fixed client review player annotations

app/api/client/[token]/annotation/route.ts

@@ -0,0 +1,68 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import { validateReviewToken } from "@/lib/review-auth";
+
+/** Find or create a guest user for the client reviewer based on the session email */
+async function getOrCreateClientUser(email: string, label?: string | null) {
+  const existing = await db.user.findUnique({ where: { email } });
+  if (existing) return existing;
+  return db.user.create({
+    data: {
+      email,
+      name: label ?? email.split("@")[0],
+      role: "CLIENT",
+      isActive: true,
+    },
+  });
+}
+
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ token: string }> }
+) {
+  const { token } = await params;
+  const result = await validateReviewToken(token, req);
+  if (result.type === "requiresPassword") {
+    return NextResponse.json({ requiresPassword: true }, { status: 401 });
+  }
+  if (result.type === "invalid") {
+    return NextResponse.json({ error: "Invalid or expired review link" }, { status: 403 });
+  }
+  const session = result.session;
+
+  const body = await req.json();
+  const { versionId, frameNumber, drawingData, color } = body;
+
+  if (!versionId || frameNumber == null || !drawingData) {
+    return NextResponse.json({ error: "Missing required fields" }, { status: 400 });
+  }
+
+  // Ensure the version belongs to this project
+  const version = await db.version.findUnique({
+    where: { id: versionId },
+    include: {
+      shot: { select: { projectId: true } },
+      task: { select: { projectId: true } },
+    },
+  });
+  const projectId = version?.shot?.projectId ?? version?.task?.projectId;
+  if (!version || projectId !== session.projectId) {
+    return NextResponse.json({ error: "Version not found" }, { status: 404 });
+  }
+
+  // Resolve commenter identity
+  const email = session.email ?? `client+${token.slice(0, 8)}@review.external`;
+  const user = await getOrCreateClientUser(email, session.label);
+
+  const annotation = await db.annotation.create({
+    data: {
+      versionId,
+      authorId: user.id,
+      frameNumber,
+      drawingData,
+      color: color ?? "#ef4444",
+    },
+  });
+
+  return NextResponse.json({ success: true, annotation });
+}