maroandClaude Sonnet 5
1cd15aff25
- Customer accounts now require email verification (hashed, single-use, time-limited tokens) before they can request/confirm bookings, with resend flows on login/account/booking widget and rate limiting. - Admins get a private, rotatable iCalendar (ICS) subscription feed of their confirmed bookings and public events, timezone-correct for Europe/Berlin including DST, never exposing meeting passwords. - Adds a full SEO layer: per-page canonical/OG/Twitter metadata with CMS-editable overrides and content-derived fallbacks, a dynamic sitemap.xml and robots.txt driven by real published content, JSON-LD (Organization/LocalBusiness, WebSite, WebPage, BreadcrumbList, Service, Event, BlogPosting) that never fabricates data, and a CMS-managed redirect table for changed slugs. - Global ANOUMA-naming audit: the brand name is never used to label personal account/calendar areas anywhere in the app, CMS, or emails. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
55 lines
2.2 KiB
TypeScript
55 lines
2.2 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { getPayload } from "payload";
|
|
import config from "@payload-config";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
type Args = { params: Promise<{ id: string }> };
|
|
|
|
export async function POST(request: Request, { params }: Args) {
|
|
const { id } = await params;
|
|
|
|
try {
|
|
const payload = await getPayload({ config });
|
|
const { user } = await payload.auth({ headers: request.headers });
|
|
if (!user || user.collection !== "customers") {
|
|
return NextResponse.json({ error: "Bitte melde dich an." }, { status: 401 });
|
|
}
|
|
if (!user.emailVerified) {
|
|
return NextResponse.json({ error: "Bitte bestätige zuerst deine E-Mail-Adresse.", code: "EMAIL_NOT_VERIFIED" }, { status: 403 });
|
|
}
|
|
|
|
const booking = await payload.findByID({ collection: "booking-requests", id, depth: 0 }).catch(() => null);
|
|
if (!booking || Number(booking.user) !== Number(user.id)) {
|
|
return NextResponse.json({ error: "Buchung nicht gefunden." }, { status: 404 });
|
|
}
|
|
const alternative = booking.proposedAlternative;
|
|
if (booking.status !== "pending" || !alternative?.date || !alternative.startTime || !alternative.endTime) {
|
|
return NextResponse.json({ error: "Für diese Buchung liegt kein alternativer Termin vor." }, { status: 409 });
|
|
}
|
|
|
|
// The beforeChange hook on booking-requests re-checks for conflicts
|
|
// (with an advisory lock) before allowing this to become "confirmed" —
|
|
// the alternative slot may have been taken by someone else since it was
|
|
// proposed.
|
|
await payload.update({
|
|
collection: "booking-requests",
|
|
id,
|
|
data: {
|
|
status: "confirmed",
|
|
date: alternative.date,
|
|
startTime: alternative.startTime,
|
|
endTime: alternative.endTime,
|
|
},
|
|
});
|
|
|
|
return NextResponse.json({ ok: true });
|
|
} catch (error) {
|
|
if (error instanceof Error && "status" in error && (error as { status: number }).status === 409) {
|
|
return NextResponse.json({ error: error.message }, { status: 409 });
|
|
}
|
|
console.error("accept-alternative failed", error);
|
|
return NextResponse.json({ error: "Der Termin konnte nicht angenommen werden." }, { status: 500 });
|
|
}
|
|
}
|