Pascal
cfda014760
- Remove explicit ADMIN role checks in API handlers - Replace combined creator/member role checks with membership-only filters - Update seed data roles to reflect changed authorization logic - Add migration to insert hunt creators as members for consistent checks - Prevent removal of hunt creator as a member with new explicit check - Adjust related user role updates and queries accordingly - Upgrade dependencies including nuxt and zod for compatibility
62 lines
1.3 KiB
TypeScript
62 lines
1.3 KiB
TypeScript
import { useValidatedBody, useValidatedParams, z, zh } from 'h3-zod';
|
|
import prisma from '~~/lib/prisma';
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
const user = await requireUserSession(event);
|
|
|
|
const userId = user.user.id;
|
|
const { answerId } = await useValidatedParams(
|
|
event,
|
|
z.object({
|
|
answerId: zh.numAsString
|
|
})
|
|
);
|
|
|
|
const answer = await prisma.questAnswer.findUnique({
|
|
where: {
|
|
id: answerId,
|
|
quest: {
|
|
hunt: {
|
|
members: {
|
|
some: {
|
|
memberId: userId
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
select: { id: true }
|
|
});
|
|
|
|
if (!answer) {
|
|
throw createError({ status: 404, statusText: 'Not found!' });
|
|
}
|
|
const data = await useValidatedBody(
|
|
event,
|
|
z.object({
|
|
score: z.int().min(0).max(32767).nullable(),
|
|
review: z.string().max(2000).trim().nullable(),
|
|
showcase: z.boolean().nullable().default(false),
|
|
internalNote: z.string().max(256).trim().nullable(),
|
|
rankingValue: z.int().nullable()
|
|
})
|
|
);
|
|
|
|
await prisma.review.upsert({
|
|
where: {
|
|
answerId
|
|
},
|
|
update: {
|
|
...data,
|
|
reviewerId: userId
|
|
},
|
|
create: {
|
|
...data,
|
|
reviewerId: userId,
|
|
answerId
|
|
}
|
|
});
|
|
|
|
return answer;
|
|
});
|