ok_r/app/api/meetings/[id]/route.ts

import { NextRequest, NextResponse } from 'next/server';
import { supabase } from '@/lib/supabase';
import { ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';

export async function GET(
  request: NextRequest,
  { params }: { params: { id: string } }
) {
  const ctx = await getAuthContext(request);
  const auth = ensureAuthenticated(ctx);
  if (!auth.ok) {
    return NextResponse.json({ error: auth.error }, { status: auth.status });
  }

  const { data, error } = await supabase
    .from('meetings')
    .select(`
      *,
      created_by_user:users!meetings_created_by_fkey(id, name, avatar_url),
      project:projects(id, name)
    `)
    .eq('id', params.id)
    .maybeSingle();

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
  }

  if (!data) {
    return NextResponse.json({ error: '会议记录不存在' }, { status: 404 });
  }

  if (!ctx!.isAdmin && !hasProjectAccess(ctx!, data.project_id)) {
    return NextResponse.json({ error: '无权限' }, { status: 403 });
  }

  return NextResponse.json(data);
}

export async function PATCH(
  request: NextRequest,
  { params }: { params: { id: string } }
) {
  const ctx = await getAuthContext(request);
  const auth = ensureAuthenticated(ctx);
  if (!auth.ok) {
    return NextResponse.json({ error: auth.error }, { status: auth.status });
  }

  if (!ctx!.isAdmin) {
    const { data: meeting, error: mErr } = await supabase
      .from('meetings')
      .select('id,project_id')
      .eq('id', params.id)
      .maybeSingle();
    if (mErr) return NextResponse.json({ error: mErr.message }, { status: 500 });
    if (!meeting) return NextResponse.json({ error: '会议记录不存在' }, { status: 404 });
    if (!hasProjectAccess(ctx!, meeting.project_id)) {
      return NextResponse.json({ error: '无权限' }, { status: 403 });
    }
  }

  const body = await request.json();
  const { summary, decisions, risks, next_period_commitments } = body;

  const updateData: Record<string, unknown> = { updated_at: new Date().toISOString() };
  if (summary !== undefined) updateData.summary = summary;
  if (decisions !== undefined) updateData.decisions = decisions;
  if (risks !== undefined) updateData.risks = risks;
  if (next_period_commitments !== undefined) updateData.next_period_commitments = next_period_commitments;

  const { data, error } = await supabase
    .from('meetings')
    .update(updateData)
    .eq('id', params.id)
    .select()
    .single();

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
  }

  return NextResponse.json(data);
}

export async function DELETE(
  request: NextRequest,
  { params }: { params: { id: string } }
) {
  const ctx = await getAuthContext(request);
  const auth = ensureAuthenticated(ctx);
  if (!auth.ok) {
    return NextResponse.json({ error: auth.error }, { status: auth.status });
  }

  if (!ctx!.isAdmin) {
    const { data: meeting, error: mErr } = await supabase
      .from('meetings')
      .select('id,project_id')
      .eq('id', params.id)
      .maybeSingle();
    if (mErr) return NextResponse.json({ error: mErr.message }, { status: 500 });
    if (!meeting) return NextResponse.json({ error: '会议记录不存在' }, { status: 404 });
    if (!hasProjectAccess(ctx!, meeting.project_id)) {
      return NextResponse.json({ error: '无权限' }, { status: 403 });
    }
  }

  const { error } = await supabase
    .from('meetings')
    .delete()
    .eq('id', params.id);

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
  }

  return NextResponse.json({ success: true });
}