feat : comment feature

app/api/admin/comments/route.ts

@@ -0,0 +1,13 @@
+import { listComments, requireCommentAdmin, requireCommentViewer } from "@/lib/comments/repository";
+import { errorResponse } from "@/lib/security/http";
+
+export async function GET(request: Request) {
+  try {
+    const viewer = await requireCommentViewer();
+    requireCommentAdmin(viewer);
+    const query = new URL(request.url).searchParams;
+    return Response.json(await listComments({ viewer, inbox: true, target: query.get("target") || undefined,
+      status: query.get("status") || undefined, unanswered: query.get("unanswered") === "true", cursor: query.get("cursor") }),
+    { headers: { "Cache-Control": "private, no-store" } });
+  } catch (cause) { return errorResponse(cause); }
+}

app/api/admin/comments/unread/route.ts

@@ -0,0 +1,21 @@
+import * as z from "zod";
+import { requireCommentViewer } from "@/lib/comments/repository";
+import { markCommentsRead, unreadCommentCounts } from "@/lib/comments/unread";
+import { errorResponse, HttpError, readJson, requireSameOrigin } from "@/lib/security/http";
+import { limitRequest } from "@/lib/security/rate-limit";
+
+export async function GET() {
+  try { return Response.json(await unreadCommentCounts(await requireCommentViewer()), { headers: { "Cache-Control": "private, no-store" } }); }
+  catch (cause) { return errorResponse(cause); }
+}
+export async function POST(request: Request) {
+  try {
+    requireSameOrigin(request);
+    const viewer = await requireCommentViewer();
+    await limitRequest("comment-read", viewer.id, 120);
+    const body = z.object({ target: z.string().max(80) }).safeParse(await readJson(request, 1024));
+    if (!body.success) throw new HttpError(400, "invalid-target");
+    await markCommentsRead(viewer, body.data.target);
+    return new Response(null, { status: 204 });
+  } catch (cause) { return errorResponse(cause); }
+}