92 lines
2.5 KiB
TypeScript
92 lines
2.5 KiB
TypeScript
|
/**
|
||
|
|
* POST /api/analyzer/analyses/:id/share
|
||
|
|
*
|
||
|
|
* Body: { recipientEmail: string, note?: string }
|
||
|
|
*
|
||
|
|
* Records a share row in analyzer_shares. Email send is deferred to phase 8
|
||
|
|
* — this endpoint validates the recipient domain against ALLOWED_SHARE_DOMAINS
|
||
|
|
* and persists the audit row. The share is "pending delivery" until phase 8
|
||
|
|
* wires up nodemailer.
|
||
|
|
*/
|
||
|
|
|
||
|
|
import { NextRequest, NextResponse } from 'next/server';
|
||
|
|
import { requireAuth } from '@/lib/auth-utils';
|
||
|
|
import { ShareAnalysisRequest } from '@/lib/types/analyzer';
|
||
|
|
import {
|
||
|
|
createShare,
|
||
|
|
getAnalysisById,
|
||
|
|
} from '@/lib/services/analyzer/persistence';
|
||
|
|
|
||
|
|
function getAllowedDomains(): string[] {
|
||
|
|
const raw = process.env.ALLOWED_SHARE_DOMAINS ?? '';
|
||
|
|
return raw
|
||
|
|
.split(',')
|
||
|
|
.map((d) => d.trim().toLowerCase())
|
||
|
|
.filter((d) => d.length > 0);
|
||
|
|
}
|
||
|
|
|
||
|
|
export async function POST(
|
||
|
|
request: NextRequest,
|
||
|
|
{ params }: { params: Promise<{ id: string }> }
|
||
|
|
) {
|
||
|
|
const { session, error } = await requireAuth();
|
||
|
|
if (error) return error;
|
||
|
|
|
||
|
|
const { id } = await params;
|
||
|
|
|
||
|
|
const body = await request.json().catch(() => ({}));
|
||
|
|
const result = ShareAnalysisRequest.safeParse(body);
|
||
|
|
if (!result.success) {
|
||
|
|
return NextResponse.json(
|
||
|
|
{ error: 'Invalid request body', details: result.error.issues },
|
||
|
|
{ status: 400 }
|
||
|
|
);
|
||
|
|
}
|
||
|
|
const { recipientEmail, note } = result.data;
|
||
|
|
|
||
|
|
const allowedDomains = getAllowedDomains();
|
||
|
|
if (allowedDomains.length === 0) {
|
||
|
|
return NextResponse.json(
|
||
|
|
{
|
||
|
|
error: 'Sharing is not configured',
|
||
|
|
message: 'ALLOWED_SHARE_DOMAINS env var is empty.',
|
||
|
|
},
|
||
|
|
{ status: 503 }
|
||
|
|
);
|
||
|
|
}
|
||
|
|
const domain = recipientEmail.split('@')[1]?.toLowerCase();
|
||
|
|
if (!domain || !allowedDomains.includes(domain)) {
|
||
|
|
return NextResponse.json(
|
||
|
|
{
|
||
|
|
error: 'Recipient domain is not allowed',
|
||
|
|
message: `Allowed domains: ${allowedDomains.join(', ')}`,
|
||
|
|
},
|
||
|
|
{ status: 403 }
|
||
|
|
);
|
||
|
|
}
|
||
|
|
|
||
|
|
// Confirm the analysis exists.
|
||
|
|
const analysis = await getAnalysisById(id);
|
||
|
|
if (!analysis) {
|
||
|
|
return NextResponse.json({ error: 'Analysis not found' }, { status: 404 });
|
||
|
|
}
|
||
|
|
|
||
|
|
const userId = (session?.user as { id: string }).id;
|
||
|
|
const share = await createShare({
|
||
|
|
analysis_id: id,
|
||
|
|
shared_by_user_id: userId,
|
||
|
|
shared_with_email: recipientEmail,
|
||
|
|
note,
|
||
|
|
});
|
||
|
|
|
||
|
|
return NextResponse.json({
|
||
|
|
share: {
|
||
|
|
id: share.id,
|
||
|
|
analysisId: id,
|
||
|
|
sharedWithEmail: recipientEmail,
|
||
|
|
sharedAt: share.shared_at,
|
||
|
|
note: note ?? null,
|
||
|
|
},
|
||
|
|
});
|
||
|
|
}
|