Initial commit: Kalendartool (Next.js, Prisma, Docker)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Kühn
98
app/api/calendars/[id]/invites/route.ts
Normal file
98
app/api/calendars/[id]/invites/route.ts
Normal file
@@ -0,0 +1,98 @@
|
||||
/**
|
||||
* POST /api/calendars/[id]/invites - Invite-Link erstellen (nur Owner-Admin).
|
||||
* GET /api/calendars/[id]/invites - Invite-Uebersicht (Aktiv/Abgelaufen/Verwendet).
|
||||
*/
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { prisma } from '@/lib/db/client';
|
||||
import { requireCalendarContext } from '@/lib/api/context';
|
||||
import { createInviteSchema } from '@/lib/validation';
|
||||
import { canManageCalendar } from '@/lib/permissions/permissions';
|
||||
import {
|
||||
generateInviteToken,
|
||||
hashInviteToken,
|
||||
defaultInviteExpiry,
|
||||
} from '@/lib/invites/tokens';
|
||||
import { getConfig } from '@/lib/config';
|
||||
import { errorResponse, forbiddenResponse } from '@/lib/api/responses';
|
||||
|
||||
interface RouteParams {
|
||||
params: Promise<{ id: string }>;
|
||||
}
|
||||
|
||||
export async function POST(
|
||||
request: NextRequest,
|
||||
{ params }: RouteParams,
|
||||
): Promise<NextResponse> {
|
||||
try {
|
||||
const { id } = await params;
|
||||
const context = await requireCalendarContext(id);
|
||||
|
||||
if (!canManageCalendar(context.user, context.calendar)) {
|
||||
return forbiddenResponse();
|
||||
}
|
||||
|
||||
const body = createInviteSchema.parse(await request.json());
|
||||
const expiry = body.expiresInDays
|
||||
? new Date(Date.now() + body.expiresInDays * 24 * 60 * 60 * 1000)
|
||||
: defaultInviteExpiry();
|
||||
|
||||
// Klartext-Token wird genau einmal zurueckgegeben; in der DB
|
||||
// liegt ausschliesslich der Hash (plan.md Abschnitt 9).
|
||||
const token = generateInviteToken();
|
||||
const invite = await prisma.invite.create({
|
||||
data: {
|
||||
calendarId: id,
|
||||
tokenHash: hashInviteToken(token),
|
||||
expiresAt: expiry,
|
||||
},
|
||||
select: { id: true, expiresAt: true, createdAt: true },
|
||||
});
|
||||
|
||||
return NextResponse.json(
|
||||
{
|
||||
invite,
|
||||
inviteUrl: `${getConfig().appUrl}/invite/${token}`,
|
||||
},
|
||||
{ status: 201 },
|
||||
);
|
||||
} catch (error) {
|
||||
return errorResponse(error);
|
||||
}
|
||||
}
|
||||
|
||||
export async function GET(
|
||||
_request: NextRequest,
|
||||
{ params }: RouteParams,
|
||||
): Promise<NextResponse> {
|
||||
try {
|
||||
const { id } = await params;
|
||||
const context = await requireCalendarContext(id);
|
||||
|
||||
if (!canManageCalendar(context.user, context.calendar)) {
|
||||
return forbiddenResponse();
|
||||
}
|
||||
|
||||
const invites = await prisma.invite.findMany({
|
||||
where: { calendarId: id },
|
||||
orderBy: { createdAt: 'desc' },
|
||||
select: { id: true, expiresAt: true, usedAt: true, createdAt: true },
|
||||
});
|
||||
|
||||
const now = new Date();
|
||||
const summary = {
|
||||
active: invites.filter(
|
||||
(invite) =>
|
||||
invite.usedAt === null &&
|
||||
(invite.expiresAt === null || invite.expiresAt > now),
|
||||
).length,
|
||||
expired: invites.filter(
|
||||
(invite) => invite.usedAt === null && invite.expiresAt !== null && invite.expiresAt <= now,
|
||||
).length,
|
||||
used: invites.filter((invite) => invite.usedAt !== null).length,
|
||||
};
|
||||
|
||||
return NextResponse.json({ invites, summary });
|
||||
} catch (error) {
|
||||
return errorResponse(error);
|
||||
}
|
||||
}
|
||||
144
app/api/calendars/[id]/members/route.ts
Normal file
144
app/api/calendars/[id]/members/route.ts
Normal file
@@ -0,0 +1,144 @@
|
||||
/**
|
||||
* GET /api/calendars/[id]/members - Mitgliederliste (nur Admin).
|
||||
* POST /api/calendars/[id]/members - User per E-Mail hinzufuegen (nur Admin).
|
||||
* DELETE /api/calendars/[id]/members - Mitglied entfernen (nur Admin).
|
||||
*
|
||||
* DB-basiertes Einladungssystem: Statt Invite-Links werden Benutzer
|
||||
* direkt per E-Mail-Suche ueber die Datenbank zugeordnet. Der Server
|
||||
* prueft die Verwaltungsberechtigung zentral (canManageCalendar).
|
||||
*/
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { prisma } from '@/lib/db/client';
|
||||
import { requireCalendarContext } from '@/lib/api/context';
|
||||
import { addMemberSchema } from '@/lib/validation';
|
||||
import { canManageCalendar } from '@/lib/permissions/permissions';
|
||||
import { errorResponse, forbiddenResponse, notFoundResponse } from '@/lib/api/responses';
|
||||
|
||||
interface RouteParams {
|
||||
params: Promise<{ id: string }>;
|
||||
}
|
||||
|
||||
/** Prueft Admin-Berechtigung fuer die Member-Verwaltung. */
|
||||
async function requireManageContext(calendarId: string) {
|
||||
const context = await requireCalendarContext(calendarId);
|
||||
if (!canManageCalendar(context.user, context.calendar)) {
|
||||
return null;
|
||||
}
|
||||
return context;
|
||||
}
|
||||
|
||||
export async function GET(
|
||||
_request: NextRequest,
|
||||
{ params }: RouteParams,
|
||||
): Promise<NextResponse> {
|
||||
try {
|
||||
const { id } = await params;
|
||||
const context = await requireManageContext(id);
|
||||
if (!context) {
|
||||
return forbiddenResponse();
|
||||
}
|
||||
|
||||
const members = await prisma.calendarMember.findMany({
|
||||
where: { calendarId: id },
|
||||
orderBy: { createdAt: 'asc' },
|
||||
select: {
|
||||
id: true,
|
||||
createdAt: true,
|
||||
user: { select: { id: true, email: true, username: true } },
|
||||
},
|
||||
});
|
||||
|
||||
return NextResponse.json({ members });
|
||||
} catch (error) {
|
||||
return errorResponse(error);
|
||||
}
|
||||
}
|
||||
|
||||
export async function POST(
|
||||
request: NextRequest,
|
||||
{ params }: RouteParams,
|
||||
): Promise<NextResponse> {
|
||||
try {
|
||||
const { id } = await params;
|
||||
const context = await requireManageContext(id);
|
||||
if (!context) {
|
||||
return forbiddenResponse();
|
||||
}
|
||||
|
||||
const body = addMemberSchema.parse(await request.json());
|
||||
|
||||
const targetUser = await prisma.user.findUnique({
|
||||
where: { email: body.email },
|
||||
select: { id: true, email: true },
|
||||
});
|
||||
if (!targetUser) {
|
||||
return notFoundResponse(
|
||||
'Kein Benutzer mit dieser E-Mail gefunden. Der Benutzer muss sich zuerst registrieren.',
|
||||
);
|
||||
}
|
||||
|
||||
// Ein User gehoert genau einem Kalender an (unique auf user_id).
|
||||
const existingMembership = await prisma.calendarMember.findUnique({
|
||||
where: { userId: targetUser.id },
|
||||
select: { calendarId: true },
|
||||
});
|
||||
if (existingMembership) {
|
||||
return NextResponse.json(
|
||||
{
|
||||
error:
|
||||
existingMembership.calendarId === id
|
||||
? 'Dieser Benutzer ist bereits Mitglied dieses Kalenders.'
|
||||
: 'Dieser Benutzer ist bereits einem anderen Kalender zugeordnet.',
|
||||
},
|
||||
{ status: 409 },
|
||||
);
|
||||
}
|
||||
|
||||
const member = await prisma.calendarMember.create({
|
||||
data: { calendarId: id, userId: targetUser.id },
|
||||
select: {
|
||||
id: true,
|
||||
createdAt: true,
|
||||
user: { select: { id: true, email: true } },
|
||||
},
|
||||
});
|
||||
|
||||
return NextResponse.json({ member }, { status: 201 });
|
||||
} catch (error) {
|
||||
return errorResponse(error);
|
||||
}
|
||||
}
|
||||
|
||||
export async function DELETE(
|
||||
request: NextRequest,
|
||||
{ params }: RouteParams,
|
||||
): Promise<NextResponse> {
|
||||
try {
|
||||
const { id } = await params;
|
||||
const context = await requireManageContext(id);
|
||||
if (!context) {
|
||||
return forbiddenResponse();
|
||||
}
|
||||
|
||||
const memberId = request.nextUrl.searchParams.get('memberId');
|
||||
if (!memberId) {
|
||||
return NextResponse.json(
|
||||
{ error: 'memberId ist erforderlich.' },
|
||||
{ status: 400 },
|
||||
);
|
||||
}
|
||||
|
||||
const member = await prisma.calendarMember.findUnique({
|
||||
where: { id: memberId },
|
||||
select: { id: true, calendarId: true },
|
||||
});
|
||||
if (!member || member.calendarId !== id) {
|
||||
return notFoundResponse('Mitglied nicht gefunden.');
|
||||
}
|
||||
|
||||
await prisma.calendarMember.delete({ where: { id: memberId } });
|
||||
return NextResponse.json({ ok: true });
|
||||
} catch (error) {
|
||||
return errorResponse(error);
|
||||
}
|
||||
}
|
||||
121
app/api/calendars/[id]/reservations/route.ts
Normal file
121
app/api/calendars/[id]/reservations/route.ts
Normal file
@@ -0,0 +1,121 @@
|
||||
/**
|
||||
* GET /api/calendars/[id]/reservations - Reservierungen eines Kalenders.
|
||||
* POST /api/calendars/[id]/reservations - neue Reservierung (atomar).
|
||||
*
|
||||
* Berechtigungen werden serverseitig ueber die zentrale
|
||||
* Berechtigungsschicht erzwungen (plan.md Abschnitt 2 und 20).
|
||||
*
|
||||
* Sichtbarkeiten: Titel und Notizen fremder Reservierungen werden
|
||||
* fuer Nicht-Admins gemaess der Kalender-Einstellungen geschwaerzt
|
||||
* (show_title_to_members / show_notes_to_members).
|
||||
*/
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { prisma } from '@/lib/db/client';
|
||||
import { requireCalendarContext } from '@/lib/api/context';
|
||||
import { createReservationSchema } from '@/lib/validation';
|
||||
import { canCreateReservation } from '@/lib/permissions/permissions';
|
||||
import { createReservationAtomically } from '@/lib/reservations/service';
|
||||
import { errorResponse, forbiddenResponse } from '@/lib/api/responses';
|
||||
import { displayName } from '@/lib/privacy/display';
|
||||
|
||||
interface RouteParams {
|
||||
params: Promise<{ id: string }>;
|
||||
}
|
||||
|
||||
export async function GET(
|
||||
request: NextRequest,
|
||||
{ params }: RouteParams,
|
||||
): Promise<NextResponse> {
|
||||
try {
|
||||
const { id } = await params;
|
||||
const context = await requireCalendarContext(id);
|
||||
|
||||
// Optionales Zeitfenster-Filter (Monat/Woche/Tag-Ansicht).
|
||||
// Overlap-Bedingung (startAt < to UND endAt > from) statt Enthaltensein:
|
||||
// Eine Reservierung muss zurueckgegeben werden, wenn sie den
|
||||
// Zeitraum auch nur teilweise ueberdeckt (z. B. Mehrtages-Reservierung,
|
||||
// die vor dem Fenster beginnt oder danach endet).
|
||||
const from = request.nextUrl.searchParams.get('from');
|
||||
const to = request.nextUrl.searchParams.get('to');
|
||||
|
||||
const reservations = await prisma.reservation.findMany({
|
||||
where: {
|
||||
calendarId: id,
|
||||
status: 'CONFIRMED',
|
||||
...(from && to
|
||||
? { startAt: { lt: new Date(to) }, endAt: { gt: new Date(from) } }
|
||||
: {}),
|
||||
},
|
||||
orderBy: { startAt: 'asc' },
|
||||
select: {
|
||||
id: true,
|
||||
userId: true,
|
||||
title: true,
|
||||
startAt: true,
|
||||
endAt: true,
|
||||
status: true,
|
||||
notes: true,
|
||||
user: { select: { email: true, username: true } },
|
||||
},
|
||||
});
|
||||
|
||||
const showForeignTitles =
|
||||
context.user.role === 'ADMIN' || context.calendar.showTitleToMembers;
|
||||
const showForeignNotes =
|
||||
context.user.role === 'ADMIN' || context.calendar.showNotesToMembers;
|
||||
|
||||
return NextResponse.json({
|
||||
reservations: reservations.map((reservation) => {
|
||||
const isOwn = reservation.userId === context.user.id;
|
||||
return {
|
||||
id: reservation.id,
|
||||
userId: reservation.userId,
|
||||
title: isOwn || showForeignTitles ? reservation.title : 'Gebucht',
|
||||
startAt: reservation.startAt,
|
||||
endAt: reservation.endAt,
|
||||
status: reservation.status,
|
||||
notes: isOwn || showForeignNotes ? reservation.notes : null,
|
||||
// Datenschutz: Keine vollstaendigen E-Mail-Adressen an
|
||||
// Mitglieder; nur Username oder maskierte E-Mail.
|
||||
ownerName: displayName(
|
||||
reservation.user.username,
|
||||
reservation.user.email,
|
||||
),
|
||||
};
|
||||
}),
|
||||
});
|
||||
} catch (error) {
|
||||
return errorResponse(error);
|
||||
}
|
||||
}
|
||||
|
||||
export async function POST(
|
||||
request: NextRequest,
|
||||
{ params }: RouteParams,
|
||||
): Promise<NextResponse> {
|
||||
try {
|
||||
const { id } = await params;
|
||||
const context = await requireCalendarContext(id);
|
||||
|
||||
if (!canCreateReservation(context.user, context.calendar, context.isMember)) {
|
||||
return forbiddenResponse();
|
||||
}
|
||||
|
||||
const body = createReservationSchema.parse(await request.json());
|
||||
|
||||
// Serverseitige, atomare Pruefung (plan.md Abschnitt 6 und 15):
|
||||
// Kalender gueltig? Benutzer berechtigt? Max-Dauer? Zeit verfuegbar?
|
||||
const reservation = await createReservationAtomically({
|
||||
calendarId: id,
|
||||
userId: context.user.id,
|
||||
title: body.title,
|
||||
startAt: body.startAt,
|
||||
endAt: body.endAt,
|
||||
notes: body.notes ?? null,
|
||||
});
|
||||
|
||||
return NextResponse.json({ reservation }, { status: 201 });
|
||||
} catch (error) {
|
||||
return errorResponse(error);
|
||||
}
|
||||
}
|
||||
79
app/api/calendars/[id]/route.ts
Normal file
79
app/api/calendars/[id]/route.ts
Normal file
@@ -0,0 +1,79 @@
|
||||
/**
|
||||
* GET /api/calendars/[id] - Kalenderdetails (Owner oder Member).
|
||||
* PATCH /api/calendars/[id] - bearbeiten (nur besitzender Admin).
|
||||
*/
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { prisma } from '@/lib/db/client';
|
||||
import { requireCalendarContext } from '@/lib/api/context';
|
||||
import { updateCalendarSchema } from '@/lib/validation';
|
||||
import { canManageCalendar } from '@/lib/permissions/permissions';
|
||||
import { errorResponse, forbiddenResponse } from '@/lib/api/responses';
|
||||
|
||||
interface RouteParams {
|
||||
params: Promise<{ id: string }>;
|
||||
}
|
||||
|
||||
export async function GET(
|
||||
_request: NextRequest,
|
||||
{ params }: RouteParams,
|
||||
): Promise<NextResponse> {
|
||||
try {
|
||||
const { id } = await params;
|
||||
const context = await requireCalendarContext(id);
|
||||
|
||||
return NextResponse.json({ calendar: context.calendar });
|
||||
} catch (error) {
|
||||
return errorResponse(error);
|
||||
}
|
||||
}
|
||||
|
||||
export async function PATCH(
|
||||
request: NextRequest,
|
||||
{ params }: RouteParams,
|
||||
): Promise<NextResponse> {
|
||||
try {
|
||||
const { id } = await params;
|
||||
const context = await requireCalendarContext(id);
|
||||
|
||||
if (!canManageCalendar(context.user, context.calendar)) {
|
||||
return forbiddenResponse();
|
||||
}
|
||||
|
||||
const body = updateCalendarSchema.parse(await request.json());
|
||||
|
||||
const calendar = await prisma.calendar.update({
|
||||
where: { id },
|
||||
data: {
|
||||
...(body.title !== undefined ? { title: body.title } : {}),
|
||||
...(body.description !== undefined
|
||||
? { description: body.description }
|
||||
: {}),
|
||||
...(body.timezone !== undefined ? { timezone: body.timezone } : {}),
|
||||
...(body.isActive !== undefined ? { isActive: body.isActive } : {}),
|
||||
...(body.maxReservationMinutes !== undefined
|
||||
? { maxReservationMinutes: body.maxReservationMinutes }
|
||||
: {}),
|
||||
...(body.showTitleToMembers !== undefined
|
||||
? { showTitleToMembers: body.showTitleToMembers }
|
||||
: {}),
|
||||
...(body.showNotesToMembers !== undefined
|
||||
? { showNotesToMembers: body.showNotesToMembers }
|
||||
: {}),
|
||||
},
|
||||
select: {
|
||||
id: true,
|
||||
title: true,
|
||||
description: true,
|
||||
timezone: true,
|
||||
isActive: true,
|
||||
maxReservationMinutes: true,
|
||||
showTitleToMembers: true,
|
||||
showNotesToMembers: true,
|
||||
},
|
||||
});
|
||||
|
||||
return NextResponse.json({ calendar });
|
||||
} catch (error) {
|
||||
return errorResponse(error);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user