63 lines
2.6 KiB
TypeScript
63 lines
2.6 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { getPayload } from "payload";
|
|
import config from "@payload-config";
|
|
import { createMeetingToken } from "@/lib/meeting/token";
|
|
import { authorizeMeeting } from "@/lib/meeting/access";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
type Body = { eventSlug?: unknown };
|
|
|
|
/** Creates a host session for an online event from the authenticated CRM. */
|
|
export async function POST(request: Request) {
|
|
let body: Body;
|
|
try {
|
|
body = await request.json();
|
|
if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("Invalid body");
|
|
} catch {
|
|
return NextResponse.json({ error: "Ungültige Anfrage." }, { status: 400 });
|
|
}
|
|
|
|
const eventSlug = typeof body.eventSlug === "string" ? body.eventSlug.trim() : "";
|
|
if (!eventSlug) return NextResponse.json({ error: "Online-Termin fehlt." }, { status: 400 });
|
|
|
|
try {
|
|
const payload = await getPayload({ config });
|
|
const { user } = await payload.auth({ headers: request.headers });
|
|
if (!user || user.collection !== "users" || user.role !== "admin") {
|
|
return NextResponse.json({ error: "Nicht autorisiert." }, { status: 401 });
|
|
}
|
|
|
|
const { docs } = await payload.find({
|
|
collection: "events",
|
|
where: { slug: { equals: eventSlug } },
|
|
limit: 1,
|
|
});
|
|
const event = docs[0];
|
|
if (!event || !event.isOnline) {
|
|
return NextResponse.json({ error: "Dieser Termin ist kein Online-Termin." }, { status: 404 });
|
|
}
|
|
|
|
const access = await authorizeMeeting(payload, event, "host");
|
|
if (!access) return NextResponse.json({ error: "Dieser Termin ist nicht offen oder wurde storniert." }, { status: 403 });
|
|
const { token } = createMeetingToken({
|
|
eventSlug,
|
|
name: typeof user.name === "string" && user.name.trim() ? user.name.trim() : "Host",
|
|
role: "host",
|
|
accessVersion: access.accessVersion,
|
|
ttlMs: Math.min(6 * 3600000, access.expiresAt - Date.now()),
|
|
});
|
|
|
|
// Keep the token in the URL fragment: browsers do not send fragments to
|
|
// the server, so the temporary host credential does not enter request or
|
|
// reverse-proxy logs. The CRM copies this test link without navigating.
|
|
const baseUrl = process.env.NEXT_PUBLIC_SERVER_URL || new URL(request.url).origin;
|
|
const testUrl = `${baseUrl.replace(/\/$/, "")}/termine/${encodeURIComponent(eventSlug)}/call#token=${encodeURIComponent(token)}`;
|
|
|
|
return NextResponse.json({ testUrl });
|
|
} catch (error) {
|
|
console.error("admin meeting start failed", error);
|
|
return NextResponse.json({ error: "Der Video-Call konnte nicht gestartet werden." }, { status: 500 });
|
|
}
|
|
}
|