adminandClaude Sonnet 4.6
d18d29168a
Custom auth stack: bcryptjs password hashing (cost 10, GoTrue-compatible), jose JWT session cookies (edge-safe, 8hr TTL), new API routes for login/logout/reset/change-password, middleware rewritten to JWT-only verification with no DB access. All 38 protected pages and API routes migrated from supabase.auth.getUser() to getSession(). Supabase .from() queries retained for Phase 4. lib/db/index.ts refactored to lazy Proxy singleton to avoid module-level throw during Next.js build. tsc: clean, build: clean, tests: 4/4 passed Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
75 lines
3.3 KiB
TypeScript
75 lines
3.3 KiB
TypeScript
export const dynamic = 'force-dynamic'
|
|
|
|
import { NextRequest, NextResponse } from 'next/server'
|
|
import { createClient } from '@/lib/supabase/server'
|
|
import { getSession } from '@/lib/auth/get-session'
|
|
import { buildJkkp6Pdf, buildJkkp7Pdf, type JkkpIncident } from '@/lib/pdf/jkkp'
|
|
import { computeDoshObligation } from '@/lib/incidents/dosh'
|
|
|
|
export async function GET(
|
|
request: NextRequest,
|
|
{ params }: { params: Promise<{ id: string }> }
|
|
) {
|
|
const { id } = await params
|
|
const form = request.nextUrl.searchParams.get('form')
|
|
if (form !== 'jkkp6' && form !== 'jkkp7')
|
|
return NextResponse.json({ error: 'form must be jkkp6 or jkkp7' }, { status: 422 })
|
|
|
|
const session = await getSession()
|
|
if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
|
if (!['hse', 'admin'].includes(session.role))
|
|
return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
|
|
|
|
const supabase = await createClient()
|
|
|
|
const { data: incident } = await supabase
|
|
.from('incidents')
|
|
.select(`
|
|
reference_no, incident_type, description, reported_at, severity, lost_days,
|
|
is_fatality, is_serious_bodily_injury, is_dangerous_occurrence, is_occupational_disease,
|
|
sites (name),
|
|
reporter:users!reported_by (name)
|
|
`)
|
|
.eq('id', id)
|
|
.single()
|
|
|
|
if (!incident) return NextResponse.json({ error: 'Not found' }, { status: 404 })
|
|
|
|
const dosh = computeDoshObligation({
|
|
is_fatality: (incident as { is_fatality: boolean }).is_fatality,
|
|
is_serious_bodily_injury: (incident as { is_serious_bodily_injury: boolean }).is_serious_bodily_injury,
|
|
is_dangerous_occurrence: (incident as { is_dangerous_occurrence: boolean }).is_dangerous_occurrence,
|
|
is_occupational_disease: (incident as { is_occupational_disease: boolean }).is_occupational_disease,
|
|
lost_days: (incident as { lost_days: number | null }).lost_days,
|
|
})
|
|
|
|
const required = form === 'jkkp6' ? dosh.requires_jkkp6 : dosh.requires_jkkp7
|
|
if (!required) return NextResponse.json({ error: 'This form is not required for this incident' }, { status: 400 })
|
|
|
|
const jkkpIncident: JkkpIncident = {
|
|
reference_no: (incident as { reference_no: string | null }).reference_no,
|
|
incident_type: (incident as { incident_type: string }).incident_type,
|
|
description: (incident as { description: string }).description,
|
|
reported_at: (incident as { reported_at: string }).reported_at,
|
|
severity: (incident as { severity: number | null }).severity,
|
|
is_fatality: (incident as { is_fatality: boolean }).is_fatality,
|
|
is_serious_bodily_injury: (incident as { is_serious_bodily_injury: boolean }).is_serious_bodily_injury,
|
|
is_dangerous_occurrence: (incident as { is_dangerous_occurrence: boolean }).is_dangerous_occurrence,
|
|
lost_days: (incident as { lost_days: number | null }).lost_days,
|
|
site_name: (incident.sites as unknown as { name: string } | null)?.name ?? 'Unknown',
|
|
reporter_name: (incident.reporter as unknown as { name: string } | null)?.name ?? 'Unknown',
|
|
}
|
|
|
|
const pdfBytes = form === 'jkkp6'
|
|
? await buildJkkp6Pdf(jkkpIncident)
|
|
: await buildJkkp7Pdf(jkkpIncident)
|
|
|
|
const ref = jkkpIncident.reference_no ?? id
|
|
return new NextResponse(Buffer.from(pdfBytes), {
|
|
headers: {
|
|
'Content-Type': 'application/pdf',
|
|
'Content-Disposition': `attachment; filename="${form}-${ref}.pdf"`,
|
|
},
|
|
})
|
|
}
|