POST /api/loyalty/rules

curl -X POST https://your-domain.com/api/loyalty/rules \
  -H "Content-Type: application/json" \
  -H "Cookie: your-session-cookie" \
  -d '{
    "locationId": "location-madrid-centro-uuid",
    "rules": [
      {
        "tier_id": "tier-bronce-uuid",
        "min_spend": 0,
        "min_visits": 0
      },
      {
        "tier_id": "tier-plata-uuid",
        "min_spend": 500,
        "min_visits": 5
      },
      {
        "tier_id": "tier-oro-uuid",
        "min_spend": 1500,
        "min_visits": 12
      },
      {
        "tier_id": "tier-vip-uuid",
        "min_spend": 3000,
        "min_visits": 25
      }
    ]
  }'

{
  "success": true
}

{
  "error": "No autorizado"
}

{
  "error": "Datos incompletos"
}

{
  "error": "No autorizado para esta ubicación"
}

{
  "error": "Database error message"
}

const { data: profile } = await supabase
  .from('profiles')
  .select('organization_id')
  .eq('id', user.id)
  .single();

const { data: location } = await supabase
  .from('locations')
  .select('organization_id')
  .eq('id', locationId)
  .single();

if (location?.organization_id !== profile?.organization_id) {
  return NextResponse.json(
    { error: "No autorizado para esta ubicación" },
    { status: 403 }
  );
}

for (const rule of rules) {
  await supabase
    .from('loyalty_rules')
    .upsert({
      location_id: locationId,
      tier_id: rule.tier_id,
      min_spend: rule.min_spend || 0,
      min_visits: rule.min_visits || 0
    }, { 
      onConflict: 'location_id,tier_id'
    });
}