70 lines
2.2 KiB
TypeScript
70 lines
2.2 KiB
TypeScript
/**
|
|
* @file app/api/messages/[messageId]/route.ts
|
|
* @description API route handler for deleting a specific message.
|
|
*/
|
|
|
|
import { auth } from "@/auth";
|
|
import { db } from "@/db";
|
|
import { members, messages } from "@/db/schema";
|
|
import { eq } from "drizzle-orm";
|
|
import { NextResponse } from "next/server";
|
|
|
|
/**
|
|
* Handles the DELETE request to remove a specific message by its ID.
|
|
* Verifies user authentication and ensures the user owns the message before deletion.
|
|
*
|
|
* @async
|
|
* @function DELETE
|
|
* @param {Request} req - The incoming HTTP request object.
|
|
* @param {Object} context - The route context.
|
|
* @param {Promise<{ messageId: string }>} context.params - A promise resolving to the route parameters containing the message ID.
|
|
* @returns {Promise<NextResponse>} JSON response indicating success or failure with appropriate HTTP status codes.
|
|
*/
|
|
export async function DELETE(
|
|
req: Request,
|
|
{ params }: { params: Promise<{ messageId: string }> },
|
|
) {
|
|
try {
|
|
const { messageId } = await params;
|
|
const session = await auth();
|
|
|
|
if (!session?.user?.id) {
|
|
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
|
|
// Retrieve a message and its associated member
|
|
const [existingMessage] = await db
|
|
.select({
|
|
id: messages.id,
|
|
memberId: messages.memberId,
|
|
userId: members.userId,
|
|
})
|
|
.from(messages)
|
|
.innerJoin(members, eq(messages.memberId, members.id))
|
|
.where(eq(messages.id, messageId))
|
|
.limit(1);
|
|
|
|
if (!existingMessage) {
|
|
return NextResponse.json({ error: "Message not found" }, { status: 404 });
|
|
}
|
|
|
|
// Check permissions (Is the user the creator of the message?)
|
|
if (existingMessage.userId !== session.user.id) {
|
|
return NextResponse.json(
|
|
{ error: "You do not have permission to delete this message" },
|
|
{ status: 403 },
|
|
);
|
|
}
|
|
|
|
// 3. Nachricht löschen
|
|
await db.delete(messages).where(eq(messages.id, messageId));
|
|
|
|
return NextResponse.json({ success: true });
|
|
} catch (error) {
|
|
console.error("API Message DELETE error:", error);
|
|
return NextResponse.json(
|
|
{ error: "Internal Server Error" },
|
|
{ status: 500 },
|
|
);
|
|
}
|
|
}
|