All files / src/app/api/collections/[id]/members/[mid] route.ts

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
 
 
 
 
 
 
 
 
7x
 
 
 
6x
6x
6x
5x
 
5x
5x
3x
1x
 
2x
 
 
 
 
 
 
 
5x
5x
5x
4x
4x
1x
 
 
3x
3x
1x
1x
 
 
import { NextRequest, NextResponse } from "next/server";
import { getSession } from "@/lib/auth";
import { getDb } from "@/lib/db";
import { requireApiCapability } from "@/server/dal/collection-access";
import { MemberController } from "@/server/api/members";
 
// Verify the [mid] membership row actually belongs to collection [id] (belongs-to-parent).
async function membershipBelongsToCollection(db: ReturnType<typeof getDb>, mid: string, collectionId: string) {
  return (await MemberController.fromDb(db).getByIdForCollection(mid, collectionId)) !== null;
}
 
export async function GET(_request: NextRequest, { params }: { params: Promise<{ id: string; mid: string }> }) {
  const { id, mid } = await params;
  const session = await getSession();
  if (!session?.user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  const db = getDb();
  // members:read = curator — any curator may read a membership.
  const access = await requireApiCapability(db, id, session.user.id, "members:read");
  if (access instanceof NextResponse) return access;
  if (!(await membershipBelongsToCollection(db, mid, id))) {
    return NextResponse.json({ error: "Not found" }, { status: 404 });
  }
  return NextResponse.json(await MemberController.fromDb(db).getMember(mid));
}
 
// PATCH removed (purses-2wzz): no UI caller; members have no editable fields under
// the role model (UpdateMemberSchema is empty; repo update writes only updatedAt).
// Next.js returns 405 automatically for unexported methods.
 
export async function DELETE(_request: NextRequest, { params }: { params: Promise<{ id: string; mid: string }> }) {
  const { id, mid } = await params;
  const session = await getSession();
  if (!session?.user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  const db = getDb();
  if (!(await membershipBelongsToCollection(db, mid, id))) {
    return NextResponse.json({ error: "Not found" }, { status: 404 });
  }
  // members:manage = owner — only the collection owner may remove members.
  const access = await requireApiCapability(db, id, session.user.id, "members:manage");
  if (access instanceof NextResponse) return access;
  await MemberController.fromDb(db).removeMember(mid);
  return NextResponse.json({ message: "Member removed" });
}