pstream-backend/server/routes/users/[id]/ratings.ts

import { useAuth } from '~/utils/auth';
import { z } from 'zod';

const userRatingsSchema = z.object({
  tmdb_id: z.number(),
  type: z.enum(['movie', 'tv']),
  rating: z.number().min(0).max(10),
});

export default defineEventHandler(async event => {
  const userId = event.context.params?.id;

  const session = await useAuth().getCurrentSession();

  if (session.user !== userId) {
    throw createError({
      statusCode: 403,
      message: 'Permission denied',
    });
  }

  if (event.method === 'GET') {
    const ratings = await prisma.users.findMany({
      select: {
        ratings: true,
      },
      where: {
        id: userId,
      },
    });

    return {
      userId,
      ratings: ratings[0].ratings,
    };
  } else if (event.method === 'POST') {
    const body = await readBody(event);
    const validatedBody = userRatingsSchema.parse(body);

    const user = await prisma.users.findUnique({
      where: {
        id: userId,
      },
      select: {
        ratings: true,
      },
    });

    const userRatings = user?.ratings || [];
    const currentRatings = Array.isArray(userRatings) ? userRatings : [];

    const existingRatingIndex = currentRatings.findIndex(
      (r: any) => r.tmdb_id === validatedBody.tmdb_id && r.type === validatedBody.type
    );

    let updatedRatings;
    if (existingRatingIndex >= 0) {
      updatedRatings = [...currentRatings];
      updatedRatings[existingRatingIndex] = validatedBody;
    } else {
      updatedRatings = [...currentRatings, validatedBody];
    }

    await prisma.users.update({
      where: {
        id: userId,
      },
      data: {
        ratings: updatedRatings,
      },
    });

    return {
      userId,
      rating: {
        tmdb_id: validatedBody.tmdb_id,
        type: validatedBody.type,
        rating: validatedBody.rating,
      },
    };
  }

  // This should only execute if the method is neither GET nor POST
  throw createError({
    statusCode: 405,
    message: 'Method not allowed',
  });
});