23d995102f
✅ ALL FEATURES IMPLEMENTED: 🔐 Advanced Permission System: - Role-based access control (Owner/Editor/Viewer) - Permission middleware for all API endpoints - Granular permissions for collection operations - Activity logging for complete audit trails 🌍 Collection Visibility Types: - Private: Owner-only access - Invite-Only: Controlled collaboration - Public: Community accessible - Dynamic permission checking across all endpoints 📧 Complete Email Integration: - Beautiful HTML invitation templates - Role-based permission descriptions - Personal message support - Accept/decline workflow with proper UX - Bulk invitation system for multiple users 🎨 Rich User Interface: - Permission indicators with tooltips - Activity log component with real-time updates - Collaboration management dashboard - Bulk invite modal with batch processing - Permission gates throughout the UI ⚡ Performance & Security: - Database indexes for optimal queries - Comprehensive error handling - CORS headers and preflight support - JWT-based authentication integration - Cascading deletes and data integrity 🚀 Ready for Production: - All API endpoints protected with permissions - Complete activity logging system - Beautiful email templates with Resend - Responsive UI components - Error handling and loading states This system now provides enterprise-level collaboration features for community-driven collection building! 🎯
44 lines
1.2 KiB
JavaScript
44 lines
1.2 KiB
JavaScript
import { sql } from '@vercel/postgres';
|
|
import { withCollectionPermission } from '../../../../lib/permission-middleware';
|
|
|
|
async function handler(req, res) {
|
|
// Set CORS headers
|
|
res.setHeader('Access-Control-Allow-Origin', '*');
|
|
res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS');
|
|
res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
|
|
|
|
// Handle preflight requests
|
|
if (req.method === 'OPTIONS') {
|
|
res.status(200).end();
|
|
return;
|
|
}
|
|
|
|
if (req.method !== 'GET') {
|
|
return res.status(405).json({ error: 'Method not allowed' });
|
|
}
|
|
|
|
const { id } = req.query; // collection id
|
|
|
|
try {
|
|
// Get activity log for the collection
|
|
const result = await sql`
|
|
SELECT
|
|
ca.*,
|
|
u.email as user_email
|
|
FROM collection_activity ca
|
|
LEFT JOIN users u ON ca.user_id = u.id
|
|
WHERE ca.collection_id = ${id}
|
|
ORDER BY ca.created_at DESC
|
|
LIMIT 50
|
|
`;
|
|
|
|
res.status(200).json(result.rows);
|
|
|
|
} catch (error) {
|
|
console.error('Error fetching collection activity:', error);
|
|
res.status(500).json({ error: 'Internal server error' });
|
|
}
|
|
}
|
|
|
|
// Apply permission middleware - requires viewer access to see activity
|
|
export default withCollectionPermission('viewer')(handler);
|