47 lines
1.4 KiB
TypeScript
47 lines
1.4 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { auth } from "@/auth";
|
|
import { prisma } from "@/lib/db";
|
|
|
|
async function canAccessEvaluation(evaluationId: string, userId: string, isAdmin: boolean) {
|
|
if (isAdmin) return true;
|
|
const eval_ = await prisma.evaluation.findUnique({
|
|
where: { id: evaluationId },
|
|
select: { evaluatorId: true, sharedWith: { select: { userId: true } } },
|
|
});
|
|
if (!eval_) return false;
|
|
if (eval_.evaluatorId === userId) return true;
|
|
if (eval_.sharedWith.some((s) => s.userId === userId)) return true;
|
|
return false;
|
|
}
|
|
|
|
export async function DELETE(
|
|
_req: NextRequest,
|
|
{ params }: { params: Promise<{ id: string; userId: string }> }
|
|
) {
|
|
try {
|
|
const session = await auth();
|
|
if (!session?.user) {
|
|
return NextResponse.json({ error: "Non authentifié" }, { status: 401 });
|
|
}
|
|
const { id, userId } = await params;
|
|
|
|
const hasAccess = await canAccessEvaluation(
|
|
id,
|
|
session.user.id,
|
|
session.user.role === "admin"
|
|
);
|
|
if (!hasAccess) {
|
|
return NextResponse.json({ error: "Accès refusé" }, { status: 403 });
|
|
}
|
|
|
|
await prisma.evaluationShare.deleteMany({
|
|
where: { evaluationId: id, userId },
|
|
});
|
|
|
|
return NextResponse.json({ ok: true });
|
|
} catch (e) {
|
|
console.error(e);
|
|
return NextResponse.json({ error: "Erreur" }, { status: 500 });
|
|
}
|
|
}
|