45 lines
2.1 KiB
JavaScript
45 lines
2.1 KiB
JavaScript
import { savedViewSchema } from '@pokemon-inventory/validation/saved-view';
|
|
|
|
import { createApplicationError } from '../../../shared/errors/application-error.js';
|
|
|
|
export async function registerAdminSavedViewRoutes(app, options) {
|
|
const {
|
|
authenticateAdmin = async () => {
|
|
throw createApplicationError('UNAUTHORIZED', 'Authentication is required.', 401);
|
|
},
|
|
authorizeUnsafeRequest,
|
|
sessionCookieName = 'pokemon_inventory_session',
|
|
savedViewService,
|
|
} = options;
|
|
|
|
app.addHook('preHandler', async (request) => {
|
|
const admin = await authenticateAdmin(request);
|
|
if (!admin?.sellerId) throw createApplicationError('UNAUTHORIZED', 'Authentication is required.', 401);
|
|
request.admin = admin;
|
|
});
|
|
|
|
app.get('/saved-views', async (request) => ({
|
|
data: await savedViewService.list({ sellerId: request.admin.sellerId }),
|
|
}));
|
|
|
|
app.post('/saved-views', async (request, reply) => {
|
|
await authorizeUnsafeRequest?.(request.cookies[sessionCookieName], request.headers['x-csrf-token']);
|
|
const result = savedViewSchema.safeParse(request.body);
|
|
if (!result.success) return reply.code(400).send({ error: { code: 'VALIDATION_ERROR', message: 'Request validation failed.' } });
|
|
return reply.code(201).send({ data: await savedViewService.create({ sellerId: request.admin.sellerId, view: result.data }) });
|
|
});
|
|
|
|
app.patch('/saved-views/:id', async (request, reply) => {
|
|
await authorizeUnsafeRequest?.(request.cookies[sessionCookieName], request.headers['x-csrf-token']);
|
|
const result = savedViewSchema.safeParse(request.body);
|
|
if (!result.success) return reply.code(400).send({ error: { code: 'VALIDATION_ERROR', message: 'Request validation failed.' } });
|
|
return reply.send({ data: await savedViewService.update({ sellerId: request.admin.sellerId, viewId: request.params.id, view: result.data }) });
|
|
});
|
|
|
|
app.delete('/saved-views/:id', async (request, reply) => {
|
|
await authorizeUnsafeRequest?.(request.cookies[sessionCookieName], request.headers['x-csrf-token']);
|
|
await savedViewService.delete({ sellerId: request.admin.sellerId, viewId: request.params.id });
|
|
return reply.code(204).send();
|
|
});
|
|
}
|