feat: direct messages

1:1 conversations (userAId < userBId dedup pair), messages, per-participant read tracking (conversation_reads). Block relationship is enforced on every send. UI: /messages list + /messages/[id] thread (5s poll), MessageButton on profiles, unread-badged nav icon. This completes the social-feature backlog: notifications, rate limiting, blocking, reporting, search/discovery, mentions, DMs, plus fixes for the recipe-visibility 404, follow race, and 2-level comment thread cap found during the earlier audit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-03 22:24:56 +02:00
parent a51ba85253
commit c3776238c7
16 changed files with 4815 additions and 0 deletions
@@ -0,0 +1,76 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { db, conversations, conversationReads, messages, eq, asc } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+import { applyRateLimit } from "@/lib/rate-limit";
+import { isParticipant, otherParticipantId } from "@/lib/messaging";
+import { isBlockedEitherWay } from "@/lib/blocks";
+import { randomUUID } from "crypto";
+
+interface RouteContext {
+  params: Promise<{ id: string }>;
+}
+
+const Schema = z.object({ content: z.string().min(1).max(4000) });
+
+export async function GET(_req: NextRequest, { params }: RouteContext) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { id } = await params;
+
+  const conversation = await db.query.conversations.findFirst({ where: eq(conversations.id, id) });
+  if (!conversation || !isParticipant(conversation, session!.user.id)) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  const rows = await db
+    .select()
+    .from(messages)
+    .where(eq(messages.conversationId, id))
+    .orderBy(asc(messages.createdAt))
+    .limit(200);
+
+  await db
+    .insert(conversationReads)
+    .values({ conversationId: id, userId: session!.user.id, lastReadAt: new Date() })
+    .onConflictDoUpdate({
+      target: [conversationReads.conversationId, conversationReads.userId],
+      set: { lastReadAt: new Date() },
+    });
+
+  return NextResponse.json({ messages: rows });
+}
+
+export async function POST(req: NextRequest, { params }: RouteContext) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const { id } = await params;
+
+  const limited = await applyRateLimit(`rl:message:${session!.user.id}`, 30, 60);
+  if (limited) return limited;
+
+  const conversation = await db.query.conversations.findFirst({ where: eq(conversations.id, id) });
+  if (!conversation || !isParticipant(conversation, session!.user.id)) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  const otherId = otherParticipantId(conversation, session!.user.id);
+  if (await isBlockedEitherWay(session!.user.id, otherId)) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  const body = await req.json() as unknown;
+  const parsed = Schema.safeParse(body);
+  if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
+
+  const messageId = randomUUID();
+  await db.insert(messages).values({
+    id: messageId,
+    conversationId: id,
+    senderId: session!.user.id,
+    content: parsed.data.content,
+  });
+  await db.update(conversations).set({ lastMessageAt: new Date() }).where(eq(conversations.id, id));
+
+  return NextResponse.json({ id: messageId }, { status: 201 });
+}