id, action, resource_type, resource_id, details)
             VALUES ($1, $2, 'create', 'customer_user', $3, $4)`,
            [
                req.user.userId,
                tenantId,
                result.rows[0].customer_user_id,
                JSON.stringify({ 
                    email: email.toLowerCase(), 
                    customer_id,
                    created_by_admin: req.user.email 
                })
            ]
        );
 
        res.status(201).json(result.rows[0]);
    } catch (err) {
        console.error('Error creating customer user:', err);
        
        if (err.code === '23505') { // Unique violation
            return res.status(409).json({ error: 'Email already exists' });
        }
        
        res.status(500).json({ error: 'Failed to create customer user' });
    }
});
 
/**
 * @api {put} /customer-users/:id Update Customer Portal User
 * @apiName UpdateCustomerUser
 * @apiGroup CustomerPortalUsers
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Updates user details. Admin only. Cannot update password via this endpoint
 * (use /reset-password instead). Logs changes to customer_audit_log.
 * 
 * @apiPermission admin
 * 
 * @apiHeader {String} Authorization Bearer JWT token (admin required)
 * @apiHeader {String} Content-Type application/json
 * 
 * @apiParam {Number} id User ID (URL parameter)
 * @apiParam {String} [first_name] First name
 * @apiParam {String} [last_name] Last name
 * @apiParam {String} [phone] Phone number
 * @apiParam {String} [email] Email address (must be unique)
 * 
 * @apiSuccess {Number} customer_user_id User ID
 * @apiSuccess {String} tenant_id Tenant UUID
 * @apiSuccess {Number} customer_id Customer ID
 * @apiSuccess {String} email Email address
 * @apiSuccess {String} first_name First name
 * @apiSuccess {String} last_name Last name
 * @apiSuccess {String} phone Phone number
 * @apiSuccess {Boolean} is_primary Primary flag
 * @apiSuccess {Boolean} is_active Active status
 * @apiSuccess {Date} updated_at Update timestamp
 * 
 * @apiError (400) {String} error No fields to update
 * @apiError (403) {String} error Admin access required
 * @apiError (404) {String} error User not found or access denied
 * @apiError (409) {String} error Email already exists
 * @apiError (500) {String} error Failed to update customer user
 */
router.put('/:id', authenticateToken, setTenantContext, async (req, res) => {
    try {
        // Admin only
        if (!req.user || req.user.role !== 'admin') {
            return res.status(403).json({ error: 'Admin access required' });
        }
 
        const { id } = req.params;
        const { first_name, last_name, phone, email } = req.body;
 
        // Verify user exists and belongs to tenant
        let userCheck;
        if (req.tenant?.isMsp) {
            userCheck = await pool.query(
                'SELECT customer_user_id, tenant_id, customer_id FROM customer_users WHERE customer_user_id = $1',
                [id]
            );
        } else {
            userCheck = await pool.query(
                'SELECT customer_user_id, tenant_id, customer_id FROM customer_users WHERE customer_user_id = $1 AND tenant_id = $2',
                [id, req.tenant?.id || req.user?.tenantId]
            );
        }
 
        if (userCheck.rows.length === 0) {
            return res.status(404).json({ error: 'User not found or access denied' });
        }
 
        // If email is being changed, verify it's unique
        if (email && email !== userCheck.rows[0].email) {
            const emailCheck = await pool.query(
                'SELECT customer_user_id FROM customer_users WHERE email = $1 AND customer_user_id != $2',
                [email.toLowerCase(), id]
            );
 
            if (emailCheck.rows.length > 0) {
                return res.status(409).json({ error: 'Email already exists' });
            }
        }
 
        // Build update query dynamically
        const updates = [];
        const values = [];
        let paramCount = 1;
 
        if (first_name !== undefined) {
            updates.push(`first_name = $${paramCount++}`);
            values.push(first_name);
        }
        if (last_name !== undefined) {
            updates.push(`last_name = $${paramCount++}`);
            values.push(last_name);
        }
        if (phone !== undefined) {
            updates.push(`phone = $${paramCount++}`);
            values.push(phone);
        }
        if (email !== undefined) {
            updates.push(`email = $${paramCount++}`);
            values.push(email.toLowerCase());
        }
 
        if (updates.length === 0) {
            return res.status(400).json({ error: 'No fields to update' });
        }
 
        updates.push(`updated_at = NOW()`);
        values.push(id);
 
        const result = await pool.query(
            `UPDATE customer_users 
             SET ${updates.join(', ')}
             WHERE customer_user_id = $${paramCount}
             RETURNING 
                customer_user_id, 
                tenant_id, 
                customer_id, 
                email, 
                first_name, 
                last_name, 
                phone, 
                is_primary, 
                is_active, 
                updated_at`,
            values
        );
 
        // Log action
        await pool.query(
            `INSERT INTO customer_audit_log 
                (customer_user_id, tenant_id, action, resource_type, resource_id, details)
             VALUES ($1, $2, 'update', 'customer_user', $3, $4)`,
            [
                req.user.userId,
                userCheck.rows[0].tenant_id,
                id,
                JSON.stringify({ 
                    updated_by_admin: req.user.email,
                    changes: { first_name, last_name, phone, email }
                })
            ]
        );
 
        res.json(result.rows[0]);
    } catch (err) {
        console.error('Error updating customer user:', err);
        
        if (err.code === '23505') {
            return res.status(409).json({ error: 'Email already exists' });
        }
        
        res.status(500).json({ error: 'Failed to update customer user' });
    }
});
 
/**
 * @api {post} /customer-users/:id/reset-password Reset Customer Password
 * @apiName ResetCustomerUserPassword
 * @apiGroup CustomerPortalUsers
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Admin-initiated password reset. Allows admin to reset customer user password
 * without knowing current password. Password is bcrypt-hashed. Logs action to
 * customer_audit_log.
 * 
 * @apiPermission admin
 * 
 * @apiHeader {String} Authorization Bearer JWT token (admin required)
 * @apiHeader {String} Content-Type application/json
 * 
 * @apiParam {Number} id User ID (URL parameter)
 * @apiParam {String} new_password New plain text password (required, will be hashed)
 * 
 * @apiSuccess {Boolean} success Operation status (true)
 * @apiSuccess {String} message Success message
 * 
 * @apiError (400) {String} error new_password is required
 * @apiError (403) {String} error Admin access required
 * @apiError (404) {String} error User not found or access denied
 * @apiError (500) {String} error Failed to reset password
 * 
 * @apiExample {curl} Example Request:
 *   curl -X POST \
 *        -H "Authorization: Bearer eyJhbGc..." \
 *        -H "Content-Type: application/json" \
 *        -d '{"new_password": "NewSecure456"}' \
 *        "https://api.everydaytech.au/customer-users/45/reset-password"
 */
router.post('/:id/reset-password', authenticateToken, setTenantContext, async (req, res) => {
    try {
        // Admin only
        if (!req.user || req.user.role !== 'admin') {
            return res.status(403).json({ error: 'Admin access required' });
        }
 
        const { id } = req.params;
        const { new_password } = req.body;
 
        if (!new_password) {
            return res.status(400).json({ error: 'new_password is required' });
        }
 
        // Verify user exists and belongs to tenant
        let userCheck;
        if (req.tenant?.isMsp) {
            userCheck = await pool.query(
                'SELECT customer_user_id, tenant_id, customer_id, email FROM customer_users WHERE customer_user_id = $1',
                [id]
            );
        } else {
            userCheck = await pool.query(
                'SELECT customer_user_id, tenant_id, customer_id, email FROM customer_users WHERE customer_user_id = $1 AND tenant_id = $2',
                [id, req.tenant?.id || req.user?.tenantId]
            );
        }
 
        if (userCheck.rows.length === 0) {
            return res.status(404).json({ error: 'User not found or access denied' });
        }
 
        // Hash new password
        const passwordHash = await bcrypt.hash(new_password, 10);
 
        // Update password
        await pool.query(
            'UPDATE customer_users SET password_hash = $1, updated_at = NOW() WHERE customer_user_id = $2',
            [passwordHash, id]
        );
 
        // Log action
        await pool.query(
            `INSERT INTO customer_audit_log 
                (customer_user_id, tenant_id, action, resource_type, resource_id, details)
             VALUES ($1, $2, 'password_reset', 'customer_user', $3, $4)`,
            [
                req.user.userId,
                userCheck.rows[0].tenant_id,
                id,
                JSON.stringify({ 
                    reset_by_admin: req.user.email,
                    user_email: userCheck.rows[0].email,
                    timestamp: new Date().toISOString()
                })
            ]
        );
 
        res.json({ 
            success: true, 
            message: 'Password reset successfully' 
        });
    } catch (err) {
        console.error('Error resetting password:', err);
        res.status(500).json({ error: 'Failed to reset password' });
    }
});
 
/**
 * @api {put} /customer-users/:id/status Toggle User Active Status
 * @apiName ToggleCustomerUserStatus
 * @apiGroup CustomerPortalUsers
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Toggle user active status. Admin only. Soft delete - disables login without
 * deleting user data. Can be reversed. Logs action to customer_audit_log.
 * 
 * @apiPermission admin
 * 
 * @apiHeader {String} Authorization Bearer JWT token (admin required)
 * @apiHeader {String} Content-Type application/json
 * 
 * @apiParam {Number} id User ID (URL parameter)
 * @apiParam {Boolean} is_active Active status (true=enable, false=disable)
 * 
 * @apiSuccess {Number} customer_user_id User ID
 * @apiSuccess {String} email Email address
 * @apiSuccess {Boolean} is_active New active status
 * 
 * @apiError (400) {String} error is_active is required
 * @apiError (403) {String} error Admin access required
 * @apiError (404) {String} error User not found or access denied
 * @apiError (500) {String} error Failed to update user status
 */
router.put('/:id/status', authenticateToken, setTenantContext, async (req, res) => {
    try {
        // Admin only
        if (!req.user || req.user.role !== 'admin') {
            return res.status(403).json({ error: 'Admin access required' });
        }
 
        const { id } = req.params;
        const { is_active } = req.body;
 
        if (is_active === undefined) {
            return res.status(400).json({ error: 'is_active is required' });
        }
 
        // Verify user exists and belongs to tenant
        let userCheck;
        if (req.tenant?.isMsp) {
            userCheck = await pool.query(
                'SELECT customer_user_id, tenant_id, email FROM customer_users WHERE customer_user_id = $1',
                [id]
            );
        } else {
            userCheck = await pool.query(
                'SELECT customer_user_id, tenant_id, email FROM customer_users WHERE customer_user_id = $1 AND tenant_id = $2',
                [id, req.tenant?.id || req.user?.tenantId]
            );
        }
 
        if (userCheck.rows.length === 0) {
            return res.status(404).json({ error: 'User not found or access denied' });
        }
 
        // Update status
        const result = await pool.query(
            `UPDATE customer_users 
             SET is_active = $1, updated_at = NOW() 
             WHERE customer_user_id = $2
             RETURNING 
                customer_user_id, 
                email, 
                is_active`,
            [is_active, id]
        );
 
        // Log action
        await pool.query(
            `INSERT INTO customer_audit_log 
                (customer_user_id, tenant_id, action, resource_type, resource_id, details)
             VALUES ($1, $2, $3, 'customer_user', $4, $5)`,
            [
                req.user.userId,
                userCheck.rows[0].tenant_id,
                is_active ? 'activate' : 'deactivate',
                id,
                JSON.stringify({ 
                    changed_by_admin: req.user.email,
                    user_email: userCheck.rows[0].email,
                    new_status: is_active
                })
            ]
        );
 
        res.json(result.rows[0]);
    } catch (err) {
        console.error('Error updating user status:', err);
        res.status(500).json({ error: 'Failed to update user status' });
    }
});
 
/**
 * @api {delete} /customer-users/:id Delete Customer Portal User
 * @apiName DeleteCustomerUser
 * @apiGroup CustomerPortalUsers
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Permanently delete customer portal user. Admin only. Hard delete - removes
 * user and all associated sessions. **Use with caution** - prefer deactivation
 * (is_active = false) instead. Logs deletion to customer_audit_log before removal.
 * 
 * @apiPermission admin
 * 
 * @apiHeader {String} Authorization Bearer JWT token (admin required)
 * 
 * @apiParam {Number} id User ID (URL parameter)
 * 
 * @apiSuccess {Boolean} success Operation status (true)
 * @apiSuccess {String} message Success message
 * 
 * @apiError (403) {String} error Admin access required
 * @apiError (404) {String} error User not found or access denied
 * @apiError (500) {String} error Failed to delete customer user
 * 
 * @apiExample {curl} Example Request:
 *   curl -X DELETE \
 *        -H "Authorization: Bearer eyJhbGc..." \
 *        "https://api.everydaytech.au/customer-users/45"
 */
router.delete('/:id', authenticateToken, setTenantContext, async (req, res) => {
    try {
        // Admin only
        if (!req.user || req.user.role !== 'admin') {
            return res.status(403).json({ error: 'Admin access required' });
        }
 
        const { id } = req.params;
 
        // Verify user exists and belongs to tenant
        let userCheck;
        if (req.tenant?.isMsp) {
            userCheck = await pool.query(
                'SELECT customer_user_id, tenant_id, email, customer_id FROM customer_users WHERE customer_user_id = $1',
                [id]
            );
        } else {
            userCheck = await pool.query(
                'SELECT customer_user_id, tenant_id, email, customer_id FROM customer_users WHERE customer_user_id = $1 AND tenant_id = $2',
                [id, req.tenant?.id || req.user?.tenantId]
            );
        }
 
        if (userCheck.rows.length === 0) {
            return res.status(404).json({ error: 'User not found or access denied' });
        }
 
        const user = userCheck.rows[0];
 
        // Log action before deletion
        await pool.query(
            `INSERT INTO customer_audit_log 
                (customer_user_id, tenant_id, action, resource_type, resource_id, details)
             VALUES ($1, $2, 'delete', 'customer_user', $3, $4)`,
            [
                req.user.userId,
                user.tenant_id,
                id,
                JSON.stringify({ 
                    deleted_by_admin: req.user.email,
                    user_email: user.email,
                    customer_id: user.customer_id
                })
            ]
        );
 
        // Delete user (cascade will delete sessions)
        await pool.query(
            'DELETE FROM customer_users WHERE customer_user_id = $1',
            [id]
        );
 
        res.json({ 
            success: true, 
            message: 'Customer user deleted successfully' 
        });
    } catch (err) {
        console.error('Error deleting customer user:', err);
        res.status(500).json({ error: 'Failed to delete customer user' });
    }
});
 
module.exports = router;