arnaudne
169309af05
All collection routes (events, growth, doctor-notes, journal, milestones, vaccinations, milk, reminders, teeth, search, export) now verify the requested babyId belongs to the authenticated user's family before querying or writing. All [id] mutation routes verify record ownership via nested baby→familyId before any PATCH/DELETE. Additional fixes: admin config masks sensitive secrets in GET response, invite send-email enforces PARENT role, photo serving requires authentication, baby PATCH restricted to own-family PARENT. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
77 lines
2.6 KiB
TypeScript
77 lines
2.6 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { auth } from "@/lib/auth";
|
|
import { prisma } from "@/lib/prisma";
|
|
import { EVENT_CONFIG, EventType } from "@/lib/event-config";
|
|
import { format } from "date-fns";
|
|
import { fr } from "date-fns/locale";
|
|
|
|
export async function GET(req: Request) {
|
|
const session = await auth();
|
|
if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
|
|
|
|
const { searchParams } = new URL(req.url);
|
|
const babyId = searchParams.get("babyId");
|
|
const dateFrom = searchParams.get("dateFrom");
|
|
const dateTo = searchParams.get("dateTo");
|
|
const outputFormat = searchParams.get("format");
|
|
|
|
if (!babyId) return NextResponse.json({ error: "babyId requis" }, { status: 400 });
|
|
|
|
const familyId = (session.user as { familyId?: string }).familyId;
|
|
if (!familyId) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
|
|
const ownedBaby = await prisma.baby.findFirst({ where: { id: babyId, familyId } });
|
|
if (!ownedBaby) return NextResponse.json({ error: "Bébé introuvable" }, { status: 404 });
|
|
|
|
const where: Record<string, unknown> = { babyId };
|
|
if (dateFrom || dateTo) {
|
|
where.startedAt = {
|
|
...(dateFrom ? { gte: new Date(dateFrom) } : {}),
|
|
...(dateTo ? { lte: new Date(dateTo) } : {}),
|
|
};
|
|
}
|
|
|
|
const events = await prisma.event.findMany({
|
|
where,
|
|
orderBy: { startedAt: "asc" },
|
|
include: { user: { select: { name: true } } },
|
|
});
|
|
|
|
if (outputFormat === "json") {
|
|
return NextResponse.json(events.map((e) => ({
|
|
type: e.type,
|
|
startedAt: e.startedAt,
|
|
endedAt: e.endedAt,
|
|
notes: e.notes,
|
|
metadata: e.metadata,
|
|
user: e.user.name,
|
|
})));
|
|
}
|
|
|
|
const rows = [
|
|
["Date", "Heure", "Type", "Durée (min)", "Noté par", "Notes", "Détails"].join(","),
|
|
...events.map((e) => {
|
|
const duration =
|
|
e.endedAt
|
|
? Math.round((e.endedAt.getTime() - e.startedAt.getTime()) / 60000)
|
|
: "";
|
|
const details = e.metadata ? JSON.stringify(e.metadata).replace(/"/g, "'") : "";
|
|
return [
|
|
format(e.startedAt, "dd/MM/yyyy", { locale: fr }),
|
|
format(e.startedAt, "HH:mm"),
|
|
EVENT_CONFIG[e.type as EventType]?.label ?? e.type,
|
|
duration,
|
|
e.user.name,
|
|
`"${(e.notes ?? "").replace(/"/g, "'")}"`,
|
|
`"${details}"`,
|
|
].join(",");
|
|
}),
|
|
].join("\n");
|
|
|
|
return new NextResponse(rows, {
|
|
headers: {
|
|
"Content-Type": "text/csv; charset=utf-8",
|
|
"Content-Disposition": `attachment; filename="grow-export-${format(new Date(), "yyyy-MM-dd")}.csv"`,
|
|
},
|
|
});
|
|
}
|