66 lines
2.1 KiB
TypeScript
66 lines
2.1 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { getSessionUser, canMutate } from "@/lib/session";
|
|
import { dismissTenantRequest, getTenantRequestById } from "@/lib/db";
|
|
import { safeError } from "@/lib/errors";
|
|
|
|
/**
|
|
* POST /api/onboarding/[id]/dismiss
|
|
*
|
|
* Customer-side acknowledgement of a rejected or cancelled request
|
|
* (Bug 13). Sets `dismissed_at = now()` so the row stops appearing
|
|
* in the dashboard's `listActiveTenantRequestsByOrgId` query. The
|
|
* row itself is preserved for audit.
|
|
*
|
|
* Authorization mirrors the GET / DELETE / PATCH endpoints on this
|
|
* resource: customer owners (or platform staff) of the row's org.
|
|
*
|
|
* Idempotent: dismissing an already-dismissed request returns 200
|
|
* with no change. We refuse to dismiss non-terminal rows (pending,
|
|
* approved, provisioning, active) — those are still actionable, and
|
|
* "hiding" them would stash live state from the customer.
|
|
*/
|
|
export async function POST(
|
|
_req: NextRequest,
|
|
{ params }: { params: Promise<{ id: string }> }
|
|
) {
|
|
const user = await getSessionUser();
|
|
if (!user) {
|
|
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
if (!canMutate(user)) {
|
|
return NextResponse.json({ error: "Forbidden" }, { status: 403 });
|
|
}
|
|
|
|
const { id } = await params;
|
|
const tr = await getTenantRequestById(id);
|
|
if (!tr) {
|
|
return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
}
|
|
if (!user.isPlatform && tr.zitadelOrgId !== user.orgId) {
|
|
return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
}
|
|
|
|
if (tr.status !== "rejected" && tr.status !== "cancelled") {
|
|
return NextResponse.json(
|
|
{
|
|
error:
|
|
"Only rejected or cancelled requests can be dismissed. Active requests stay visible.",
|
|
code: "not_dismissable",
|
|
currentStatus: tr.status,
|
|
},
|
|
{ status: 409 }
|
|
);
|
|
}
|
|
|
|
try {
|
|
await dismissTenantRequest(id);
|
|
return NextResponse.json({ message: "Dismissed.", id });
|
|
} catch (e: any) {
|
|
console.error("Failed to dismiss request:", e);
|
|
return NextResponse.json(
|
|
{ error: safeError(e, "Failed to dismiss request") },
|
|
{ status: 500 }
|
|
);
|
|
}
|
|
}
|