arnaudne
169309af05
All collection routes (events, growth, doctor-notes, journal, milestones, vaccinations, milk, reminders, teeth, search, export) now verify the requested babyId belongs to the authenticated user's family before querying or writing. All [id] mutation routes verify record ownership via nested baby→familyId before any PATCH/DELETE. Additional fixes: admin config masks sensitive secrets in GET response, invite send-email enforces PARENT role, photo serving requires authentication, baby PATCH restricted to own-family PARENT. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
52 lines
2.0 KiB
TypeScript
52 lines
2.0 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { auth } from "@/lib/auth";
|
|
import { prisma } from "@/lib/prisma";
|
|
|
|
export async function PATCH(
|
|
req: Request,
|
|
{ params }: { params: Promise<{ id: string }> }
|
|
) {
|
|
const session = await auth();
|
|
if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
|
|
|
|
const { id } = await params;
|
|
const body = await req.json();
|
|
|
|
const familyId = (session.user as { familyId?: string }).familyId;
|
|
if (!familyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
|
|
const owned = await prisma.medicationReminder.findFirst({ where: { id, baby: { familyId } } });
|
|
if (!owned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
|
|
|
|
const reminder = await prisma.medicationReminder.update({
|
|
where: { id },
|
|
data: {
|
|
...(body.name !== undefined ? { name: body.name } : {}),
|
|
...(body.dose !== undefined ? { dose: body.dose } : {}),
|
|
...(body.unit !== undefined ? { unit: body.unit } : {}),
|
|
...(body.intervalHours !== undefined ? { intervalHours: parseFloat(body.intervalHours) } : {}),
|
|
...(body.startAt !== undefined ? { startAt: new Date(body.startAt) } : {}),
|
|
...(body.enabled !== undefined ? { enabled: body.enabled } : {}),
|
|
},
|
|
});
|
|
|
|
return NextResponse.json(reminder);
|
|
}
|
|
|
|
export async function DELETE(
|
|
_req: Request,
|
|
{ params }: { params: Promise<{ id: string }> }
|
|
) {
|
|
const session = await auth();
|
|
if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
|
|
|
|
const { id } = await params;
|
|
|
|
const delFamilyId = (session.user as { familyId?: string }).familyId;
|
|
if (!delFamilyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
|
|
const delOwned = await prisma.medicationReminder.findFirst({ where: { id, baby: { familyId: delFamilyId } } });
|
|
if (!delOwned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
|
|
|
|
await prisma.medicationReminder.delete({ where: { id } });
|
|
return new NextResponse(null, { status: 204 });
|
|
}
|