enhancment complete with phase 10

apps/admin/src/app/api/recommendations/route.ts

@@ -1,13 +1,28 @@
-import { NextResponse } from "next/server";
+import { NextRequest, NextResponse } from "next/server";
 import { auth } from "@clerk/nextjs/server";
 import { getDatabase } from "@/lib/database";
 import log from "@/lib/logger";
+import {
+  legacyRecommendationSchema,
+  recommendationUpdateRequestSchema,
+} from "@/lib/validation/schemas";
+import {
+  validateRequestBody,
+  validationErrorResponse,
+} from "@/lib/validation/helpers";
+import {
+  successResponse,
+  unauthorizedResponse,
+  forbiddenResponse,
+  badRequestResponse,
+  internalErrorResponse,
+} from "@/lib/api/responses";
 
-export async function GET(request: Request) {
+export async function GET(request: NextRequest) {
   try {
     const { userId: currentUserId } = await auth();
     if (!currentUserId) {
-      return new NextResponse("Unauthorized", { status: 401 });
+      return unauthorizedResponse();
     }
 
     const { searchParams } = new URL(request.url);
@@ -24,11 +39,11 @@ export async function GET(request: Request) {
         currentUser?.role === "trainer";
 
       if (!isStaff) {
-        return new NextResponse("User ID is required", { status: 400 });
+        return badRequestResponse("User ID is required");
       }
 
       const recommendations = await db.getAllRecommendations();
-      return NextResponse.json({ recommendations });
+      return successResponse({ recommendations });
     }
 
     // Check permissions: Users can view their own, Admins/Trainers can view anyone's
@@ -40,7 +55,7 @@ export async function GET(request: Request) {
 
     if (currentUserId !== targetUserId) {
       if (!isStaff) {
-        return new NextResponse("Forbidden", { status: 403 });
+        return forbiddenResponse();
       }
     }
 
@@ -53,18 +68,18 @@ export async function GET(request: Request) {
       );
     }
 
-    return NextResponse.json(recommendations);
+    return successResponse(recommendations);
   } catch (error) {
     console.error("Error fetching recommendations:", error);
-    return new NextResponse("Internal Server Error", { status: 500 });
+    return internalErrorResponse();
   }
 }
 
-export async function POST(request: Request) {
+export async function POST(request: NextRequest) {
   try {
     const { userId: currentUserId } = await auth();
     if (!currentUserId) {
-      return new NextResponse("Unauthorized", { status: 401 });
+      return unauthorizedResponse();
     }
 
     const db = await getDatabase();
@@ -75,10 +90,22 @@ export async function POST(request: Request) {
       currentUser?.role === "trainer";
 
     if (!isStaff) {
-      return new NextResponse("Forbidden", { status: 403 });
+      return forbiddenResponse();
+    }
+
+    // Validate request body
+    const validation = await validateRequestBody(
+      request,
+      legacyRecommendationSchema,
+    );
+
+    if (!validation.success) {
+      log.warn("Recommendation creation validation failed", {
+        errors: validation.errors,
+      });
+      return validationErrorResponse(validation.errors);
     }
 
-    const body = await request.json();
     const {
       userId,
       fitnessProfileId,
@@ -88,7 +115,7 @@ export async function POST(request: Request) {
       status,
       type,
       content,
-    } = body;
+    } = validation.data;
 
     // Handle AI Plan (Legacy/Specific)
     if (recommendationText && activityPlan && dietPlan && fitnessProfileId) {
@@ -101,8 +128,8 @@ export async function POST(request: Request) {
         activityPlan,
         dietPlan,
         status: status || "pending",
-      });
-      return NextResponse.json(recommendation);
+      } as any);
+      return successResponse(recommendation);
     }
 
     // Handle User Goal (Generic)
@@ -113,31 +140,39 @@ export async function POST(request: Request) {
         type,
         recommendationText: content,
         status: status || "pending",
-      });
-      return NextResponse.json(recommendation);
+      } as any);
+      return successResponse(recommendation);
     }
 
-    return NextResponse.json("Missing required fields", { status: 400 });
+    return badRequestResponse("Missing required fields");
   } catch (error) {
     log.error("Failed to create recommendation", error);
-    return new NextResponse("Internal Server Error", { status: 500 });
+    return internalErrorResponse();
   }
 }
 
-export async function PUT(request: Request) {
+export async function PUT(request: NextRequest) {
   try {
     const { userId: currentUserId } = await auth();
     if (!currentUserId) {
-      return new NextResponse("Unauthorized", { status: 401 });
+      return unauthorizedResponse();
+    }
+
+    // Validate request body
+    const validation = await validateRequestBody(
+      request,
+      recommendationUpdateRequestSchema,
+    );
+
+    if (!validation.success) {
+      log.warn("Recommendation update validation failed", {
+        errors: validation.errors,
+      });
+      return validationErrorResponse(validation.errors);
     }
 
-    const body = await request.json();
     const { id, status, recommendationText, activityPlan, dietPlan, content } =
-      body;
-
-    if (!id) {
-      return new NextResponse("Recommendation ID is required", { status: 400 });
-    }
+      validation.data;
 
     const db = await getDatabase();
 
@@ -147,11 +182,11 @@ export async function PUT(request: Request) {
       ...(content && { recommendationText: content }),
       ...(activityPlan && { activityPlan }),
       ...(dietPlan && { dietPlan }),
-    });
+    } as any);
 
-    return NextResponse.json(updated);
+    return successResponse(updated);
   } catch (error) {
     log.error("Failed to update recommendation", error);
-    return new NextResponse("Internal Server Error", { status: 500 });
+    return internalErrorResponse();
   }
 }