Supervisor feature

app/api/shoot-log/takes/[takeId]/attachments/[attachmentId]/route.ts

@@ -0,0 +1,46 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { db } from "@/lib/db";
+
+function requireRole(role: string) {
+  return ["ADMIN", "PRODUCER", "SUPERVISOR"].includes(role);
+}
+
+// PATCH /api/shoot-log/takes/[takeId]/attachments/[attachmentId]
+export async function PATCH(
+  req: NextRequest,
+  { params }: { params: Promise<{ takeId: string; attachmentId: string }> }
+) {
+  const session = await auth();
+  if (!session?.user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  if (!requireRole(session.user.role))
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+
+  const { attachmentId } = await params;
+  const { caption, category } = await req.json();
+
+  const attachment = await db.takeAttachment.update({
+    where: { id: attachmentId },
+    data: {
+      ...(caption !== undefined ? { caption } : {}),
+      ...(category !== undefined ? { category } : {}),
+    },
+  });
+
+  return NextResponse.json({ attachment });
+}
+
+// DELETE /api/shoot-log/takes/[takeId]/attachments/[attachmentId]
+export async function DELETE(
+  _req: NextRequest,
+  { params }: { params: Promise<{ takeId: string; attachmentId: string }> }
+) {
+  const session = await auth();
+  if (!session?.user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  if (!requireRole(session.user.role))
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+
+  const { attachmentId } = await params;
+  await db.takeAttachment.delete({ where: { id: attachmentId } });
+  return NextResponse.json({ ok: true });
+}