root/chadebebe
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: allow anonymous public wishlist viewing

Browse Source
This commit is contained in:
Adriano Belisario
2026-05-04 00:09:43 +00:00
parent 6c8e11c851
commit 78bef85c96
6 changed files with 31 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
app/api/wishlists/[id]/items/route.ts
View File

@@ -11,12 +11,6 @@ export async function GET(
try {
const { id } = await params;
const isAdmin = verifyAdminToken(request);
const guest = await getGuestFromRequest(request);
if (!isAdmin && !guest) {
return NextResponse.json({ error: 'Convite necessário' }, { status: 401 });
}
// Check if wishlist exists
const wishlist = await db
.select()
@@ -31,11 +25,14 @@ export async function GET(
);
}
// Permissions: guest can only see public wishlists; admin sees all
if (!wishlist[0].isPublic && !isAdmin) {
const isAdmin = verifyAdminToken(request);
const guest = await getGuestFromRequest(request);
// Public wishlists can be viewed anonymously; private wishlists require admin or guest access.
if (!wishlist[0].isPublic && !isAdmin && !guest) {
return NextResponse.json(
{ error: 'This wishlist is private' },
{ status: 403 }
{ error: 'Convite necessário' },
{ status: 401 }
);
}