Arnaud
f2a0c20f07
Users can rate a recipe with review text and an optional photo. Adds ratings.photo_key column, a reviews list endpoint, and a review-purpose presign path (reviewer isn't the recipe owner, so the upload authorization differs from cover-photo uploads). Also fixes CSP connect-src/img-src to allow the storage origin — direct-to-S3/MinIO presigned uploads and stored images were silently blocked by Content-Security-Policy in the browser. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
43 lines
1.3 KiB
TypeScript
43 lines
1.3 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { db, recipes, ratings, eq, and, or, inArray, desc } from "@epicure/db";
|
|
import { requireSession } from "@/lib/api-auth";
|
|
|
|
type Params = { params: Promise<{ id: string }> };
|
|
|
|
export async function GET(_req: NextRequest, { params }: Params) {
|
|
const { session, response } = await requireSession();
|
|
if (response) return response;
|
|
const { id } = await params;
|
|
|
|
const recipe = await db.query.recipes.findFirst({
|
|
where: and(
|
|
eq(recipes.id, id),
|
|
or(eq(recipes.authorId, session!.user.id), inArray(recipes.visibility, ["public", "unlisted"]))
|
|
),
|
|
columns: { id: true },
|
|
});
|
|
if (!recipe) return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
|
|
const rows = await db.query.ratings.findMany({
|
|
where: eq(ratings.recipeId, id),
|
|
orderBy: desc(ratings.createdAt),
|
|
limit: 50,
|
|
with: {
|
|
user: { columns: { id: true, name: true, username: true, avatarUrl: true } },
|
|
},
|
|
});
|
|
|
|
const reviews = rows
|
|
.filter((r) => r.reviewText || r.photoKey)
|
|
.map((r) => ({
|
|
id: r.id,
|
|
score: r.score,
|
|
reviewText: r.reviewText,
|
|
photoKey: r.photoKey,
|
|
createdAt: r.createdAt,
|
|
user: r.user,
|
|
}));
|
|
|
|
return NextResponse.json({ data: reviews });
|
|
}
|