client review by episode filter added

app/api/client/[token]/project/route.ts

@@ -26,11 +26,18 @@ export async function GET(
     return NextResponse.json({ error: "Project not found" }, { status: 404 });
   }
 
-  // Only return shots that have been explicitly shared with the client
+  // Only return shots that have been explicitly shared with the client.
+  // If the session has episode restrictions, further filter to those episodes.
+  const episodeFilter =
+    session.allowedEpisodes && session.allowedEpisodes.length > 0
+      ? session.allowedEpisodes
+      : undefined;
+
   const shots = await db.shot.findMany({
     where: {
       projectId: session.projectId,
       sharedWithClient: true,
+      ...(episodeFilter ? { episode: { in: episodeFilter } } : {}),
     },
     orderBy: [{ episode: "asc" }, { sequence: "asc" }, { shotCode: "asc" }],
     select: {

app/api/projects/[projectId]/episodes/route.ts

@@ -0,0 +1,29 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { db } from "@/lib/db";
+
+/** GET /api/projects/[projectId]/episodes — returns distinct episode values for shots in a project */
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ projectId: string }> }
+) {
+  const session = await auth();
+  if (!session?.user) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const { projectId } = await params;
+
+  const shots = await db.shot.findMany({
+    where: { projectId, episode: { not: null } },
+    select: { episode: true },
+    distinct: ["episode"],
+    orderBy: { episode: "asc" },
+  });
+
+  const episodes = shots
+    .map((s) => s.episode as string)
+    .filter(Boolean);
+
+  return NextResponse.json({ episodes });
+}

app/api/review-sessions/route.ts

@@ -33,7 +33,7 @@ export async function POST(req: NextRequest) {
   }
 
   const body = await req.json();
-  const { projectId, label, email, expiresInDays = 30, password } = body;
+  const { projectId, label, email, expiresInDays = 30, password, allowedEpisodes } = body;
 
   if (!projectId) {
     return NextResponse.json({ error: "projectId is required" }, { status: 400 });
@@ -49,6 +49,11 @@ export async function POST(req: NextRequest) {
       ? await bcrypt.hash(password, 12)
       : null;
 
+  const episodeFilter =
+    Array.isArray(allowedEpisodes) && allowedEpisodes.length > 0
+      ? (allowedEpisodes as string[]).filter((e) => typeof e === "string" && e.length > 0)
+      : [];
+
   const reviewSession = await db.reviewSession.create({
     data: {
       projectId,
@@ -56,6 +61,7 @@ export async function POST(req: NextRequest) {
       email: email || null,
       passwordHash,
       expiresAt: addDays(new Date(), expiresInDays),
+      allowedEpisodes: episodeFilter,
     },
   });