All files / src/app/api/collections/[id]/pool/photos route.ts

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
 
 
 
 
 
 
 
 
 
5x
5x
5x
1x
 
 
4x
 
4x
4x
 
2x
2x
2x
 
 
 
import { NextResponse } from "next/server";
import { getSession } from "@/lib/auth";
import { getDb } from "@/lib/db";
import { PhotoController } from "@/server/api/photos";
import { requireApiCapability } from "@/server/dal/collection-access";
 
// Lists a collection's pooled (unassigned) photos as JSON.
// items:read = curator (full-curator model).
export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
  const { id } = await params;
  const session = await getSession();
  if (!session?.user) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }
 
  const db = getDb();
  // items:read = curator — any curator may list pool photos (full-curator model).
  const access = await requireApiCapability(db, id, session.user.id, "items:read");
  if (access instanceof NextResponse) return access;
 
  const pool = await PhotoController.fromDb(db).findPoolByCollection(id);
  return NextResponse.json({
    photos: pool.map((p) => ({ id: p.id, filename: p.filename })),
  });
}