# Task 2 - Backend API Routes for ScamChecker BD

## Summary
Created all 16 API routes for the ScamChecker BD platform backend.

## Files Created

### Auth Routes
1. `src/app/api/auth/register/route.ts` - POST: User registration with email, name, password; hashes password; checks duplicate email
2. `src/app/api/auth/login/route.ts` - POST: User login with email/password; checks banned status; returns token
3. `src/app/api/auth/me/route.ts` - GET: Get current user by userId query param

### Reports Routes
4. `src/app/api/reports/route.ts` - GET (paginated list with filters) + POST (create report with linked entities, evidence, risk score updates)
5. `src/app/api/reports/[id]/route.ts` - GET: Single report detail with evidence, linked entities, reporter info; increments view count
6. `src/app/api/reports/[id]/upvote/route.ts` - POST: Upvote a report

### Other Routes
7. `src/app/api/upload/route.ts` - POST: Upload image evidence (png/jpg/jpeg/webp, max 5MB)
8. `src/app/api/search/route.ts` - GET: Global search across linked entities and report fields, grouped by entity
9. `src/app/api/analytics/route.ts` - GET: Dashboard analytics (totals, top categories/districts, daily trends, risk distribution)
10. `src/app/api/categories/route.ts` - GET: All active scam categories ordered by order field

### Admin Routes
11. `src/app/api/admin/reports/route.ts` - GET: Admin paginated report list with reporter info
12. `src/app/api/admin/reports/[id]/route.ts` - PATCH: Update report status with admin log and risk score recalculation
13. `src/app/api/admin/users/route.ts` - GET: Admin paginated user list with report counts
14. `src/app/api/admin/users/[id]/route.ts` - PATCH: Ban/unban user with admin log

### Seed Route
15. `src/app/api/seed/route.ts` - POST: Seeds database with 9 categories, admin user, sample users, 10 reports with evidence and linked entities, and risk scores

## Key Implementation Details
- All routes use `import { db } from '@/lib/db'` for Prisma database access
- Consistent JSON response format: `{ success: true, data: ... }` or `{ success: false, error: ... }`
- Route params parsed from URL: `request.url.split('/').pop()`
- Risk engine integration: `updateRiskScore()` called on report creation and admin status changes
- Password hashing with `hashPassword()` and `compare()` from auth-utils
- Admin routes verify admin role before allowing operations
- Admin log entries created for status changes and user bans

## Test Results
- All API endpoints tested successfully via curl
- `bun run lint` passes with no errors
- Seed endpoint creates 9 categories, 3 users, 10 reports, 27 risk scores
