Arnaud
45b886e398
Five S-sized items from HANDOFF.md's new-features backlog, all wiring up previously-orphaned infra: - createNotification now sends web push + email for every notification type (follow/comment/reply/reaction/rating/mention), not just comments - Personal recipe notes: private per-user notes on any viewable recipe (recipeNotes table had zero API/UI before this) - Recipe fork/clone: deep-copies a viewable recipe into your own library as a private draft, linked via recipeVariations, respects tier quota - Pantry-aware shopping lists: meal-plan-generated lists now subtract on-hand pantry quantities (ingredientId match, falling back to normalized name match) and flag partial/ambiguous matches instead of guessing - GDPR data export: downloadable JSON of a user's own content and activity across every relevant table, secrets/internal tables excluded New migrations 0025 (unique index for recipe-notes upsert) and 0026 (shopping_list_items.in_pantry) generated, left unapplied like 0023/0024. Verified with typecheck, lint, and a full local `docker build`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
59 lines
2.1 KiB
TypeScript
59 lines
2.1 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { z } from "zod";
|
|
import { db, recipes, ratings, eq, and } from "@epicure/db";
|
|
import { requireSession } from "@/lib/api-auth";
|
|
import { createNotification } from "@/lib/notifications";
|
|
|
|
const Schema = z.object({
|
|
score: z.number().int().min(1).max(5),
|
|
reviewText: z.string().max(2000).optional(),
|
|
photoKey: z.string().max(500).optional(),
|
|
});
|
|
|
|
type Params = { params: Promise<{ id: string }> };
|
|
|
|
export async function POST(req: NextRequest, { params }: Params) {
|
|
const { session, response } = await requireSession();
|
|
if (response) return response;
|
|
const { id } = await params;
|
|
|
|
const recipe = await db.query.recipes.findFirst({ where: eq(recipes.id, id) });
|
|
if (!recipe || (recipe.visibility === "private" && recipe.authorId !== session!.user.id)) {
|
|
return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
}
|
|
if (recipe.authorId === session!.user.id) {
|
|
return NextResponse.json({ error: "Cannot rate your own recipe" }, { status: 400 });
|
|
}
|
|
|
|
const body = await req.json() as unknown;
|
|
const parsed = Schema.safeParse(body);
|
|
if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
|
|
|
|
const existing = await db.query.ratings.findFirst({
|
|
where: and(eq(ratings.recipeId, id), eq(ratings.userId, session!.user.id)),
|
|
});
|
|
|
|
if (existing) {
|
|
await db.update(ratings)
|
|
.set({
|
|
score: parsed.data.score,
|
|
reviewText: parsed.data.reviewText,
|
|
photoKey: parsed.data.photoKey,
|
|
updatedAt: new Date(),
|
|
})
|
|
.where(eq(ratings.id, existing.id));
|
|
return NextResponse.json({ updated: true });
|
|
}
|
|
|
|
await db.insert(ratings).values({
|
|
id: crypto.randomUUID(),
|
|
recipeId: id,
|
|
userId: session!.user.id,
|
|
score: parsed.data.score,
|
|
reviewText: parsed.data.reviewText,
|
|
photoKey: parsed.data.photoKey,
|
|
});
|
|
void createNotification({ userId: recipe.authorId, type: "rating", actorId: session!.user.id, recipeId: id, score: parsed.data.score });
|
|
return NextResponse.json({ created: true }, { status: 201 });
|
|
}
|