All files / src/app/api/collections/[id]/items/[itemId] route.ts

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
 
 
 
 
 
 
 
 
 
 
 
8x
8x
1x
 
 
7x
 
7x
7x
 
 
 
7x
7x
 
 
4x
4x
1x
 
 
3x
3x
 
3x
 
 
 
 
 
import { NextRequest, NextResponse } from "next/server";
import { getSession } from "@/lib/auth";
import { getDb } from "@/lib/db";
import { ItemController } from "@/server/api/items";
import { requireApiCapability } from "@/server/dal/collection-access";
import { errorResponse } from "@/server/api/http-errors";
 
export async function PATCH(
  req: NextRequest,
  { params }: { params: Promise<{ id: string; itemId: string }> }
) {
  const session = await getSession();
  if (!session?.user) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }
 
  const db = getDb();
 
  try {
    const { id, itemId } = await params;
    // Authz before existence (purses-ct0): the collection is in the URL, so a
    // non-curator never learns whether the item exists.
    // items:write = curator — any curator may edit metadata (full-curator model).
    const access = await requireApiCapability(db, id, session.user.id, "items:write");
    if (access instanceof NextResponse) return access;
 
    // Verify item belongs to collection (belongs-to-parent).
    const item = await ItemController.fromDb(db).getItem(itemId);
    if (!item || item.collectionId !== id) {
      return NextResponse.json({ error: "Not found" }, { status: 404 });
    }
 
    const body = await req.json();
    const updated = await ItemController.fromDb(db).updateItem(itemId, body);
 
    return NextResponse.json(updated);
  } catch (error) {
    return errorResponse(error);
  }
}