toanhoangandClaude Sonnet 5
17c5882e86
Auth via BOT_INGEST_SECRET bearer header (src/lib/bot-auth.ts), not Auth.js session -- caller is the inventory-capture Telegram bot service, not a browser. Co-Authored-By: Claude Sonnet 5 <[email protected]>
43 lines
1.6 KiB
TypeScript
43 lines
1.6 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { requireBotAuth } from "@/lib/bot-auth";
|
|
import { createOrGetArea, listAreas, validateCreateAreaInput } from "@/lib/areas";
|
|
|
|
// Bot-facing Area list/create — see src/lib/areas.ts's createOrGetArea()
|
|
// comment for why POST is idempotent-by-name rather than erroring on a
|
|
// name the bot's own keyboard just offered as an existing option.
|
|
export async function GET(request: Request): Promise<NextResponse> {
|
|
if (!requireBotAuth(request)) {
|
|
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
const areas = await listAreas();
|
|
return NextResponse.json({ areas });
|
|
}
|
|
|
|
export async function POST(request: Request): Promise<NextResponse> {
|
|
if (!requireBotAuth(request)) {
|
|
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
|
|
let body: unknown;
|
|
try {
|
|
body = await request.json();
|
|
} catch {
|
|
return NextResponse.json({ error: "Request body must be valid JSON" }, { status: 400 });
|
|
}
|
|
if (typeof body !== "object" || body === null) {
|
|
return NextResponse.json({ error: "Request body must be a JSON object" }, { status: 400 });
|
|
}
|
|
|
|
const { name, team } = body as Record<string, unknown>;
|
|
const validation = validateCreateAreaInput({ name, team });
|
|
if (!validation.ok) {
|
|
return NextResponse.json({ error: validation.error }, { status: 400 });
|
|
}
|
|
|
|
const created = await createOrGetArea(validation.value);
|
|
if (!created.ok) {
|
|
return NextResponse.json({ error: created.error }, { status: 400 });
|
|
}
|
|
return NextResponse.json(created.value, { status: 201 });
|
|
}
|