Speisekarte/app/api/sections/route.ts

import { NextResponse } from "next/server";
import { query, queryOne } from "@/lib/db";
import { authErrorResponse, requireRole } from "@/lib/auth/session";
import { isSameOrigin } from "@/lib/origin";
import type { Section } from "@/lib/types";

export async function GET() {
  const sections = await query<Section>("select * from sections order by sort");
  return NextResponse.json(sections);
}

export async function POST(request: Request) {
  if (!isSameOrigin(request)) {
    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
  }
  try {
    await requireRole(["staff", "admin"]);
    const body = (await request.json()) as {
      label: string;
      label_en: string | null;
      label_pl: string | null;
      time_range: string;
    };

    const maxRow = await queryOne<{ sort: number }>(
      "select sort from sections order by sort desc limit 1"
    );
    const section = await queryOne<Section>(
      `insert into sections (label, label_en, label_pl, time_range, sort)
       values ($1, $2, $3, $4, $5) returning *`,
      [body.label, body.label_en, body.label_pl, body.time_range, (maxRow?.sort ?? 0) + 1]
    );
    return NextResponse.json(section, { status: 201 });
  } catch (err) {
    const res = authErrorResponse(err);
    if (res) return res;
    throw err;
  }
}