31 lines
1.6 KiB
TypeScript
31 lines
1.6 KiB
TypeScript
import { and, eq } from "drizzle-orm";
|
|
import { getDb } from "@/db";
|
|
import { commissionCheckouts } from "@/db/schema";
|
|
import { requireCommissionUser } from "@/lib/commission/server";
|
|
import { invalidateMobileSlipLink } from "@/lib/commission/mobile-slip";
|
|
import { MAX_SLIP_BYTES, verifyAndCreateTicket } from "@/lib/commission/slip-upload";
|
|
import { boundedBody, errorResponse, HttpError, requireSameOrigin, withUploadSlot } from "@/lib/security/http";
|
|
import { limitRequest } from "@/lib/security/rate-limit";
|
|
|
|
export async function POST(request: Request, context: RouteContext<"/api/commission/checkouts/[id]/verify">) {
|
|
try {
|
|
requireSameOrigin(request);
|
|
const user = await requireCommissionUser();
|
|
await limitRequest("commission-slip", user.id, 10);
|
|
const { id } = await context.params;
|
|
const [checkout] = await getDb().select().from(commissionCheckouts)
|
|
.where(and(eq(commissionCheckouts.id, id), eq(commissionCheckouts.userId, user.id))).limit(1);
|
|
if (!checkout) throw new HttpError(404, "checkout-not-found");
|
|
if (!request.headers.get("content-type")?.startsWith("multipart/form-data;"))
|
|
throw new HttpError(415, "expected-multipart");
|
|
return await withUploadSlot(async () => {
|
|
const form = await boundedBody(request, MAX_SLIP_BYTES + 64 * 1024).formData();
|
|
const result = await verifyAndCreateTicket(checkout, form.get("file"));
|
|
await invalidateMobileSlipLink(checkout.id).catch(() => undefined);
|
|
return Response.json({ ticketId: result.ticketId }, {
|
|
status: result.created ? 201 : 200, headers: { "Cache-Control": "no-store" },
|
|
});
|
|
});
|
|
} catch (cause) { return errorResponse(cause); }
|
|
}
|