Arnaud
1abab17ca8
Part of the social-feature backlog (follow, comments, reactions, ratings, feed, threading) audited earlier — see conversation. - notifications table: follow/comment/reply/reaction/rating events, replaces the fully-dead feed_items table (feed_item_type enum existed but had zero references anywhere in the codebase). - Bell UI in the nav with unread badge, mark-all-read, 30s poll. - Rate limiting on comment posting (20/min), follow/unfollow (30/min), and comment reactions (60/min) — previously unthrottled. - /recipes/[id] queried by (id, authorId=session.user) only, so any recipe not owned by the viewer 404'd regardless of visibility. Widen the query to include public/unlisted recipes and gate the owner-only actions (edit, delete, version history, translate, AI content generation) behind an isOwner check. - user_follows had no primary key/unique constraint, so the follow route's onConflictDoNothing() was a silent no-op — concurrent follow clicks could insert duplicate rows and inflate follower counts. Add a composite primary key on (follower_id, following_id). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
36 lines
1.2 KiB
TypeScript
36 lines
1.2 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { db, notifications, users, eq, and, desc, count } from "@epicure/db";
|
|
import { requireSession } from "@/lib/api-auth";
|
|
|
|
export async function GET() {
|
|
const { session, response } = await requireSession();
|
|
if (response) return response;
|
|
|
|
const [rows, unread] = await Promise.all([
|
|
db
|
|
.select({
|
|
id: notifications.id,
|
|
type: notifications.type,
|
|
recipeId: notifications.recipeId,
|
|
commentId: notifications.commentId,
|
|
read: notifications.read,
|
|
createdAt: notifications.createdAt,
|
|
actorId: notifications.actorId,
|
|
actorName: users.name,
|
|
actorUsername: users.username,
|
|
actorAvatarUrl: users.avatarUrl,
|
|
})
|
|
.from(notifications)
|
|
.innerJoin(users, eq(notifications.actorId, users.id))
|
|
.where(eq(notifications.userId, session!.user.id))
|
|
.orderBy(desc(notifications.createdAt))
|
|
.limit(30),
|
|
db
|
|
.select({ total: count() })
|
|
.from(notifications)
|
|
.where(and(eq(notifications.userId, session!.user.id), eq(notifications.read, false))),
|
|
]);
|
|
|
|
return NextResponse.json({ notifications: rows, unreadCount: unread[0]?.total ?? 0 });
|
|
}
|