feat(claim): quantity-aware claims via item_claims; per-guest unclaim

app/api/public/items/[id]/unclaim/route.ts

@@ -1,84 +1,50 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { eq } from 'drizzle-orm';
-import { db, wishlistItems, wishlists } from '@/lib/db';
+import { and, eq } from 'drizzle-orm';
+import { db, wishlistItems, wishlists, itemClaims } from '@/lib/db';
+import { getGuestFromRequest, verifyAdminToken } from '@/lib/auth/tokens';
 
 export async function POST(
   request: NextRequest,
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
+    const guest = await getGuestFromRequest(request);
+    const isAdmin = verifyAdminToken(request);
+    if (!guest && !isAdmin) {
+      return NextResponse.json({ error: 'Convite necessário' }, { status: 401 });
+    }
+
     const { id } = await params;
+    const body = await request.json().catch(() => ({}));
 
-    // Get the item
-    const item = await db
-      .select()
-      .from(wishlistItems)
-      .where(eq(wishlistItems.id, id))
-      .limit(1);
-
-    if (item.length === 0) {
-      return NextResponse.json(
-        { error: 'Item not found' },
-        { status: 404 }
-      );
+    const targetGuestId = isAdmin && typeof body?.guestId === 'string' ? body.guestId : guest?.id;
+    if (!targetGuestId) {
+      return NextResponse.json({ error: 'Missing guest' }, { status: 400 });
     }
 
-    // Check if item is actually claimed
-    if (!item[0].claimedByToken) {
-      return NextResponse.json(
-        { error: 'Item is not claimed' },
-        { status: 400 }
-      );
+    const itemRows = await db.select().from(wishlistItems).where(eq(wishlistItems.id, id)).limit(1);
+    if (itemRows.length === 0) return NextResponse.json({ error: 'Item not found' }, { status: 404 });
+
+    const wl = await db.select().from(wishlists).where(eq(wishlists.id, itemRows[0].wishlistId)).limit(1);
+    if (wl.length === 0) return NextResponse.json({ error: 'Wishlist not found' }, { status: 404 });
+    if (!wl[0].isPublic && !isAdmin) {
+      return NextResponse.json({ error: 'This wishlist is private' }, { status: 403 });
     }
 
-    // Check if wishlist is public
-    const wishlist = await db
-      .select()
-      .from(wishlists)
-      .where(eq(wishlists.id, item[0].wishlistId))
-      .limit(1);
-
-    if (wishlist.length === 0) {
-      return NextResponse.json(
-        { error: 'Wishlist not found' },
-        { status: 404 }
-      );
-    }
-
-    if (!wishlist[0].isPublic) {
-      return NextResponse.json(
-        { error: 'This wishlist is private' },
-        { status: 403 }
-      );
-    }
-
-    // Remove claim information (honor system - no verification)
-    const updatedItem = await db
-      .update(wishlistItems)
-      .set({
-        claimedByName: null,
-        claimedByNote: null,
-        claimedByToken: null,
-        claimedAt: null,
-        isPurchased: false,
-        updatedAt: new Date(),
-      })
-      .where(eq(wishlistItems.id, id))
+    const result = await db
+      .delete(itemClaims)
+      .where(and(eq(itemClaims.itemId, id), eq(itemClaims.guestId, targetGuestId)))
       .returning();
 
-    return NextResponse.json(
-      {
-        success: true,
-        message: 'Item unclaimed successfully',
-        item: updatedItem[0],
-      },
-      { status: 200 }
-    );
-  } catch (error) {
-    console.error('Error unclaiming item:', error);
-    return NextResponse.json(
-      { error: 'Failed to unclaim item' },
-      { status: 500 }
-    );
+    if (result.length === 0) {
+      return NextResponse.json({ error: 'Reserva não encontrada' }, { status: 404 });
+    }
+
+    await db.update(wishlistItems).set({ updatedAt: new Date() }).where(eq(wishlistItems.id, id));
+
+    return NextResponse.json({ success: true });
+  } catch (err) {
+    console.error('Error unclaiming item:', err);
+    return NextResponse.json({ error: 'Failed to unclaim item' }, { status: 500 });
   }
 }