feat: enhance OKR management by adding permission checks for editing and deleting, and updating OKR forms to handle key results more effectively

src/app/api/okrs/[id]/route.ts

@@ -25,7 +25,19 @@ export async function GET(request: Request, { params }: { params: Promise<{ id:
       return NextResponse.json({ error: 'Accès refusé' }, { status: 403 });
     }
 
-    return NextResponse.json(okr);
+    // Check permissions
+    const isAdmin = await isTeamAdmin(okr.teamMember.team.id, session.user.id);
+    const isConcernedMember = okr.teamMember.userId === session.user.id;
+
+    return NextResponse.json({
+      ...okr,
+      permissions: {
+        isAdmin,
+        isConcernedMember,
+        canEdit: isAdmin || isConcernedMember,
+        canDelete: isAdmin,
+      },
+    });
   } catch (error) {
     console.error('Error fetching OKR:', error);
     return NextResponse.json(
@@ -49,13 +61,22 @@ export async function PATCH(request: Request, { params }: { params: Promise<{ id
       return NextResponse.json({ error: 'OKR non trouvé' }, { status: 404 });
     }
 
-    // Check if user is admin of the team
+    // Check if user is admin of the team or the concerned member
     const isAdmin = await isTeamAdmin(okr.teamMember.team.id, session.user.id);
-    if (!isAdmin) {
-      return NextResponse.json({ error: 'Seuls les administrateurs peuvent modifier les OKRs' }, { status: 403 });
+    const isConcernedMember = okr.teamMember.userId === session.user.id;
+    if (!isAdmin && !isConcernedMember) {
+      return NextResponse.json({ error: 'Seuls les administrateurs et le membre concerné peuvent modifier les OKRs' }, { status: 403 });
     }
 
-    const body: UpdateOKRInput & { startDate?: string; endDate?: string } = await request.json();
+    const body: UpdateOKRInput & { 
+      startDate?: string; 
+      endDate?: string;
+      keyResultsUpdates?: {
+        create?: Array<{ title: string; targetValue: number; unit: string; order: number }>;
+        update?: Array<{ id: string; title?: string; targetValue?: number; unit?: string; order?: number }>;
+        delete?: string[];
+      };
+    } = await request.json();
     
     // Convert date strings to Date objects if provided
     const updateData: UpdateOKRInput = { ...body };
@@ -66,7 +87,17 @@ export async function PATCH(request: Request, { params }: { params: Promise<{ id
       updateData.endDate = new Date(body.endDate);
     }
 
-    const updated = await updateOKR(id, updateData);
+    // Remove keyResultsUpdates from updateData as it's not part of UpdateOKRInput
+    const { keyResultsUpdates, ...okrUpdateData } = body;
+    const finalUpdateData: UpdateOKRInput = { ...okrUpdateData };
+    if (finalUpdateData.startDate) {
+      finalUpdateData.startDate = new Date(finalUpdateData.startDate as any);
+    }
+    if (finalUpdateData.endDate) {
+      finalUpdateData.endDate = new Date(finalUpdateData.endDate as any);
+    }
+
+    const updated = await updateOKR(id, finalUpdateData, keyResultsUpdates);
 
     return NextResponse.json(updated);
   } catch (error: any) {