|
| 1 | +import { db } from '@sim/db' |
| 2 | +import { workflowFolder } from '@sim/db/schema' |
| 3 | +import { createLogger } from '@sim/logger' |
| 4 | +import { eq, inArray } from 'drizzle-orm' |
| 5 | +import { type NextRequest, NextResponse } from 'next/server' |
| 6 | +import { z } from 'zod' |
| 7 | +import { getSession } from '@/lib/auth' |
| 8 | +import { generateRequestId } from '@/lib/core/utils/request' |
| 9 | +import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils' |
| 10 | + |
| 11 | +const logger = createLogger('FolderReorderAPI') |
| 12 | + |
| 13 | +const ReorderSchema = z.object({ |
| 14 | + workspaceId: z.string(), |
| 15 | + updates: z.array( |
| 16 | + z.object({ |
| 17 | + id: z.string(), |
| 18 | + sortOrder: z.number().int().min(0), |
| 19 | + parentId: z.string().nullable().optional(), |
| 20 | + }) |
| 21 | + ), |
| 22 | +}) |
| 23 | + |
| 24 | +export async function PUT(req: NextRequest) { |
| 25 | + const requestId = generateRequestId() |
| 26 | + const session = await getSession() |
| 27 | + |
| 28 | + if (!session?.user?.id) { |
| 29 | + logger.warn(`[${requestId}] Unauthorized folder reorder attempt`) |
| 30 | + return NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) |
| 31 | + } |
| 32 | + |
| 33 | + try { |
| 34 | + const body = await req.json() |
| 35 | + const { workspaceId, updates } = ReorderSchema.parse(body) |
| 36 | + |
| 37 | + const permission = await getUserEntityPermissions(session.user.id, 'workspace', workspaceId) |
| 38 | + if (!permission || permission === 'read') { |
| 39 | + logger.warn( |
| 40 | + `[${requestId}] User ${session.user.id} lacks write permission for workspace ${workspaceId}` |
| 41 | + ) |
| 42 | + return NextResponse.json({ error: 'Write access required' }, { status: 403 }) |
| 43 | + } |
| 44 | + |
| 45 | + const folderIds = updates.map((u) => u.id) |
| 46 | + const existingFolders = await db |
| 47 | + .select({ id: workflowFolder.id, workspaceId: workflowFolder.workspaceId }) |
| 48 | + .from(workflowFolder) |
| 49 | + .where(inArray(workflowFolder.id, folderIds)) |
| 50 | + |
| 51 | + const validIds = new Set( |
| 52 | + existingFolders.filter((f) => f.workspaceId === workspaceId).map((f) => f.id) |
| 53 | + ) |
| 54 | + |
| 55 | + const validUpdates = updates.filter((u) => validIds.has(u.id)) |
| 56 | + |
| 57 | + if (validUpdates.length === 0) { |
| 58 | + return NextResponse.json({ error: 'No valid folders to update' }, { status: 400 }) |
| 59 | + } |
| 60 | + |
| 61 | + await db.transaction(async (tx) => { |
| 62 | + for (const update of validUpdates) { |
| 63 | + const updateData: Record<string, unknown> = { |
| 64 | + sortOrder: update.sortOrder, |
| 65 | + updatedAt: new Date(), |
| 66 | + } |
| 67 | + if (update.parentId !== undefined) { |
| 68 | + updateData.parentId = update.parentId |
| 69 | + } |
| 70 | + await tx.update(workflowFolder).set(updateData).where(eq(workflowFolder.id, update.id)) |
| 71 | + } |
| 72 | + }) |
| 73 | + |
| 74 | + logger.info( |
| 75 | + `[${requestId}] Reordered ${validUpdates.length} folders in workspace ${workspaceId}` |
| 76 | + ) |
| 77 | + |
| 78 | + return NextResponse.json({ success: true, updated: validUpdates.length }) |
| 79 | + } catch (error) { |
| 80 | + if (error instanceof z.ZodError) { |
| 81 | + logger.warn(`[${requestId}] Invalid folder reorder data`, { errors: error.errors }) |
| 82 | + return NextResponse.json( |
| 83 | + { error: 'Invalid request data', details: error.errors }, |
| 84 | + { status: 400 } |
| 85 | + ) |
| 86 | + } |
| 87 | + |
| 88 | + logger.error(`[${requestId}] Error reordering folders`, error) |
| 89 | + return NextResponse.json({ error: 'Failed to reorder folders' }, { status: 500 }) |
| 90 | + } |
| 91 | +} |
0 commit comments