82 lines
3.1 KiB
TypeScript
82 lines
3.1 KiB
TypeScript
export const dynamic = 'force-dynamic'
|
|
|
|
import { NextRequest, NextResponse } from 'next/server'
|
|
import { getSession } from '@/lib/auth/get-session'
|
|
import { withUser } from '@/lib/db/with-user'
|
|
import { writeAuditLog } from '@/lib/db/audit'
|
|
import { capaActions, incidents } from '@/lib/db/schema'
|
|
import { eq, and, not, inArray } from 'drizzle-orm'
|
|
import { createInAppNotifications } from '@/lib/notifications/in-app'
|
|
|
|
export async function POST(
|
|
request: NextRequest,
|
|
{ params }: { params: Promise<{ id: string }> }
|
|
) {
|
|
const { id } = await params
|
|
const session = await getSession()
|
|
if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
|
if (!['hse', 'admin'].includes(session.role))
|
|
return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
|
|
|
|
const [capa] = await withUser(session.sub, async tx =>
|
|
tx.select({ status: capaActions.status, incidentId: capaActions.incidentId, ownerUserId: capaActions.ownerUserId })
|
|
.from(capaActions).where(eq(capaActions.id, id)).limit(1)
|
|
)
|
|
if (!capa) return NextResponse.json({ error: 'Not found' }, { status: 404 })
|
|
if (capa.status !== 'pending_verification')
|
|
return NextResponse.json({ error: 'CAPA must be pending_verification' }, { status: 409 })
|
|
|
|
const body: { verdict: 'verified' | 'reopened'; reopen_reason?: string } = await request.json()
|
|
if (body.verdict !== 'verified' && body.verdict !== 'reopened')
|
|
return NextResponse.json({ error: 'verdict must be verified or reopened' }, { status: 422 })
|
|
|
|
const verifiedAt = new Date()
|
|
const recheckDate = new Date(verifiedAt)
|
|
recheckDate.setUTCDate(recheckDate.getUTCDate() + 30)
|
|
|
|
await withUser(session.sub, async tx => {
|
|
await tx.update(capaActions).set({
|
|
status: body.verdict,
|
|
verifiedBy: session.sub,
|
|
verifiedAt,
|
|
...(body.verdict === 'verified' ? {
|
|
effectivenessRecheckDate: recheckDate.toISOString().split('T')[0],
|
|
effectivenessRecheckRound: 0,
|
|
} : {}),
|
|
}).where(eq(capaActions.id, id))
|
|
|
|
await writeAuditLog(tx, 'capa_actions', id, body.verdict === 'verified' ? 'verified' : 'reopened', {
|
|
status: body.verdict, reopen_reason: body.reopen_reason ?? null,
|
|
})
|
|
})
|
|
|
|
if (capa.ownerUserId) {
|
|
await createInAppNotifications([{
|
|
userId: capa.ownerUserId,
|
|
title: body.verdict === 'verified'
|
|
? 'Your CAPA action was verified'
|
|
: `Your CAPA action was reopened${body.reopen_reason ? `: ${body.reopen_reason}` : ''}`,
|
|
link: `/hse/capa/${id}`,
|
|
incidentId: capa.incidentId,
|
|
capaId: id,
|
|
}])
|
|
}
|
|
|
|
const openCapas = await withUser(session.sub, async tx =>
|
|
tx.select({ id: capaActions.id }).from(capaActions)
|
|
.where(and(
|
|
eq(capaActions.incidentId, capa.incidentId),
|
|
not(inArray(capaActions.status, ['verified', 'closed'])),
|
|
))
|
|
)
|
|
|
|
if (openCapas.length === 0) {
|
|
await withUser(session.sub, async tx => {
|
|
await tx.update(incidents).set({ status: 'verification' }).where(eq(incidents.id, capa.incidentId))
|
|
await writeAuditLog(tx, 'incidents', capa.incidentId, 'status_changed', { status: 'verification' })
|
|
})
|
|
}
|
|
|
|
return NextResponse.json({ ok: true })
|
|
}
|