128 lines
3.6 KiB
TypeScript
128 lines
3.6 KiB
TypeScript
// routes/api/delete/tenant_application.ts
|
|
import { define } from "../../../utils.ts";
|
|
import {
|
|
deleteApplication,
|
|
getApplicationById,
|
|
getApplicationsByApplicant as _getApplicationsByApplicant,
|
|
getTenantApplicationsByLandlord,
|
|
} from "../../../services/tenantApplicationService.ts";
|
|
import { SessionCookie } from "../../auth/callback.ts";
|
|
|
|
export const handler = define.handlers({
|
|
async POST(ctx) {
|
|
try {
|
|
const stateData: SessionCookie = ctx.state.data;
|
|
const { user_id, user_type } = stateData;
|
|
|
|
const contentType = ctx.req.headers.get("content-type") || "";
|
|
let data: Record<string, string> = {};
|
|
let sender: string | null = null;
|
|
let isJsonRequest = false;
|
|
|
|
// Handle both JSON and form data
|
|
if (contentType.includes("application/json")) {
|
|
isJsonRequest = true;
|
|
const jsonData = await ctx.req.json();
|
|
data = jsonData;
|
|
} else {
|
|
const formData = await ctx.req.formData();
|
|
sender = formData.get("sender")?.toString() || null;
|
|
|
|
data = {
|
|
id: formData.get("id")?.toString() || "",
|
|
};
|
|
}
|
|
|
|
const id = data.id;
|
|
|
|
if (!id) {
|
|
return new Response(
|
|
JSON.stringify({
|
|
error: "Application ID is required",
|
|
}),
|
|
{
|
|
status: 400,
|
|
headers: { "Content-Type": "application/json" },
|
|
},
|
|
);
|
|
}
|
|
|
|
// DATA ISOLATION: Verify user has authorization to delete this application
|
|
const application = await getApplicationById(id);
|
|
|
|
if (!application) {
|
|
return new Response(
|
|
JSON.stringify({
|
|
error: "Application not found",
|
|
}),
|
|
{
|
|
status: 404,
|
|
headers: { "Content-Type": "application/json" },
|
|
},
|
|
);
|
|
}
|
|
|
|
let hasAccess = false;
|
|
|
|
if (user_type === "tenant") {
|
|
// Tenants can only delete their own applications
|
|
if (application.applicant_id === user_id) {
|
|
hasAccess = true;
|
|
}
|
|
} else if (user_type === "landlord" || user_type === "admin") {
|
|
// Landlords can only delete applications for their properties
|
|
const landlordApplications = await getTenantApplicationsByLandlord(
|
|
user_id,
|
|
);
|
|
hasAccess = landlordApplications.some((app) => app.id === id);
|
|
}
|
|
|
|
if (!hasAccess) {
|
|
return new Response(
|
|
JSON.stringify({
|
|
error: "Application not found or unauthorized",
|
|
}),
|
|
{
|
|
status: 403,
|
|
headers: { "Content-Type": "application/json" },
|
|
},
|
|
);
|
|
}
|
|
|
|
const result = await deleteApplication(id);
|
|
|
|
// Return appropriate response based on request type
|
|
if (isJsonRequest) {
|
|
return new Response(
|
|
JSON.stringify({
|
|
success: true,
|
|
deleted: result[0],
|
|
}),
|
|
{
|
|
status: 200,
|
|
headers: { "Content-Type": "application/json" },
|
|
},
|
|
);
|
|
} else {
|
|
// Redirect back to the sender URL
|
|
const senderPath = sender?.toString() || "/";
|
|
let redirectUrl = senderPath;
|
|
try {
|
|
if (senderPath.startsWith("/")) {
|
|
const url = new URL(ctx.req.url);
|
|
redirectUrl = url.origin + senderPath;
|
|
}
|
|
} catch (_) {
|
|
// fallback: just use senderPath
|
|
}
|
|
return Response.redirect(redirectUrl, 303);
|
|
}
|
|
} catch (e) {
|
|
return new Response(JSON.stringify({ error: e }), {
|
|
status: 500,
|
|
headers: { "Content-Type": "application/json" },
|
|
});
|
|
}
|
|
},
|
|
});
|