root/chadebebe
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: allow anonymous public wishlist viewing

Browse Source
This commit is contained in:
Adriano Belisario
2026-05-04 00:09:43 +00:00
parent 6c8e11c851
commit 78bef85c96
6 changed files with 31 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
app/api/[slug]/route.ts
View File

@@ -8,13 +8,9 @@ export async function GET(
{ params }: { params: Promise<{ slug: string }> }
) {
try {
const { slug } = await params;
const isAdmin = verifyAdminToken(request);
const guest = await getGuestFromRequest(request);
if (!isAdmin && !guest) {
return NextResponse.json({ error: 'Convite necessário' }, { status: 401 });
}
const { slug } = await params;
const wishlist = await db
.select()
@@ -29,11 +25,11 @@ export async function GET(
);
}
// Only return public wishlists (admin can see all)
if (!wishlist[0].isPublic && !isAdmin) {
// Public wishlists can be viewed anonymously; private wishlists require admin or guest access.
if (!wishlist[0].isPublic && !isAdmin && !guest) {
return NextResponse.json(
{ error: 'Wishlist not found' },
{ status: 404 }
{ error: 'Convite necessário' },
{ status: 401 }
);
}

15
app/api/items/[id]/route.ts
View File

@@ -11,12 +11,6 @@ export async function GET(
try {
const { id } = await params;
const isAdmin = verifyAdminToken(request);
const guest = await getGuestFromRequest(request);
if (!isAdmin && !guest) {
return NextResponse.json({ error: 'Convite necessário' }, { status: 401 });
}
// Get item
const item = await db
.select()
@@ -45,10 +39,13 @@ export async function GET(
);
}
if (!wishlist[0].isPublic && !isAdmin) {
const isAdmin = verifyAdminToken(request);
const guest = await getGuestFromRequest(request);
if (!wishlist[0].isPublic && !isAdmin && !guest) {
return NextResponse.json(
{ error: 'This item is private' },
{ status: 403 }
{ error: 'Convite necessário' },
{ status: 401 }
);
}

11
app/api/public/wishlists/route.ts
View File

@@ -1,16 +1,9 @@
import { NextRequest, NextResponse } from 'next/server';
import { NextResponse } from 'next/server';
import { eq, asc } from 'drizzle-orm';
import { db, wishlists } from '@/lib/db';
import { getGuestFromRequest, verifyAdminToken } from '@/lib/auth/tokens';
export async function GET(request: NextRequest) {
export async function GET() {
try {
const isAdmin = verifyAdminToken(request);
const guest = await getGuestFromRequest(request);
if (!isAdmin && !guest) {
return NextResponse.json({ error: 'Convite necessário' }, { status: 401 });
}
// Fetch only public wishlists
const publicWishlists = await db
.select()

17
app/api/wishlists/[id]/items/route.ts
View File

@@ -11,12 +11,6 @@ export async function GET(
try {
const { id } = await params;
const isAdmin = verifyAdminToken(request);
const guest = await getGuestFromRequest(request);
if (!isAdmin && !guest) {
return NextResponse.json({ error: 'Convite necessário' }, { status: 401 });
}
// Check if wishlist exists
const wishlist = await db
.select()
@@ -31,11 +25,14 @@ export async function GET(
);
}
// Permissions: guest can only see public wishlists; admin sees all
if (!wishlist[0].isPublic && !isAdmin) {
const isAdmin = verifyAdminToken(request);
const guest = await getGuestFromRequest(request);
// Public wishlists can be viewed anonymously; private wishlists require admin or guest access.
if (!wishlist[0].isPublic && !isAdmin && !guest) {
return NextResponse.json(
{ error: 'This wishlist is private' },
{ status: 403 }
{ error: 'Convite necessário' },
{ status: 401 }
);
}