feat: add session-authed Area + InventoryScan API routes

GET /api/areas, GET /api/inventory-scans, PATCH+DELETE /api/inventory-scans/[id], GET /api/inventory-scans/[id]/photo (proxies Telegram file_id on demand, derives Content-Type from file_path extension since Telegram serves application/octet-stream regardless of actual type).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

src/app/api/inventory-scans/[id]/route.ts

@@ -0,0 +1,76 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { auth } from "@/auth";
+import {
+  deleteInventoryScan,
+  updateInventoryScan,
+  validateUpdateInventoryScanInput,
+} from "@/lib/inventory-scans";
+
+// Review-page edit/delete — session-authed, mirrors
+// src/app/api/assignments/[id]/route.ts's pattern (synchronous params,
+// explicit UUID pre-check before hitting Prisma).
+export async function PATCH(
+  request: Request,
+  { params }: { params: { id: string } }
+): Promise<NextResponse> {
+  const session = await auth();
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  if (!z.string().uuid().safeParse(params.id).success) {
+    return NextResponse.json({ error: "id must be a valid UUID string" }, { status: 400 });
+  }
+
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Request body must be valid JSON" }, { status: 400 });
+  }
+  if (typeof body !== "object" || body === null) {
+    return NextResponse.json({ error: "Request body must be a JSON object" }, { status: 400 });
+  }
+
+  const { modelId, areaId, assignedEmployeeId, assetTag, serialNumber, specs } =
+    body as Record<string, unknown>;
+  const validation = validateUpdateInventoryScanInput({
+    modelId,
+    areaId,
+    assignedEmployeeId,
+    assetTag,
+    serialNumber,
+    specs,
+  });
+  if (!validation.ok) {
+    return NextResponse.json({ error: validation.error }, { status: 400 });
+  }
+
+  const updated = await updateInventoryScan(params.id, validation.value);
+  if (!updated.ok) {
+    const status = updated.error === "InventoryScan not found" ? 404 : 400;
+    return NextResponse.json({ error: updated.error }, { status });
+  }
+  return NextResponse.json(updated.value, { status: 200 });
+}
+
+export async function DELETE(
+  request: Request,
+  { params }: { params: { id: string } }
+): Promise<NextResponse> {
+  const session = await auth();
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  if (!z.string().uuid().safeParse(params.id).success) {
+    return NextResponse.json({ error: "id must be a valid UUID string" }, { status: 400 });
+  }
+
+  const result = await deleteInventoryScan(params.id);
+  if (!result.ok) {
+    return NextResponse.json({ error: result.error }, { status: 404 });
+  }
+  return new NextResponse(null, { status: 204 });
+}