arnaudne
9e32766046
- medication-profiles/[id]: verify familyId ownership before PATCH/DELETE - event-templates/[id]: verify familyId ownership before PATCH/DELETE - notify/push: verify baby.familyId matches session family before push - events GET: validate type against ALL_EVENT_TYPES allowlist; sanitize limit (1–500) and offset (≥0) to prevent NaN/unbounded queries - v1/summary: fix operator precedence bug in feeds count calculation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
52 lines
2.1 KiB
TypeScript
52 lines
2.1 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { auth } from "@/lib/auth";
|
|
import { prisma } from "@/lib/prisma";
|
|
|
|
export async function PATCH(
|
|
req: Request,
|
|
{ params }: { params: Promise<{ id: string }> }
|
|
) {
|
|
const session = await auth();
|
|
if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
|
|
|
|
const { id } = await params;
|
|
const body = await req.json();
|
|
|
|
const familyId = (session.user as { familyId?: string }).familyId;
|
|
if (!familyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
|
|
const owned = await prisma.medicationProfile.findFirst({ where: { id, familyId } });
|
|
if (!owned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
|
|
|
|
const profile = await prisma.medicationProfile.update({
|
|
where: { id },
|
|
data: {
|
|
...(body.name !== undefined ? { name: body.name } : {}),
|
|
...(body.molecule !== undefined ? { molecule: body.molecule } : {}),
|
|
...(body.defaultDose !== undefined ? { defaultDose: body.defaultDose } : {}),
|
|
...(body.unit !== undefined ? { unit: body.unit } : {}),
|
|
...(body.intervalHours !== undefined ? { intervalHours: parseFloat(body.intervalHours) } : {}),
|
|
...(body.minIntervalHours !== undefined ? { minIntervalHours: body.minIntervalHours ? parseFloat(body.minIntervalHours) : null } : {}),
|
|
},
|
|
});
|
|
|
|
return NextResponse.json(profile);
|
|
}
|
|
|
|
export async function DELETE(
|
|
_req: Request,
|
|
{ params }: { params: Promise<{ id: string }> }
|
|
) {
|
|
const session = await auth();
|
|
if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
|
|
|
|
const { id } = await params;
|
|
|
|
const delFamilyId = (session.user as { familyId?: string }).familyId;
|
|
if (!delFamilyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
|
|
const delOwned = await prisma.medicationProfile.findFirst({ where: { id, familyId: delFamilyId } });
|
|
if (!delOwned) return NextResponse.json({ error: "Introuvable" }, { status: 404 });
|
|
|
|
await prisma.medicationProfile.delete({ where: { id } });
|
|
return new NextResponse(null, { status: 204 });
|
|
}
|