From 24929494a665b9e21c2c970304a66cc9ec55ed9f Mon Sep 17 00:00:00 2001
From: DanielS <daniel.schumacher@caspos.de>
Date: Thu, 25 Jun 2026 01:33:38 +0200
Subject: [PATCH] feat: check for existing orders before user deletion and
 offer to lock instead

---
 shop/components/admin/user-list.tsx |  8 +++++++-
 shop/lib/actions/users.ts           | 15 +++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/shop/components/admin/user-list.tsx b/shop/components/admin/user-list.tsx
index 8d0e0f4..76795c8 100644
--- a/shop/components/admin/user-list.tsx
+++ b/shop/components/admin/user-list.tsx
@@ -64,7 +64,13 @@ export function UserList({ initialUsers, companies }: UserListProps) {
         router.refresh()
       } catch (e: any) {
         console.error('Fehler beim Löschen des Benutzers:', e)
-        alert('Fehler beim Löschen: ' + (e.message || JSON.stringify(e)))
+        if (e.message?.includes('Belege')) {
+          if (confirm('Auf diesen User gibt es bereits Belege. Sperren möglich. Möchten Sie diesen Benutzer stattdessen sperren?')) {
+            await handleRoleChange(id, 'gesperrt')
+          }
+        } else {
+          alert('Fehler beim Löschen: ' + (e.message || JSON.stringify(e)))
+        }
       } finally {
         setLoadingId(null)
       }
diff --git a/shop/lib/actions/users.ts b/shop/lib/actions/users.ts
index 604af44..c946090 100644
--- a/shop/lib/actions/users.ts
+++ b/shop/lib/actions/users.ts
@@ -92,6 +92,21 @@ export async function createUser(data: { email: string; role?: 'admin' | 'partne
 export async function deleteUser(id: string) {
   try {
     const admin = createAdminClient();
+    
+    // Check if user has orders (documents/belege)
+    const { count, error: countError } = await admin
+      .from('orders')
+      .select('*', { count: 'exact', head: true })
+      .eq('user_id', id);
+      
+    if (countError) {
+      console.error('Failed to count user orders:', countError);
+    }
+    
+    if (count && count > 0) {
+      throw new Error('Auf diesen User gibt es bereits Belege. Sperren möglich.');
+    }
+    
     // Delete from public.users first to satisfy foreign key constraints
     const { error: dbError } = await admin.from('users').delete().eq('id', id);
     if (dbError) {