All files / src/app/api/collections/[id]/items route.ts

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
 
 
 
 
 
 
 
 
4x
4x
4x
3x
3x
3x
1x
1x
 
 
 
6x
6x
6x
 
5x
5x
 
 
 
5x
5x
5x
2x
2x
1x
 
1x
 
 
 
import { NextRequest, NextResponse } from "next/server";
import { getSession } from "@/lib/auth";
import { getDb } from "@/lib/db";
import { requireApiCapability } from "@/server/dal/collection-access";
import { ItemController } from "@/server/api/items";
import { errorResponse } from "@/server/api/http-errors";
 
export async function GET(_request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
  const { id } = await params;
  const session = await getSession();
  if (!session?.user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  const db = getDb();
  const access = await requireApiCapability(db, id, session.user.id, "items:read");
  if (access instanceof NextResponse) return access;
  const items = await ItemController.fromDb(db).listItems(id);
  return NextResponse.json(items);
}
 
export async function POST(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
  const { id } = await params;
  const session = await getSession();
  if (!session?.user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  let body: unknown;
  try {
    body = await request.json();
  } catch (error) {
    return errorResponse(error);
  }
  const db = getDb();
  const access = await requireApiCapability(db, id, session.user.id, "items:write");
  if (access instanceof NextResponse) return access;
  try {
    const item = await ItemController.fromDb(db).createItem(id, body);
    return NextResponse.json(item, { status: 201 });
  } catch (error) {
    return errorResponse(error);
  }
}