Arnaud
1abab17ca8
Part of the social-feature backlog (follow, comments, reactions, ratings, feed, threading) audited earlier — see conversation. - notifications table: follow/comment/reply/reaction/rating events, replaces the fully-dead feed_items table (feed_item_type enum existed but had zero references anywhere in the codebase). - Bell UI in the nav with unread badge, mark-all-read, 30s poll. - Rate limiting on comment posting (20/min), follow/unfollow (30/min), and comment reactions (60/min) — previously unthrottled. - /recipes/[id] queried by (id, authorId=session.user) only, so any recipe not owned by the viewer 404'd regardless of visibility. Widen the query to include public/unlisted recipes and gate the owner-only actions (edit, delete, version history, translate, AI content generation) behind an isOwner check. - user_follows had no primary key/unique constraint, so the follow route's onConflictDoNothing() was a silent no-op — concurrent follow clicks could insert duplicate rows and inflate follower counts. Add a composite primary key on (follower_id, following_id). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
52 lines
1.9 KiB
TypeScript
52 lines
1.9 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { z } from "zod";
|
|
import { db, recipes, ratings, eq, and } from "@epicure/db";
|
|
import { requireSession } from "@/lib/api-auth";
|
|
import { createNotification } from "@/lib/notifications";
|
|
|
|
const Schema = z.object({
|
|
score: z.number().int().min(1).max(5),
|
|
reviewText: z.string().max(2000).optional(),
|
|
});
|
|
|
|
type Params = { params: Promise<{ id: string }> };
|
|
|
|
export async function POST(req: NextRequest, { params }: Params) {
|
|
const { session, response } = await requireSession();
|
|
if (response) return response;
|
|
const { id } = await params;
|
|
|
|
const recipe = await db.query.recipes.findFirst({ where: eq(recipes.id, id) });
|
|
if (!recipe || (recipe.visibility === "private" && recipe.authorId !== session!.user.id)) {
|
|
return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
}
|
|
if (recipe.authorId === session!.user.id) {
|
|
return NextResponse.json({ error: "Cannot rate your own recipe" }, { status: 400 });
|
|
}
|
|
|
|
const body = await req.json() as unknown;
|
|
const parsed = Schema.safeParse(body);
|
|
if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
|
|
|
|
const existing = await db.query.ratings.findFirst({
|
|
where: and(eq(ratings.recipeId, id), eq(ratings.userId, session!.user.id)),
|
|
});
|
|
|
|
if (existing) {
|
|
await db.update(ratings)
|
|
.set({ score: parsed.data.score, reviewText: parsed.data.reviewText, updatedAt: new Date() })
|
|
.where(eq(ratings.id, existing.id));
|
|
return NextResponse.json({ updated: true });
|
|
}
|
|
|
|
await db.insert(ratings).values({
|
|
id: crypto.randomUUID(),
|
|
recipeId: id,
|
|
userId: session!.user.id,
|
|
score: parsed.data.score,
|
|
reviewText: parsed.data.reviewText,
|
|
});
|
|
void createNotification({ userId: recipe.authorId, type: "rating", actorId: session!.user.id, recipeId: id });
|
|
return NextResponse.json({ created: true }, { status: 201 });
|
|
}
|