Arnaud
45b886e398
Five S-sized items from HANDOFF.md's new-features backlog, all wiring up previously-orphaned infra: - createNotification now sends web push + email for every notification type (follow/comment/reply/reaction/rating/mention), not just comments - Personal recipe notes: private per-user notes on any viewable recipe (recipeNotes table had zero API/UI before this) - Recipe fork/clone: deep-copies a viewable recipe into your own library as a private draft, linked via recipeVariations, respects tier quota - Pantry-aware shopping lists: meal-plan-generated lists now subtract on-hand pantry quantities (ingredientId match, falling back to normalized name match) and flag partial/ambiguous matches instead of guessing - GDPR data export: downloadable JSON of a user's own content and activity across every relevant table, secrets/internal tables excluded New migrations 0025 (unique index for recipe-notes upsert) and 0026 (shopping_list_items.in_pantry) generated, left unapplied like 0023/0024. Verified with typecheck, lint, and a full local `docker build`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
77 lines
2.6 KiB
TypeScript
77 lines
2.6 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { db, recipes, recipeNotes, eq, and, or, inArray } from "@epicure/db";
|
|
import { z } from "zod";
|
|
import { requireSessionOrApiKey } from "@/lib/api-auth";
|
|
|
|
type Params = { params: Promise<{ id: string }> };
|
|
|
|
const PutSchema = z.object({
|
|
content: z.string().max(5000),
|
|
});
|
|
|
|
async function assertRecipeAccessible(recipeId: string, userId: string) {
|
|
const recipe = await db.query.recipes.findFirst({
|
|
where: and(
|
|
eq(recipes.id, recipeId),
|
|
or(eq(recipes.authorId, userId), inArray(recipes.visibility, ["public", "unlisted"]))
|
|
),
|
|
columns: { id: true },
|
|
});
|
|
return recipe;
|
|
}
|
|
|
|
export async function GET(req: NextRequest, { params }: Params) {
|
|
const { session, response } = await requireSessionOrApiKey(req, { rateLimit: { limit: 60, windowSeconds: 60 } });
|
|
if (response) return response;
|
|
const { id } = await params;
|
|
|
|
const recipe = await assertRecipeAccessible(id, session!.user.id);
|
|
if (!recipe) return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
|
|
const note = await db.query.recipeNotes.findFirst({
|
|
where: and(eq(recipeNotes.recipeId, id), eq(recipeNotes.userId, session!.user.id)),
|
|
columns: { content: true, updatedAt: true },
|
|
});
|
|
|
|
return NextResponse.json({ note: note ?? null });
|
|
}
|
|
|
|
export async function PUT(req: NextRequest, { params }: Params) {
|
|
const { session, response } = await requireSessionOrApiKey(req, { rateLimit: { limit: 60, windowSeconds: 60 } });
|
|
if (response) return response;
|
|
const { id } = await params;
|
|
|
|
const recipe = await assertRecipeAccessible(id, session!.user.id);
|
|
if (!recipe) return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
|
|
const parsed = PutSchema.safeParse(await req.json());
|
|
if (!parsed.success) {
|
|
return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
|
|
}
|
|
|
|
const content = parsed.data.content.trim();
|
|
const userId = session!.user.id;
|
|
|
|
if (content.length === 0) {
|
|
await db
|
|
.delete(recipeNotes)
|
|
.where(and(eq(recipeNotes.recipeId, id), eq(recipeNotes.userId, userId)));
|
|
return NextResponse.json({ note: null });
|
|
}
|
|
|
|
await db
|
|
.insert(recipeNotes)
|
|
.values({ id: crypto.randomUUID(), recipeId: id, userId, content, updatedAt: new Date() })
|
|
.onConflictDoUpdate({
|
|
target: [recipeNotes.recipeId, recipeNotes.userId],
|
|
set: { content, updatedAt: new Date() },
|
|
});
|
|
|
|
const note = await db.query.recipeNotes.findFirst({
|
|
where: and(eq(recipeNotes.recipeId, id), eq(recipeNotes.userId, userId)),
|
|
columns: { content: true, updatedAt: true },
|
|
});
|
|
|
|
return NextResponse.json({ note });
|
|
}
|