14e3ab125b
Error statuses follow one rule: APIException takes a status and derives the code from it (BAD_REQUEST 400, UNAUTHORIZED 401, FORBIDDEN 403, NOT_FOUND 404, CONFLICT 409, RATE_LIMITED 429, SERVER_ERROR 500, BAD_GATEWAY 502), so a code can't contradict its status. That fixed real bugs: a wrong current password on change-password answered 401, on which authFetch signs the user out; editing or deleting someone else's comment or chat message answered 401 rather than 403; one invalid dump edit answered 422. A taken username is 409, like a taken email. Along the way: the database is created from schema.sql by connection.ts when the file doesn't exist, so every task works on a fresh checkout (dev and serve never ran db/init.ts, which is gone); the startup purge compared ISO dates with SQLite's datetime() as text and kept anything from the current UTC day, and now compares ISO cutoffs; the seeded admin's hash comes from lib/password.ts (split out of jwt.ts, which needs the JWT secret) rather than a copy of its format; avatar, thumbnail and playlist-cover uploads go through replaceUploadedFile, which writes beside the old file and renames over it before the record announces it (a failed avatar write lost the old avatar; a thumbnail was announced before it existed); upload.ts derives its size message from MAX_IMAGE_SIZE_BYTES and stops re-exporting the upload folders; ALLOWED_IMAGE_MIMES, which duplicated detectImageMime, is gone; the SPA fallback no longer calls next() after answering; a reply must answer a comment on the same dump (a foreign or unknown parent was a 500 or a cross-dump thread). 211 backend and 628 frontend tests pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
68 lines
2.1 KiB
TypeScript
68 lines
2.1 KiB
TypeScript
/**
|
|
* Serves the caller's own notifications to the client's `/notifications`
|
|
* page, which marks them all read when it opens. New ones arrive over the
|
|
* WebSocket instead, as `notification_created`.
|
|
*
|
|
* - `GET /api/notifications?page=&limit=` — signed in. Answers a page of them,
|
|
* newest first.
|
|
* - `POST /api/notifications/read-all` — signed in. Marks them all read.
|
|
* - `PATCH /api/notifications/:id/read` — signed in. Marks one of them read.
|
|
* The client doesn't use it.
|
|
*
|
|
* @module
|
|
*/
|
|
|
|
import { Router } from "@oak/oak";
|
|
import { type APIResponse, type PaginatedData } from "../../shared/api.ts";
|
|
import { APIException } from "../lib/api-exception.ts";
|
|
import type { Notification } from "../../shared/notification.ts";
|
|
import { parsePagination } from "../lib/pagination.ts";
|
|
import { type AuthContext, authMiddleware } from "../middleware/auth.ts";
|
|
import {
|
|
getNotificationsForUser,
|
|
markAllRead,
|
|
markOneRead,
|
|
} from "../services/notification-service.ts";
|
|
|
|
/**
|
|
* Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
|
|
* An `APIException` thrown by a handler becomes the JSON error response there.
|
|
*/
|
|
const router: Router = new Router({ prefix: "/api/notifications" });
|
|
|
|
router.get("/", authMiddleware, (ctx: AuthContext) => {
|
|
if (!ctx.state.user) {
|
|
throw new APIException(401, "Not authenticated");
|
|
}
|
|
const { page, limit } = parsePagination(ctx.request.url.searchParams);
|
|
const { items, hasMore } = getNotificationsForUser(
|
|
ctx.state.user.userId,
|
|
page,
|
|
limit,
|
|
);
|
|
const responseBody: APIResponse<PaginatedData<Notification>> = {
|
|
success: true,
|
|
data: { items, hasMore },
|
|
};
|
|
ctx.response.body = responseBody;
|
|
});
|
|
|
|
router.post("/read-all", authMiddleware, (ctx: AuthContext) => {
|
|
if (!ctx.state.user) {
|
|
throw new APIException(401, "Not authenticated");
|
|
}
|
|
markAllRead(ctx.state.user.userId);
|
|
ctx.response.status = 204;
|
|
});
|
|
|
|
router.patch("/:id/read", authMiddleware, (ctx) => {
|
|
const user = ctx.state.user;
|
|
if (!user) {
|
|
throw new APIException(401, "Not authenticated");
|
|
}
|
|
markOneRead(ctx.params.id, user.userId);
|
|
ctx.response.status = 204;
|
|
});
|
|
|
|
export default router;
|