3e71bd29a2
Convert requireSession -> requireSessionOrApiKey across recipes, collections, meal-plans, shopping-lists, pantry, feed, and ai/* (52 routes) so API keys work end-to-end, not just for the handful of endpoints that supported them before. Scope was explicitly confirmed per-resource-family with the user before any file was touched. Left session-cookie-only, deliberately: users/me*, ai-keys/*, webhooks/*, conversations/*, notifications/*, push/subscribe, admin/* — account/credential-adjacent surface that shouldn't widen without a separate, explicit decision. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
44 lines
1.4 KiB
TypeScript
44 lines
1.4 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { db, mealPlans, eq, and } from "@epicure/db";
|
|
import { requireSessionOrApiKey } from "@/lib/api-auth";
|
|
|
|
type Params = { params: Promise<{ weekStart: string }> };
|
|
|
|
export async function GET(req: NextRequest, { params }: Params) {
|
|
const { session, response } = await requireSessionOrApiKey(req);
|
|
if (response) return response;
|
|
const { weekStart } = await params;
|
|
|
|
const plan = await db.query.mealPlans.findFirst({
|
|
where: and(eq(mealPlans.userId, session!.user.id), eq(mealPlans.weekStart, weekStart)),
|
|
with: {
|
|
entries: {
|
|
with: {
|
|
recipe: {
|
|
with: { photos: true },
|
|
},
|
|
},
|
|
},
|
|
},
|
|
});
|
|
|
|
if (!plan) return NextResponse.json({ weekStart, entries: [] });
|
|
return NextResponse.json(plan);
|
|
}
|
|
|
|
export async function POST(req: NextRequest, { params }: Params) {
|
|
const { session, response } = await requireSessionOrApiKey(req);
|
|
if (response) return response;
|
|
const { weekStart } = await params;
|
|
|
|
const existing = await db.query.mealPlans.findFirst({
|
|
where: and(eq(mealPlans.userId, session!.user.id), eq(mealPlans.weekStart, weekStart)),
|
|
});
|
|
|
|
if (existing) return NextResponse.json(existing);
|
|
|
|
const id = crypto.randomUUID();
|
|
await db.insert(mealPlans).values({ id, userId: session!.user.id, weekStart });
|
|
return NextResponse.json({ id, weekStart }, { status: 201 });
|
|
}
|