Arnaud
3e71bd29a2
Convert requireSession -> requireSessionOrApiKey across recipes, collections, meal-plans, shopping-lists, pantry, feed, and ai/* (52 routes) so API keys work end-to-end, not just for the handful of endpoints that supported them before. Scope was explicitly confirmed per-resource-family with the user before any file was touched. Left session-cookie-only, deliberately: users/me*, ai-keys/*, webhooks/*, conversations/*, notifications/*, push/subscribe, admin/* — account/credential-adjacent surface that shouldn't widen without a separate, explicit decision. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
44 lines
1.8 KiB
TypeScript
44 lines
1.8 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { z } from "zod";
|
|
import { db, pantryItems, eq, and } from "@epicure/db";
|
|
import { requireSessionOrApiKey } from "@/lib/api-auth";
|
|
|
|
type Params = { params: Promise<{ id: string }> };
|
|
|
|
export async function PUT(req: NextRequest, { params }: Params) {
|
|
const { session, response } = await requireSessionOrApiKey(req);
|
|
if (response) return response;
|
|
const { id } = await params;
|
|
|
|
const item = await db.query.pantryItems.findFirst({ where: and(eq(pantryItems.id, id), eq(pantryItems.userId, session!.user.id)) });
|
|
if (!item) return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
|
|
const body = await req.json() as unknown;
|
|
const parsed = z.object({
|
|
rawName: z.string().min(1).max(200).optional(),
|
|
quantity: z.string().nullable().optional(),
|
|
unit: z.string().nullable().optional(),
|
|
expiresAt: z.string().datetime().nullable().optional(),
|
|
}).safeParse(body);
|
|
if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
|
|
|
|
const data = parsed.data;
|
|
await db.update(pantryItems).set({
|
|
...(data.rawName && { rawName: data.rawName }),
|
|
...(data.quantity !== undefined && { quantity: data.quantity ?? undefined }),
|
|
...(data.unit !== undefined && { unit: data.unit ?? undefined }),
|
|
...(data.expiresAt !== undefined && { expiresAt: data.expiresAt ? new Date(data.expiresAt) : undefined }),
|
|
}).where(eq(pantryItems.id, id));
|
|
|
|
return NextResponse.json({ updated: true });
|
|
}
|
|
|
|
export async function DELETE(req: NextRequest, { params }: Params) {
|
|
const { session, response } = await requireSessionOrApiKey(req);
|
|
if (response) return response;
|
|
const { id } = await params;
|
|
|
|
await db.delete(pantryItems).where(and(eq(pantryItems.id, id), eq(pantryItems.userId, session!.user.id)));
|
|
return new NextResponse(null, { status: 204 });
|
|
}
|