Arnaud
c5e1643d39
- Notification email preferences: every push category (follow, comment, reply, reaction, rating, mention, leftoverExpiring, shoppingList) now has an independent email toggle, plus a Weekly Digest toggle. Previously email sent unconditionally whenever the recipient had one; now gated the same way push already was. The weekly-digest cron route excludes opted-out users. - Admin-only site-wide webhooks (Admin → Webhooks): new signups, support tickets, and reports filed can now fire an HMAC-signed HTTP webhook (Slack/Discord/ops alerting), independent of the existing per-user webhooks (which stay scoped to a user's own recipe/meal-plan/shopping-list events). Signing/delivery logic factored into lib/webhook-delivery.ts and shared by both dispatchers instead of duplicated. - Settings → Features: users can hide Nutrition, Pantry, Meal Plan, Shopping Lists, Collections, or Messages from their own nav. Purely cosmetic — hidden pages stay reachable by direct link, nothing is access-restricted. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
50 lines
1.7 KiB
TypeScript
50 lines
1.7 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { z } from "zod";
|
|
import { db, reports, comments, recipes, users, eq } from "@epicure/db";
|
|
import { requireSession } from "@/lib/api-auth";
|
|
import { applyRateLimit } from "@/lib/rate-limit";
|
|
import { dispatchAdminWebhook } from "@/lib/admin-webhooks";
|
|
import { randomUUID } from "crypto";
|
|
|
|
const Schema = z.object({
|
|
targetType: z.enum(["recipe", "comment", "user"]),
|
|
targetId: z.string().min(1),
|
|
reason: z.string().min(1).max(1000),
|
|
});
|
|
|
|
export async function POST(req: NextRequest) {
|
|
const { session, response } = await requireSession();
|
|
if (response) return response;
|
|
|
|
const limited = await applyRateLimit(`rl:report:${session!.user.id}`, 10, 60);
|
|
if (limited) return limited;
|
|
|
|
const body = await req.json() as unknown;
|
|
const parsed = Schema.safeParse(body);
|
|
if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
|
|
|
|
const { targetType, targetId, reason } = parsed.data;
|
|
|
|
const exists =
|
|
targetType === "recipe"
|
|
? await db.query.recipes.findFirst({ where: eq(recipes.id, targetId) })
|
|
: targetType === "comment"
|
|
? await db.query.comments.findFirst({ where: eq(comments.id, targetId) })
|
|
: await db.query.users.findFirst({ where: eq(users.id, targetId) });
|
|
|
|
if (!exists) return NextResponse.json({ error: "Target not found" }, { status: 404 });
|
|
|
|
const id = randomUUID();
|
|
await db.insert(reports).values({
|
|
id,
|
|
reporterId: session!.user.id,
|
|
targetType,
|
|
targetId,
|
|
reason,
|
|
});
|
|
|
|
void dispatchAdminWebhook("report.filed", { id, reporterId: session!.user.id, targetType, targetId, reason });
|
|
|
|
return NextResponse.json({ ok: true }, { status: 201 });
|
|
}
|