diff --git a/app/api/routes-b/invoices/[id]/route.ts b/app/api/routes-b/invoices/[id]/route.ts new file mode 100644 index 00000000..3e92749e --- /dev/null +++ b/app/api/routes-b/invoices/[id]/route.ts @@ -0,0 +1,49 @@ +import { NextRequest, NextResponse } from 'next/server' +import { prisma } from '@/lib/db' +import { verifyAuthToken } from '@/lib/auth' +import { logger } from '@/lib/logger' + +export async function GET( + request: NextRequest, + { params }: { params: { id: string } } +) { + try { + // Verify auth + const authToken = request.headers.get('authorization')?.replace('Bearer ', '') + if (!authToken) { + return NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) + } + + const claims = await verifyAuthToken(authToken) + if (!claims) { + return NextResponse.json({ error: 'Invalid token' }, { status: 401 }) + } + + const user = await prisma.user.findUnique({ + where: { privyId: claims.userId }, + }) + + if (!user) { + return NextResponse.json({ error: 'User not found' }, { status: 404 }) + } + + // Find invoice + const invoice = await prisma.invoice.findUnique({ + where: { id: params.id }, + }) + + if (!invoice) { + return NextResponse.json({ error: 'Invoice not found' }, { status: 404 }) + } + + // Verify ownership + if (invoice.userId !== user.id) { + return NextResponse.json({ error: 'Forbidden' }, { status: 403 }) + } + + return NextResponse.json(invoice) + } catch (error) { + logger.error({ err: error }, 'Invoice GET error') + return NextResponse.json({ error: 'Failed to get invoice' }, { status: 500 }) + } +} \ No newline at end of file