fix: endpoints

app/api/v1/databases/[id]/backup/[backupId]/route.ts

@@ -2,49 +2,60 @@ import { NextResponse } from "next/server";
 import { withApiKey } from "@/lib/api-v1/middleware";
 import { db } from "@/db";
 import * as drizzleDb from "@/db";
-import { eq, and, isNull } from "drizzle-orm";
+import { and, eq, isNull } from "drizzle-orm";
 import { logger } from "@/lib/logger";
-import {getAccessibleDatabaseIds} from "@/lib/api-v1/services/databases";
-import {ApiKeyContext} from "@/lib/api-v1/types";
+import { ApiKeyContext } from "@/lib/api-v1/types";
+import {requireDatabaseAccess} from "@/lib/api-v1/services/databases";
 
-const log = logger.child({ module: "api/v1/databases/[id]/backup/[backupId]" });
+const log = logger.child({
+  module: "api/v1/databases/[id]/backup/[backupId]",
+});
 
 export const GET = withApiKey(
-  async (_req: Request, ctx: ApiKeyContext, params?: Record<string, string>) => {
-    try {
-      const { id, backupId } = params ?? {};
-      if (!id || !backupId) return NextResponse.json({ error: "Not found" }, { status: 404 });
+    async (_req: Request, ctx: ApiKeyContext, params?: Record<string, string>) => {
+      try {
+        const guard = await requireDatabaseAccess(params, ctx.user);
 
-      const accessibleIds = await getAccessibleDatabaseIds(ctx.user);
-      if (!accessibleIds.includes(id)) {
-        const exists = await db.query.database.findFirst({
-          where: eq(drizzleDb.schemas.database.id, id),
-          columns: { id: true },
+        if (!guard.ok) {
+          return guard.response;
+        }
+
+        const { id } = guard.data;
+        const backupId = params?.backupId;
+
+        if (!backupId) {
+          return NextResponse.json({ error: "Not found" }, { status: 404 });
+        }
+
+        const backup = await db.query.backup.findFirst({
+          where: and(
+              eq(drizzleDb.schemas.backup.id, backupId),
+              eq(drizzleDb.schemas.backup.databaseId, id),
+              isNull(drizzleDb.schemas.backup.deletedAt)
+          ),
+          with: {
+            storages: {
+              where: (backupStorage, { isNull }) =>
+                  isNull(backupStorage.deletedAt),
+            },
+          },
         });
+
+        if (!backup) {
+          return NextResponse.json({ error: "Not found" }, { status: 404 });
+        }
+
+        return NextResponse.json({ data: backup });
+      } catch (error) {
+        log.error(
+            { error },
+            "Error in GET /api/v1/databases/[id]/backup/[backupId]"
+        );
+
         return NextResponse.json(
-          { error: exists ? "Forbidden" : "Not found" },
-          { status: exists ? 403 : 404 }
+            { error: "Internal server error" },
+            { status: 500 }
         );
       }
-
-      const backup = await db.query.backup.findFirst({
-        where: and(
-          eq(drizzleDb.schemas.backup.id, backupId),
-          eq(drizzleDb.schemas.backup.databaseId, id),
-          isNull(drizzleDb.schemas.backup.deletedAt)
-        ),
-        with: {
-          storages: {
-            where: (bs, { isNull }) => isNull(bs.deletedAt),
-          },
-        },
-      });
-
-      if (!backup) return NextResponse.json({ error: "Not found" }, { status: 404 });
-      return NextResponse.json({ data: backup });
-    } catch (error) {
-      log.error({ error }, "Error in GET /api/v1/databases/[id]/backup/[backupId]");
-      return NextResponse.json({ error: "Internal server error" }, { status: 500 });
     }
-  }
-);
+);

app/api/v1/databases/[id]/backup/route.ts

@@ -2,73 +2,95 @@ import { NextResponse } from "next/server";
 import { withApiKey } from "@/lib/api-v1/middleware";
 import { db } from "@/db";
 import * as drizzleDb from "@/db";
-import { eq, desc, isNull, and } from "drizzle-orm";
+import {and, desc, eq, inArray, isNull} from "drizzle-orm";
 import { logger } from "@/lib/logger";
-import {getAccessibleDatabaseIds} from "@/lib/api-v1/services/databases";
-import {ApiKeyContext, ApiKeyContextUser} from "@/lib/api-v1/types";
+import { ApiKeyContext } from "@/lib/api-v1/types";
+import {requireDatabaseAccess} from "@/lib/api-v1/services/databases";
 
 const log = logger.child({ module: "api/v1/databases/[id]/backup" });
 
-async function resolveDatabaseAccess(id: string, user: ApiKeyContextUser) {
-  const accessibleIds = await getAccessibleDatabaseIds(user);
-  if (accessibleIds.includes(id)) return "ok";
-  const exists = await db.query.database.findFirst({
-    where: eq(drizzleDb.schemas.database.id, id),
-    columns: { id: true },
-  });
-  return exists ? "forbidden" : "not_found";
-}
-
 export const GET = withApiKey(
-  async (_req: Request, ctx: ApiKeyContext, params?: Record<string, string>) => {
-    try {
-      const id = params?.id;
+    async (_req: Request, ctx: ApiKeyContext, params?: Record<string, string>) => {
+      try {
+        const guard = await requireDatabaseAccess(params, ctx.user);
 
-      if (!id) return NextResponse.json({ error: "Not found" }, { status: 404 });
+        if (!guard.ok) {
+          return guard.response;
+        }
 
-      const access = await resolveDatabaseAccess(id, ctx.user);
-      if (access === "forbidden") return NextResponse.json({ error: "Forbidden" }, { status: 403 });
-      if (access === "not_found") return NextResponse.json({ error: "Not found" }, { status: 404 });
+        const { id } = guard.data;
 
-      const backups = await db.query.backup.findMany({
-        where: and(
-          eq(drizzleDb.schemas.backup.databaseId, id),
-          isNull(drizzleDb.schemas.backup.deletedAt)
-        ),
-        orderBy: [desc(drizzleDb.schemas.backup.createdAt)],
-      });
+        const backups = await db.query.backup.findMany({
+          where: and(
+              eq(drizzleDb.schemas.backup.databaseId, id),
+              isNull(drizzleDb.schemas.backup.deletedAt)
+          ),
+          orderBy: [desc(drizzleDb.schemas.backup.createdAt)],
+        });
 
-      return NextResponse.json({ data: backups });
-    } catch (error) {
-      log.error({ error }, "Error in GET /api/v1/databases/[id]/backup");
-      return NextResponse.json({ error: "Internal server error" }, { status: 500 });
+        return NextResponse.json({ data: backups });
+      } catch (error) {
+        log.error({ error }, "Error in GET /api/v1/databases/[id]/backup");
+
+        return NextResponse.json(
+            { error: "Internal server error" },
+            { status: 500 }
+        );
+      }
     }
-  }
 );
 
 export const POST = withApiKey(
-  async (_req: Request, ctx: ApiKeyContext, params?: Record<string, string>) => {
-    try {
-      const id = params?.id;
-      if (!id) return NextResponse.json({ error: "Not found" }, { status: 404 });
+    async (_req: Request, ctx: ApiKeyContext, params?: Record<string, string>) => {
+      try {
+        const guard = await requireDatabaseAccess(params, ctx.user);
 
-      const access = await resolveDatabaseAccess(id, ctx.user);
-      if (access === "forbidden") return NextResponse.json({ error: "Forbidden" }, { status: 403 });
-      if (access === "not_found") return NextResponse.json({ error: "Not found" }, { status: 404 });
+        if (!guard.ok) {
+          return guard.response;
+        }
 
-      const [createdBackup] = await db
-        .insert(drizzleDb.schemas.backup)
-        .values({ databaseId: id, status: "waiting" })
-        .returning();
+        const { id } = guard.data;
 
-      if (!createdBackup) {
-        return NextResponse.json({ error: "Failed to create backup" }, { status: 500 });
+        const existingBackup = await db.query.backup.findFirst({
+          where: and(
+              eq(drizzleDb.schemas.backup.databaseId, id),
+              inArray(drizzleDb.schemas.backup.status, ["waiting", "ongoing"])
+          ),
+        });
+
+        if (existingBackup) {
+          return NextResponse.json(
+              {
+                error:
+                    "A backup is already waiting or ongoing for this database",
+              },
+              { status: 409 }
+          );
+        }
+
+        const [createdBackup] = await db
+            .insert(drizzleDb.schemas.backup)
+            .values({
+              databaseId: id,
+              status: "waiting",
+            })
+            .returning();
+
+        if (!createdBackup) {
+          return NextResponse.json(
+              { error: "Failed to create backup" },
+              { status: 500 }
+          );
+        }
+
+        return NextResponse.json({ data: createdBackup }, { status: 201 });
+      } catch (error) {
+        log.error({ error }, "Error in POST /api/v1/databases/[id]/backup");
+
+        return NextResponse.json(
+            { error: "Internal server error" },
+            { status: 500 }
+        );
       }
-
-      return NextResponse.json({ data: createdBackup }, { status: 201 });
-    } catch (error) {
-      log.error({ error }, "Error in POST /api/v1/databases/[id]/backup");
-      return NextResponse.json({ error: "Internal server error" }, { status: 500 });
     }
-  }
-);
+);

app/api/v1/databases/[id]/restore/route.ts

@@ -2,11 +2,12 @@ import { NextResponse } from "next/server";
 import { withApiKey } from "@/lib/api-v1/middleware";
 import { db } from "@/db";
 import * as drizzleDb from "@/db";
-import { eq, and, isNull } from "drizzle-orm";
+import {and, eq, inArray, isNull} from "drizzle-orm";
 import { z } from "zod";
 import { logger } from "@/lib/logger";
-import {ApiKeyContext} from "@/lib/api-v1/types";
-import {getAccessibleDatabaseIds} from "@/lib/api-v1/services/databases";
+import { ApiKeyContext } from "@/lib/api-v1/types";
+import { parseJsonBody } from "@/lib/api-v1/validation/json-body";
+import {requireDatabaseAccess} from "@/lib/api-v1/services/databases";
 
 const log = logger.child({ module: "api/v1/databases/[id]/restore" });
 
@@ -16,91 +17,106 @@ const RestoreSchema = z.object({
 });
 
 export const POST = withApiKey(
-  async (req: Request, ctx: ApiKeyContext, params?: Record<string, string>) => {
-    try {
-      const id = params?.id;
-      if (!id) return NextResponse.json({ error: "Not found" }, { status: 404 });
-
-      const accessibleIds = await getAccessibleDatabaseIds(ctx.user);
-      if (!accessibleIds.includes(id)) {
-        const exists = await db.query.database.findFirst({
-          where: eq(drizzleDb.schemas.database.id, id),
-          columns: { id: true },
-        });
-        return NextResponse.json(
-          { error: exists ? "Forbidden" : "Not found" },
-          { status: exists ? 403 : 404 }
-        );
-      }
-
-      let body: unknown;
+    async (req: Request, ctx: ApiKeyContext, params?: Record<string, string>) => {
       try {
-        body = await req.json();
-      } catch {
-        return NextResponse.json({ error: "Invalid JSON body" }, { status: 422 });
-      }
+        const guard = await requireDatabaseAccess(params, ctx.user);
+
+        if (!guard.ok) {
+          return guard.response;
+        }
+
+        const { id } = guard.data;
+
+        const body = await parseJsonBody(req, RestoreSchema);
+
+        if (!body.ok) {
+          return body.response;
+        }
+
+        const { backupId, backupStorageId } = body.data;
+
+        const backupRecord = await db.query.backup.findFirst({
+          where: and(
+              eq(drizzleDb.schemas.backup.id, backupId),
+              eq(drizzleDb.schemas.backup.databaseId, id),
+              isNull(drizzleDb.schemas.backup.deletedAt)
+          ),
+          columns: {
+            id: true,
+          },
+        });
+
+        if (!backupRecord) {
+          return NextResponse.json(
+              { error: "Backup not found for this database" },
+              { status: 404 }
+          );
+        }
+
+        const backupStorage = await db.query.backupStorage.findFirst({
+          where: and(
+              eq(drizzleDb.schemas.backupStorage.id, backupStorageId),
+              eq(drizzleDb.schemas.backupStorage.backupId, backupId),
+              isNull(drizzleDb.schemas.backupStorage.deletedAt)
+          ),
+        });
+
+        if (!backupStorage) {
+          return NextResponse.json(
+              { error: "Backup storage not found" },
+              { status: 404 }
+          );
+        }
+
+        if (backupStorage.status !== "success") {
+          return NextResponse.json(
+              { error: "Backup storage is not in a successful state" },
+              { status: 422 }
+          );
+        }
+
+        const existingRestorationBackup = await db.query.restoration.findFirst({
+          where: and(
+              eq(drizzleDb.schemas.restoration.databaseId, id),
+              inArray(drizzleDb.schemas.restoration.status, ["waiting", "ongoing"])
+          ),
+        });
+
+        if (existingRestorationBackup) {
+          return NextResponse.json(
+              {
+                error:
+                    "A restoration is already waiting or ongoing for this database",
+              },
+              { status: 409 }
+          );
+        }
+
+        const [restoration] = await db
+            .insert(drizzleDb.schemas.restoration)
+            .values({
+              databaseId: id,
+              backupId,
+              backupStorageId,
+              status: "waiting",
+            })
+            .returning();
+
+        if (!restoration) {
+          return NextResponse.json(
+              { error: "Failed to create restoration" },
+              { status: 500 }
+          );
+        }
+
+        return NextResponse.json({ data: restoration }, { status: 201 });
+      } catch (error) {
+        log.error({ error }, "Error in POST /api/v1/databases/[id]/restore");
 
-      const parsed = RestoreSchema.safeParse(body);
-      if (!parsed.success) {
         return NextResponse.json(
-          { error: parsed.error.issues[0].message },
-          { status: 422 }
+            { error: "Internal server error" },
+            { status: 500 }
         );
       }
-
-      const { backupId, backupStorageId } = parsed.data;
-
-      // Validate backup belongs to this database
-      const backupRecord = await db.query.backup.findFirst({
-        where: and(
-          eq(drizzleDb.schemas.backup.id, backupId),
-          eq(drizzleDb.schemas.backup.databaseId, id),
-          isNull(drizzleDb.schemas.backup.deletedAt)
-        ),
-        columns: { id: true },
-      });
-
-      if (!backupRecord) {
-        return NextResponse.json({ error: "Backup not found for this database" }, { status: 404 });
-      }
-
-      const backupStorage = await db.query.backupStorage.findFirst({
-        where: and(
-          eq(drizzleDb.schemas.backupStorage.id, backupStorageId),
-          eq(drizzleDb.schemas.backupStorage.backupId, backupId),
-          isNull(drizzleDb.schemas.backupStorage.deletedAt)
-        ),
-      });
-
-      if (!backupStorage) {
-        return NextResponse.json({ error: "Backup storage not found" }, { status: 404 });
-      }
-
-      if (backupStorage.status !== "success") {
-        return NextResponse.json(
-          { error: "Backup storage is not in a successful state" },
-          { status: 422 }
-        );
-      }
-
-      const [restoration] = await db
-        .insert(drizzleDb.schemas.restoration)
-        .values({
-          databaseId: id,
-          backupId,
-          backupStorageId,
-          status: "waiting",
-        })
-        .returning();
-
-      if (!restoration) {
-        return NextResponse.json({ error: "Failed to create restoration" }, { status: 500 });
-      }
-
-      return NextResponse.json({ data: restoration }, { status: 201 });
-    } catch (error) {
-      log.error({ error }, "Error in POST /api/v1/databases/[id]/restore");
-      return NextResponse.json({ error: "Internal server error" }, { status: 500 });
     }
-  }
-);
+);

app/api/v1/databases/[id]/route.ts

@@ -2,40 +2,43 @@ import { NextResponse } from "next/server";
 import { withApiKey } from "@/lib/api-v1/middleware";
 import { db } from "@/db";
 import * as drizzleDb from "@/db";
-import { eq } from "drizzle-orm";
+import { and, eq, isNull } from "drizzle-orm";
 import { logger } from "@/lib/logger";
-import {getAccessibleDatabaseIds} from "@/lib/api-v1/services/databases";
-import {ApiKeyContext} from "@/lib/api-v1/types";
+import { ApiKeyContext } from "@/lib/api-v1/types";
+import {requireDatabaseAccess} from "@/lib/api-v1/services/databases";
 
 const log = logger.child({ module: "api/v1/databases/[id]" });
 
 export const GET = withApiKey(
-  async (_req: Request, ctx: ApiKeyContext, params?: Record<string, string>) => {
-    try {
-      const id = params?.id;
-      if (!id) return NextResponse.json({ error: "Not found" }, { status: 404 });
+    async (_req: Request, ctx: ApiKeyContext, params?: Record<string, string>) => {
+      try {
+        const guard = await requireDatabaseAccess(params, ctx.user);
 
-      const accessibleIds = await getAccessibleDatabaseIds(ctx.user);
-      if (!accessibleIds.includes(id)) {
-        const exists = await db.query.database.findFirst({
-          where: eq(drizzleDb.schemas.database.id, id),
-          columns: { id: true },
+        if (!guard.ok) {
+          return guard.response;
+        }
+
+        const { id } = guard.data;
+
+        const database = await db.query.database.findFirst({
+          where: and(
+              eq(drizzleDb.schemas.database.id, id),
+              isNull(drizzleDb.schemas.database.deletedAt)
+          ),
         });
+
+        if (!database) {
+          return NextResponse.json({ error: "Not found" }, { status: 404 });
+        }
+
+        return NextResponse.json({ data: database });
+      } catch (error) {
+        log.error({ error }, "Error in GET /api/v1/databases/[id]");
+
         return NextResponse.json(
-          { error: exists ? "Forbidden" : "Not found" },
-          { status: exists ? 403 : 404 }
+            { error: "Internal server error" },
+            { status: 500 }
         );
       }
-
-      const database = await db.query.database.findFirst({
-        where: eq(drizzleDb.schemas.database.id, id),
-      });
-
-      if (!database) return NextResponse.json({ error: "Not found" }, { status: 404 });
-      return NextResponse.json({ data: database });
-    } catch (error) {
-      log.error({ error }, "Error in GET /api/v1/databases/[id]");
-      return NextResponse.json({ error: "Internal server error" }, { status: 500 });
     }
-  }
-);
+);

app/api/v1/databases/[id]/status/route.ts

@@ -2,69 +2,71 @@ import { NextResponse } from "next/server";
 import { withApiKey } from "@/lib/api-v1/middleware";
 import { db } from "@/db";
 import * as drizzleDb from "@/db";
-import { eq, desc, and, isNull } from "drizzle-orm";
+import { and, desc, eq, isNull } from "drizzle-orm";
 import { logger } from "@/lib/logger";
-import {ApiKeyContext} from "@/lib/api-v1/types";
-import {getAccessibleDatabaseIds} from "@/lib/api-v1/services/databases";
+import { ApiKeyContext } from "@/lib/api-v1/types";
+import {requireDatabaseAccess} from "@/lib/api-v1/services/databases";
 
 const log = logger.child({ module: "api/v1/databases/[id]/status" });
 
 export const GET = withApiKey(
-  async (_req: Request, ctx: ApiKeyContext, params?: Record<string, string>) => {
-    try {
-      const id = params?.id;
-      if (!id) return NextResponse.json({ error: "Not found" }, { status: 404 });
+    async (_req: Request, ctx: ApiKeyContext, params?: Record<string, string>) => {
+      try {
+        const guard = await requireDatabaseAccess(params, ctx.user);
 
-      const accessibleIds = await getAccessibleDatabaseIds(ctx.user);
-      if (!accessibleIds.includes(id)) {
-        const exists = await db.query.database.findFirst({
-          where: eq(drizzleDb.schemas.database.id, id),
-          columns: { id: true },
+        if (!guard.ok) {
+          return guard.response;
+        }
+
+        const { id } = guard.data;
+
+        const [database, latestBackup, latestRestoration] = await Promise.all([
+          db.query.database.findFirst({
+            where: and(
+                eq(drizzleDb.schemas.database.id, id),
+                isNull(drizzleDb.schemas.database.deletedAt)
+            ),
+          }),
+
+          db.query.backup.findFirst({
+            where: and(
+                eq(drizzleDb.schemas.backup.databaseId, id),
+                isNull(drizzleDb.schemas.backup.deletedAt)
+            ),
+            orderBy: [desc(drizzleDb.schemas.backup.createdAt)],
+          }),
+
+          db.query.restoration.findFirst({
+            where: and(
+                eq(drizzleDb.schemas.restoration.databaseId, id),
+                isNull(drizzleDb.schemas.restoration.deletedAt)
+            ),
+            orderBy: [desc(drizzleDb.schemas.restoration.createdAt)],
+          }),
+        ]);
+
+        if (!database) {
+          return NextResponse.json(
+              { error: "Database not found" },
+              { status: 404 }
+          );
+        }
+
+        return NextResponse.json({
+          data: {
+            isWaitingForBackup: database.isWaitingForBackup,
+            lastContact: database.lastContact,
+            latestBackup: latestBackup ?? null,
+            latestRestoration: latestRestoration ?? null,
+          },
         });
+      } catch (error) {
+        log.error({ error }, "Error in GET /api/v1/databases/[id]/status");
+
         return NextResponse.json(
-          { error: exists ? "Forbidden" : "Not found" },
-          { status: exists ? 403 : 404 }
+            { error: "Internal server error" },
+            { status: 500 }
         );
       }
-
-      const [database, latestBackup, latestRestoration] = await Promise.all([
-        db.query.database.findFirst({
-          where: and(
-              eq(drizzleDb.schemas.database.id, id),
-              isNull(drizzleDb.schemas.database.deletedAt)
-          )
-        }),
-        db.query.backup.findFirst({
-          where: and(
-            eq(drizzleDb.schemas.backup.databaseId, id),
-            isNull(drizzleDb.schemas.backup.deletedAt)
-          ),
-          orderBy: [desc(drizzleDb.schemas.backup.createdAt)],
-        }),
-        db.query.restoration.findFirst({
-          where: and(
-            eq(drizzleDb.schemas.restoration.databaseId, id),
-            isNull(drizzleDb.schemas.restoration.deletedAt)
-          ),
-          orderBy: [desc(drizzleDb.schemas.restoration.createdAt)],
-        }),
-      ]);
-
-      if (!database){
-        return NextResponse.json({ error: "Database not found" });
-      }
-
-      return NextResponse.json({
-        data: {
-          isWaitingForBackup: database.isWaitingForBackup,
-          lastContact: database.lastContact,
-          latestBackup: latestBackup ?? null,
-          latestRestoration: latestRestoration ?? null,
-        },
-      });
-    } catch (error) {
-      log.error({ error }, "Error in GET /api/v1/databases/[id]/status");
-      return NextResponse.json({ error: "Internal server error" }, { status: 500 });
     }
-  }
-);
+);