mirror of
https://github.com/yusufipk/OpenFrame.git
synced 2026-09-11 17:46:06 +00:00
feat: Implement core API routes for managing projects, videos, versions, and comments, including database seeding.
This commit is contained in:
Yusuf İpek
@@ -0,0 +1,158 @@
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { db } from '@/lib/db';
|
||||
import { auth } from '@/lib/auth';
|
||||
import { ProjectMemberRole, ProjectVisibility } from '@prisma/client';
|
||||
|
||||
type RouteParams = { params: Promise<{ projectId: string }> };
|
||||
|
||||
// Helper to check project access
|
||||
async function checkProjectAccess(projectId: string, userId: string) {
|
||||
const project = await db.project.findUnique({
|
||||
where: { id: projectId },
|
||||
include: {
|
||||
members: { where: { userId } },
|
||||
},
|
||||
});
|
||||
|
||||
if (!project) return { project: null, role: null, canEdit: false, canDelete: false };
|
||||
|
||||
const isOwner = project.ownerId === userId;
|
||||
const membership = project.members[0];
|
||||
const role = isOwner ? 'OWNER' : membership?.role || null;
|
||||
|
||||
return {
|
||||
project,
|
||||
role,
|
||||
canEdit: isOwner || role === ProjectMemberRole.ADMIN || role === ProjectMemberRole.EDITOR,
|
||||
canDelete: isOwner,
|
||||
};
|
||||
}
|
||||
|
||||
// GET /api/projects/[projectId] - Get a single project
|
||||
export async function GET(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const session = await auth();
|
||||
const { projectId } = await params;
|
||||
|
||||
const project = await db.project.findUnique({
|
||||
where: { id: projectId },
|
||||
include: {
|
||||
owner: { select: { id: true, name: true, image: true } },
|
||||
members: {
|
||||
include: {
|
||||
user: { select: { id: true, name: true, image: true } },
|
||||
},
|
||||
},
|
||||
videos: {
|
||||
orderBy: { position: 'asc' },
|
||||
include: {
|
||||
versions: {
|
||||
orderBy: { versionNumber: 'desc' },
|
||||
take: 1,
|
||||
},
|
||||
_count: { select: { versions: true } },
|
||||
},
|
||||
},
|
||||
_count: { select: { videos: true, members: true, shareLinks: true } },
|
||||
},
|
||||
});
|
||||
|
||||
if (!project) {
|
||||
return NextResponse.json({ error: 'Project not found' }, { status: 404 });
|
||||
}
|
||||
|
||||
// Check access
|
||||
const isPublic = project.visibility === ProjectVisibility.PUBLIC;
|
||||
const isOwner = session?.user?.id === project.ownerId;
|
||||
const isMember = project.members.some(m => m.userId === session?.user?.id);
|
||||
|
||||
if (!isPublic && !isOwner && !isMember) {
|
||||
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
|
||||
}
|
||||
|
||||
return NextResponse.json(project);
|
||||
} catch (error) {
|
||||
console.error('Error fetching project:', error);
|
||||
return NextResponse.json(
|
||||
{ error: 'Failed to fetch project' },
|
||||
{ status: 500 }
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// PATCH /api/projects/[projectId] - Update a project
|
||||
export async function PATCH(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const session = await auth();
|
||||
const { projectId } = await params;
|
||||
|
||||
if (!session?.user?.id) {
|
||||
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
|
||||
}
|
||||
|
||||
const { canEdit } = await checkProjectAccess(projectId, session.user.id);
|
||||
if (!canEdit) {
|
||||
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
|
||||
}
|
||||
|
||||
const body = await request.json();
|
||||
const { name, description, visibility } = body;
|
||||
|
||||
const updateData: Record<string, unknown> = {};
|
||||
if (name !== undefined) updateData.name = name.trim();
|
||||
if (description !== undefined) updateData.description = description?.trim() || null;
|
||||
if (visibility !== undefined) updateData.visibility = visibility;
|
||||
|
||||
const project = await db.project.update({
|
||||
where: { id: projectId },
|
||||
data: updateData,
|
||||
include: {
|
||||
owner: { select: { id: true, name: true, image: true } },
|
||||
_count: { select: { videos: true, members: true } },
|
||||
},
|
||||
});
|
||||
|
||||
return NextResponse.json(project);
|
||||
} catch (error) {
|
||||
console.error('Error updating project:', error);
|
||||
return NextResponse.json(
|
||||
{ error: 'Failed to update project' },
|
||||
{ status: 500 }
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// DELETE /api/projects/[projectId] - Delete a project
|
||||
export async function DELETE(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const session = await auth();
|
||||
const { projectId } = await params;
|
||||
|
||||
if (!session?.user?.id) {
|
||||
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
|
||||
}
|
||||
|
||||
const { canDelete, project } = await checkProjectAccess(projectId, session.user.id);
|
||||
|
||||
if (!project) {
|
||||
return NextResponse.json({ error: 'Project not found' }, { status: 404 });
|
||||
}
|
||||
|
||||
if (!canDelete) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Only the project owner can delete it' },
|
||||
{ status: 403 }
|
||||
);
|
||||
}
|
||||
|
||||
await db.project.delete({ where: { id: projectId } });
|
||||
|
||||
return NextResponse.json({ success: true, message: 'Project deleted' });
|
||||
} catch (error) {
|
||||
console.error('Error deleting project:', error);
|
||||
return NextResponse.json(
|
||||
{ error: 'Failed to delete project' },
|
||||
{ status: 500 }
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,166 @@
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { db } from '@/lib/db';
|
||||
import { auth } from '@/lib/auth';
|
||||
import { ProjectMemberRole } from '@prisma/client';
|
||||
|
||||
type RouteParams = { params: Promise<{ projectId: string; videoId: string }> };
|
||||
|
||||
// GET /api/projects/[projectId]/videos/[videoId]
|
||||
export async function GET(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const session = await auth();
|
||||
const { projectId, videoId } = await params;
|
||||
|
||||
const video = await db.video.findFirst({
|
||||
where: { id: videoId, projectId },
|
||||
include: {
|
||||
project: {
|
||||
include: { members: { where: { userId: session?.user?.id || '' } } },
|
||||
},
|
||||
versions: {
|
||||
orderBy: { versionNumber: 'desc' },
|
||||
include: {
|
||||
comments: {
|
||||
orderBy: { timestamp: 'asc' },
|
||||
include: {
|
||||
author: { select: { id: true, name: true, image: true } },
|
||||
replies: {
|
||||
orderBy: { createdAt: 'asc' },
|
||||
include: {
|
||||
author: { select: { id: true, name: true, image: true } },
|
||||
},
|
||||
},
|
||||
},
|
||||
where: { parentId: null }, // Only top-level comments
|
||||
},
|
||||
_count: { select: { comments: true } },
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
if (!video) {
|
||||
return NextResponse.json({ error: 'Video not found' }, { status: 404 });
|
||||
}
|
||||
|
||||
// Check access
|
||||
const isOwner = session?.user?.id === video.project.ownerId;
|
||||
const isMember = video.project.members.length > 0;
|
||||
const isPublicOrLink = video.project.visibility !== 'PRIVATE';
|
||||
|
||||
if (!isOwner && !isMember && !isPublicOrLink) {
|
||||
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
|
||||
}
|
||||
|
||||
return NextResponse.json(video);
|
||||
} catch (error) {
|
||||
console.error('Error fetching video:', error);
|
||||
return NextResponse.json(
|
||||
{ error: 'Failed to fetch video' },
|
||||
{ status: 500 }
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// PATCH /api/projects/[projectId]/videos/[videoId]
|
||||
export async function PATCH(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const session = await auth();
|
||||
const { projectId, videoId } = await params;
|
||||
|
||||
if (!session?.user?.id) {
|
||||
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
|
||||
}
|
||||
|
||||
const video = await db.video.findFirst({
|
||||
where: { id: videoId, projectId },
|
||||
include: {
|
||||
project: { include: { members: { where: { userId: session.user.id } } } },
|
||||
},
|
||||
});
|
||||
|
||||
if (!video) {
|
||||
return NextResponse.json({ error: 'Video not found' }, { status: 404 });
|
||||
}
|
||||
|
||||
const isOwner = video.project.ownerId === session.user.id;
|
||||
const membership = video.project.members[0];
|
||||
const canEdit = isOwner ||
|
||||
membership?.role === ProjectMemberRole.ADMIN ||
|
||||
membership?.role === ProjectMemberRole.EDITOR;
|
||||
|
||||
if (!canEdit) {
|
||||
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
|
||||
}
|
||||
|
||||
const body = await request.json();
|
||||
const { title, description, position } = body;
|
||||
|
||||
const updateData: Record<string, unknown> = {};
|
||||
if (title !== undefined) updateData.title = title.trim();
|
||||
if (description !== undefined) updateData.description = description?.trim() || null;
|
||||
if (position !== undefined) updateData.position = position;
|
||||
|
||||
const updatedVideo = await db.video.update({
|
||||
where: { id: videoId },
|
||||
data: updateData,
|
||||
include: {
|
||||
versions: { orderBy: { versionNumber: 'desc' } },
|
||||
_count: { select: { versions: true } },
|
||||
},
|
||||
});
|
||||
|
||||
return NextResponse.json(updatedVideo);
|
||||
} catch (error) {
|
||||
console.error('Error updating video:', error);
|
||||
return NextResponse.json(
|
||||
{ error: 'Failed to update video' },
|
||||
{ status: 500 }
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// DELETE /api/projects/[projectId]/videos/[videoId]
|
||||
export async function DELETE(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const session = await auth();
|
||||
const { projectId, videoId } = await params;
|
||||
|
||||
if (!session?.user?.id) {
|
||||
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
|
||||
}
|
||||
|
||||
const video = await db.video.findFirst({
|
||||
where: { id: videoId, projectId },
|
||||
include: {
|
||||
project: { include: { members: { where: { userId: session.user.id } } } },
|
||||
},
|
||||
});
|
||||
|
||||
if (!video) {
|
||||
return NextResponse.json({ error: 'Video not found' }, { status: 404 });
|
||||
}
|
||||
|
||||
const isOwner = video.project.ownerId === session.user.id;
|
||||
const membership = video.project.members[0];
|
||||
// Destructive actions limited to OWNER and ADMIN only
|
||||
const canDelete = isOwner || membership?.role === ProjectMemberRole.ADMIN;
|
||||
|
||||
if (!canDelete) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Only project owner or admin can delete videos' },
|
||||
{ status: 403 }
|
||||
);
|
||||
}
|
||||
|
||||
await db.video.delete({ where: { id: videoId } });
|
||||
|
||||
return NextResponse.json({ success: true, message: 'Video deleted' });
|
||||
} catch (error) {
|
||||
console.error('Error deleting video:', error);
|
||||
return NextResponse.json(
|
||||
{ error: 'Failed to delete video' },
|
||||
{ status: 500 }
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,146 @@
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { db } from '@/lib/db';
|
||||
import { auth } from '@/lib/auth';
|
||||
import { ProjectMemberRole } from '@prisma/client';
|
||||
import { validateUrl, validateOptionalUrl } from '@/lib/validation';
|
||||
|
||||
type RouteParams = { params: Promise<{ projectId: string; videoId: string }> };
|
||||
|
||||
// GET /api/projects/[projectId]/videos/[videoId]/versions
|
||||
export async function GET(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const session = await auth();
|
||||
const { projectId, videoId } = await params;
|
||||
|
||||
const video = await db.video.findFirst({
|
||||
where: { id: videoId, projectId },
|
||||
include: {
|
||||
project: {
|
||||
include: { members: { where: { userId: session?.user?.id || '' } } },
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
if (!video) {
|
||||
return NextResponse.json({ error: 'Video not found' }, { status: 404 });
|
||||
}
|
||||
|
||||
const isOwner = session?.user?.id === video.project.ownerId;
|
||||
const isMember = video.project.members.length > 0;
|
||||
const isPublicOrLink = video.project.visibility !== 'PRIVATE';
|
||||
|
||||
if (!isOwner && !isMember && !isPublicOrLink) {
|
||||
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
|
||||
}
|
||||
|
||||
const versions = await db.videoVersion.findMany({
|
||||
where: { videoParentId: videoId },
|
||||
orderBy: { versionNumber: 'desc' },
|
||||
include: {
|
||||
_count: { select: { comments: true } },
|
||||
},
|
||||
});
|
||||
|
||||
return NextResponse.json({ versions });
|
||||
} catch (error) {
|
||||
console.error('Error fetching versions:', error);
|
||||
return NextResponse.json(
|
||||
{ error: 'Failed to fetch versions' },
|
||||
{ status: 500 }
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// POST /api/projects/[projectId]/videos/[videoId]/versions - Add a new version
|
||||
export async function POST(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const session = await auth();
|
||||
const { projectId, videoId } = await params;
|
||||
|
||||
if (!session?.user?.id) {
|
||||
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
|
||||
}
|
||||
|
||||
const video = await db.video.findFirst({
|
||||
where: { id: videoId, projectId },
|
||||
include: {
|
||||
project: { include: { members: { where: { userId: session.user.id } } } },
|
||||
versions: { orderBy: { versionNumber: 'desc' }, take: 1 },
|
||||
},
|
||||
});
|
||||
|
||||
if (!video) {
|
||||
return NextResponse.json({ error: 'Video not found' }, { status: 404 });
|
||||
}
|
||||
|
||||
const isOwner = video.project.ownerId === session.user.id;
|
||||
const membership = video.project.members[0];
|
||||
const canEdit = isOwner ||
|
||||
membership?.role === ProjectMemberRole.ADMIN ||
|
||||
membership?.role === ProjectMemberRole.EDITOR;
|
||||
|
||||
if (!canEdit) {
|
||||
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
|
||||
}
|
||||
|
||||
const body = await request.json();
|
||||
const { videoUrl, providerId, providerVideoId, versionLabel, thumbnailUrl, duration, setActive } = body;
|
||||
|
||||
if (!videoUrl) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Video URL is required' },
|
||||
{ status: 400 }
|
||||
);
|
||||
}
|
||||
|
||||
// Validate URLs use safe schemes (http/https only)
|
||||
const videoUrlError = validateUrl(videoUrl, 'Video URL');
|
||||
if (videoUrlError) {
|
||||
return NextResponse.json({ error: videoUrlError }, { status: 400 });
|
||||
}
|
||||
|
||||
const thumbnailUrlError = validateOptionalUrl(thumbnailUrl, 'Thumbnail URL');
|
||||
if (thumbnailUrlError) {
|
||||
return NextResponse.json({ error: thumbnailUrlError }, { status: 400 });
|
||||
}
|
||||
|
||||
const nextVersionNumber = (video.versions[0]?.versionNumber || 0) + 1;
|
||||
|
||||
// Use transaction to handle active flag
|
||||
const version = await db.$transaction(async (tx) => {
|
||||
// If setActive, deactivate all other versions
|
||||
if (setActive) {
|
||||
await tx.videoVersion.updateMany({
|
||||
where: { videoParentId: videoId },
|
||||
data: { isActive: false },
|
||||
});
|
||||
}
|
||||
|
||||
return tx.videoVersion.create({
|
||||
data: {
|
||||
versionNumber: nextVersionNumber,
|
||||
versionLabel: versionLabel?.trim() || null,
|
||||
providerId: providerId || 'youtube',
|
||||
videoId: providerVideoId || '',
|
||||
originalUrl: videoUrl,
|
||||
title: versionLabel?.trim() || `Version ${nextVersionNumber}`,
|
||||
thumbnailUrl: thumbnailUrl || null,
|
||||
duration: duration || null,
|
||||
isActive: setActive ?? false,
|
||||
videoParentId: videoId,
|
||||
},
|
||||
include: {
|
||||
_count: { select: { comments: true } },
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
return NextResponse.json(version, { status: 201 });
|
||||
} catch (error) {
|
||||
console.error('Error creating version:', error);
|
||||
return NextResponse.json(
|
||||
{ error: 'Failed to create version' },
|
||||
{ status: 500 }
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,149 @@
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { db } from '@/lib/db';
|
||||
import { auth } from '@/lib/auth';
|
||||
import { ProjectMemberRole } from '@prisma/client';
|
||||
import { validateUrl, validateOptionalUrl } from '@/lib/validation';
|
||||
|
||||
type RouteParams = { params: Promise<{ projectId: string }> };
|
||||
|
||||
// GET /api/projects/[projectId]/videos - List all videos in a project
|
||||
export async function GET(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const session = await auth();
|
||||
const { projectId } = await params;
|
||||
|
||||
// Check project exists and user has access
|
||||
const project = await db.project.findUnique({
|
||||
where: { id: projectId },
|
||||
include: { members: { where: { userId: session?.user?.id || '' } } },
|
||||
});
|
||||
|
||||
if (!project) {
|
||||
return NextResponse.json({ error: 'Project not found' }, { status: 404 });
|
||||
}
|
||||
|
||||
const isOwner = session?.user?.id === project.ownerId;
|
||||
const isMember = project.members.length > 0;
|
||||
const isPublicOrLink = project.visibility !== 'PRIVATE';
|
||||
|
||||
if (!isOwner && !isMember && !isPublicOrLink) {
|
||||
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
|
||||
}
|
||||
|
||||
const videos = await db.video.findMany({
|
||||
where: { projectId },
|
||||
orderBy: { position: 'asc' },
|
||||
include: {
|
||||
versions: {
|
||||
orderBy: { versionNumber: 'desc' },
|
||||
include: {
|
||||
_count: { select: { comments: true } },
|
||||
},
|
||||
},
|
||||
_count: { select: { versions: true } },
|
||||
},
|
||||
});
|
||||
|
||||
return NextResponse.json({ videos });
|
||||
} catch (error) {
|
||||
console.error('Error fetching videos:', error);
|
||||
return NextResponse.json(
|
||||
{ error: 'Failed to fetch videos' },
|
||||
{ status: 500 }
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// POST /api/projects/[projectId]/videos - Add a new video to the project
|
||||
export async function POST(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const session = await auth();
|
||||
const { projectId } = await params;
|
||||
|
||||
if (!session?.user?.id) {
|
||||
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
|
||||
}
|
||||
|
||||
// Check project access (must be owner, admin, or editor)
|
||||
const project = await db.project.findUnique({
|
||||
where: { id: projectId },
|
||||
include: { members: { where: { userId: session.user.id } } },
|
||||
});
|
||||
|
||||
if (!project) {
|
||||
return NextResponse.json({ error: 'Project not found' }, { status: 404 });
|
||||
}
|
||||
|
||||
const isOwner = project.ownerId === session.user.id;
|
||||
const membership = project.members[0];
|
||||
const canEdit = isOwner ||
|
||||
membership?.role === ProjectMemberRole.ADMIN ||
|
||||
membership?.role === ProjectMemberRole.EDITOR;
|
||||
|
||||
if (!canEdit) {
|
||||
return NextResponse.json({ error: 'Access denied' }, { status: 403 });
|
||||
}
|
||||
|
||||
const body = await request.json();
|
||||
const { title, description, videoUrl, providerId, videoId, thumbnailUrl, duration } = body;
|
||||
|
||||
if (!title || !videoUrl) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Title and video URL are required' },
|
||||
{ status: 400 }
|
||||
);
|
||||
}
|
||||
|
||||
// Validate URLs use safe schemes (http/https only)
|
||||
const videoUrlError = validateUrl(videoUrl, 'Video URL');
|
||||
if (videoUrlError) {
|
||||
return NextResponse.json({ error: videoUrlError }, { status: 400 });
|
||||
}
|
||||
|
||||
const thumbnailUrlError = validateOptionalUrl(thumbnailUrl, 'Thumbnail URL');
|
||||
if (thumbnailUrlError) {
|
||||
return NextResponse.json({ error: thumbnailUrlError }, { status: 400 });
|
||||
}
|
||||
|
||||
// Get the next position
|
||||
const lastVideo = await db.video.findFirst({
|
||||
where: { projectId },
|
||||
orderBy: { position: 'desc' },
|
||||
});
|
||||
const nextPosition = (lastVideo?.position ?? -1) + 1;
|
||||
|
||||
// Create video with initial version
|
||||
const video = await db.video.create({
|
||||
data: {
|
||||
title: title.trim(),
|
||||
description: description?.trim() || null,
|
||||
position: nextPosition,
|
||||
projectId,
|
||||
versions: {
|
||||
create: {
|
||||
versionNumber: 1,
|
||||
providerId: providerId || 'youtube',
|
||||
videoId: videoId || '',
|
||||
originalUrl: videoUrl,
|
||||
title: title.trim(),
|
||||
thumbnailUrl: thumbnailUrl || null,
|
||||
duration: duration || null,
|
||||
isActive: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
include: {
|
||||
versions: true,
|
||||
_count: { select: { versions: true } },
|
||||
},
|
||||
});
|
||||
|
||||
return NextResponse.json(video, { status: 201 });
|
||||
} catch (error) {
|
||||
console.error('Error creating video:', error);
|
||||
return NextResponse.json(
|
||||
{ error: 'Failed to create video' },
|
||||
{ status: 500 }
|
||||
);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user