Speisekarte/app/api/dish-suggestions/[id]/accept/route.ts

import { NextResponse } from "next/server";
import { withTransaction } from "@/lib/db";
import { authErrorResponse, requireRole } from "@/lib/auth/session";
import { isSameOrigin } from "@/lib/origin";

export async function POST(
  request: Request,
  { params }: { params: Promise<{ id: string }> }
) {
  if (!isSameOrigin(request)) {
    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
  }
  try {
    await requireRole(["staff", "admin"]);
    const { id } = await params;

    const created = await withTransaction(async (client) => {
      const suggestion = await client.query<{ name: string }>(
        "select name from dish_suggestions where id = $1",
        [id]
      );
      if (suggestion.rows.length === 0) return null;
      await client.query("insert into dishes (name, price) values ($1, 0)", [
        suggestion.rows[0].name,
      ]);
      await client.query("delete from dish_suggestions where id = $1", [id]);
      return true;
    });

    if (!created) return NextResponse.json({ error: "not_found" }, { status: 404 });
    return NextResponse.json({ ok: true });
  } catch (err) {
    const res = authErrorResponse(err);
    if (res) return res;
    throw err;
  }
}