toanhoang
a9dafcc140
The only way to move an Assignment to a new employee was two separate calls (PATCH return + POST create), which is not atomic and left a race window where a third party could grab the now-in_stock AssetItem in between, plus no rollback if the second call failed. Adds transferAssignment() which closes the old Assignment and creates the new one inside a single prisma.$transaction(), per docs/asset-license-management.md's "Assignment (chốt 2026-08-02)" spec. Does not touch AssetItem.status or License.seatsUsed — the resource never becomes free mid-transfer. Wired into PATCH /api/assignments/[id]: an employeeId key in the body dispatches to transfer, a returnedAt key to return, both together is rejected as mutually exclusive.
87 lines
3.4 KiB
TypeScript
87 lines
3.4 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { z } from "zod";
|
|
import { auth } from "@/auth";
|
|
import {
|
|
returnAssignment,
|
|
transferAssignment,
|
|
validateReturnAssignmentInput,
|
|
validateTransferAssignmentInput,
|
|
} from "@/lib/assignments";
|
|
|
|
// First dynamic-segment ([id]) route in the codebase — see
|
|
// docs/asset-license-management.md's "Assignment (chốt 2026-08-02)" section,
|
|
// bullet (b): update routes use PATCH /api/<entity>/[id], not an
|
|
// action-based sub-route (e.g. NOT /api/assignments/[id]/return). Next.js
|
|
// 14 App Router route handler params are a plain synchronous object (not a
|
|
// Promise) — that changed starting in Next.js 15, which this project does
|
|
// not use (see package.json / CLAUDE.md).
|
|
export async function PATCH(
|
|
request: Request,
|
|
{ params }: { params: { id: string } }
|
|
): Promise<NextResponse> {
|
|
const session = await auth();
|
|
if (!session) {
|
|
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
|
|
// Validate the [id] path segment's format up front — an invalid UUID
|
|
// passed straight to Prisma's `findUnique({ where: { id } })` (a `@db.Uuid`
|
|
// column) throws a raw PrismaClientKnownRequestError that
|
|
// returnAssignment()'s try/catch doesn't specifically handle, which would
|
|
// otherwise leak as an uncaught 500 instead of a clean 400.
|
|
if (!z.string().uuid().safeParse(params.id).success) {
|
|
return NextResponse.json({ error: "id must be a valid UUID string" }, { status: 400 });
|
|
}
|
|
|
|
let body: unknown;
|
|
try {
|
|
body = await request.json();
|
|
} catch {
|
|
return NextResponse.json({ error: "Request body must be valid JSON" }, { status: 400 });
|
|
}
|
|
|
|
if (typeof body !== "object" || body === null) {
|
|
return NextResponse.json({ error: "Request body must be a JSON object" }, { status: 400 });
|
|
}
|
|
|
|
const { returnedAt, employeeId } = body as Record<string, unknown>;
|
|
|
|
// Dispatch on body shape — a body carrying employeeId is a transfer
|
|
// request, everything else is the existing return behavior. The two are
|
|
// mutually exclusive: don't guess intent if a caller sends both (see
|
|
// docs/asset-license-management.md's "Assignment (chốt 2026-08-02)"
|
|
// section, bullet right after the transfer rule, for why this stays a
|
|
// single PATCH route rather than an action-based sub-route).
|
|
if (employeeId !== undefined && returnedAt !== undefined) {
|
|
return NextResponse.json(
|
|
{ error: "Provide either employeeId (transfer) or returnedAt (return), not both" },
|
|
{ status: 400 }
|
|
);
|
|
}
|
|
|
|
if (employeeId !== undefined) {
|
|
const transferValidation = validateTransferAssignmentInput({ employeeId });
|
|
if (!transferValidation.ok) {
|
|
return NextResponse.json({ error: transferValidation.error }, { status: 400 });
|
|
}
|
|
|
|
const transferred = await transferAssignment(params.id, transferValidation.value);
|
|
if (!transferred.ok) {
|
|
return NextResponse.json({ error: transferred.error }, { status: transferred.status });
|
|
}
|
|
return NextResponse.json(transferred.value, { status: 200 });
|
|
}
|
|
|
|
const validation = validateReturnAssignmentInput({ returnedAt });
|
|
|
|
if (!validation.ok) {
|
|
return NextResponse.json({ error: validation.error }, { status: 400 });
|
|
}
|
|
|
|
const updated = await returnAssignment(params.id, validation.value);
|
|
if (!updated.ok) {
|
|
return NextResponse.json({ error: updated.error }, { status: updated.status });
|
|
}
|
|
return NextResponse.json(updated.value, { status: 200 });
|
|
}
|