src/app/api/v1/berth-reservations/route.ts

import { withAuth, withPermission } from '@/lib/api/helpers';
import { listHandler } from './handlers';

export const GET = withAuth(withPermission('reservations', 'view', listHandler));
feat(marina): end-reservation UI + global list, yacht tabs, dashboard distinct count - End-reservation: API handler existed but had no UI surface. Adds an "End reservation" button + date dialog on the reservation detail page, visible only when status is `active`. - New port-scoped `GET /api/v1/berth-reservations` list endpoint and `[portSlug]/berth-reservations` page so users can see all reservations across all berths from one place (was 404). - Berths "Edit" menu pushed `/berths/{id}?edit=true` but the detail page never read the param — it now auto-opens the edit sheet on mount and strips `edit` from the URL. - Reservation detail no longer shows raw 8-char UUIDs for Berth / Yacht / Client; reuses the lazy-fetching link components from the list view. - Yacht "Interests" and "Reservations" tabs replaced their "Coming soon" stubs with real lists fetched from the existing service routes. - Dashboard "Pipeline Value" KPI used `select(berthId, price)` and summed per active interest, so a berth with three open interests was counted three times. Switched to `selectDistinct(berthId, price)`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> 2026-05-02 23:01:15 +02:00			`import { withAuth, withPermission } from '@/lib/api/helpers';`
test(audit-fixes): cover the new permission and webhook surfaces Adds integration coverage for the routes / handlers shipped in the preceding audit-fix commits, plus refactors two route files to expose inner handlers from a sibling `handlers.ts` (the pattern used elsewhere in `src/app/api/v1`) so tests can call them without the `withAuth(withPermission(…))` wrapper. New tests (18 cases across 4 files): - `tests/integration/portal-auth.test.ts` (6) — verifyPortalToken rejects tokens missing `aud: 'portal'` or `iss: 'pn-crm'`, with the wrong audience (CRM-session-replay shape) or wrong issuer, plus a round-trip happy path. Locks in the portal-vs-CRM token isolation. - `tests/integration/api/saved-views-ownership.test.ts` (6) — patch and delete handlers return 403 for a different user, 404 for an unknown id or cross-port id, and 200 for the owner. Ownership is enforced at the route layer regardless of the service's internal filtering. - `tests/integration/api/berth-reservations-list.test.ts` (3) — the new global list returns rows for the current port only and honors pagination params. A reservation in a different port never leaks. - `tests/integration/documents-expired-webhook.test.ts` (3) — handleDocumentExpired flips the document to `expired`, also flips the linked interest's `eoiStatus`, writes a `documentEvents` row, and is a no-op (not a throw) when the documensoId is unknown. Refactors: - `src/app/api/v1/saved-views/[id]/route.ts` extracts `patchHandler` / `deleteHandler` (and the shared `assertViewOwner`) into `handlers.ts`. The route file is now a 4-line `withAuth(handler)` wrapper. - `src/app/api/v1/berth-reservations/route.ts` extracts `listHandler` similarly. Tests import directly from `handlers.ts`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> 2026-05-02 23:17:08 +02:00			`import { listHandler } from './handlers';`
feat(marina): end-reservation UI + global list, yacht tabs, dashboard distinct count - End-reservation: API handler existed but had no UI surface. Adds an "End reservation" button + date dialog on the reservation detail page, visible only when status is `active`. - New port-scoped `GET /api/v1/berth-reservations` list endpoint and `[portSlug]/berth-reservations` page so users can see all reservations across all berths from one place (was 404). - Berths "Edit" menu pushed `/berths/{id}?edit=true` but the detail page never read the param — it now auto-opens the edit sheet on mount and strips `edit` from the URL. - Reservation detail no longer shows raw 8-char UUIDs for Berth / Yacht / Client; reuses the lazy-fetching link components from the list view. - Yacht "Interests" and "Reservations" tabs replaced their "Coming soon" stubs with real lists fetched from the existing service routes. - Dashboard "Pipeline Value" KPI used `select(berthId, price)` and summed per active interest, so a berth with three open interests was counted three times. Switched to `selectDistinct(berthId, price)`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> 2026-05-02 23:01:15 +02:00
test(audit-fixes): cover the new permission and webhook surfaces Adds integration coverage for the routes / handlers shipped in the preceding audit-fix commits, plus refactors two route files to expose inner handlers from a sibling `handlers.ts` (the pattern used elsewhere in `src/app/api/v1`) so tests can call them without the `withAuth(withPermission(…))` wrapper. New tests (18 cases across 4 files): - `tests/integration/portal-auth.test.ts` (6) — verifyPortalToken rejects tokens missing `aud: 'portal'` or `iss: 'pn-crm'`, with the wrong audience (CRM-session-replay shape) or wrong issuer, plus a round-trip happy path. Locks in the portal-vs-CRM token isolation. - `tests/integration/api/saved-views-ownership.test.ts` (6) — patch and delete handlers return 403 for a different user, 404 for an unknown id or cross-port id, and 200 for the owner. Ownership is enforced at the route layer regardless of the service's internal filtering. - `tests/integration/api/berth-reservations-list.test.ts` (3) — the new global list returns rows for the current port only and honors pagination params. A reservation in a different port never leaks. - `tests/integration/documents-expired-webhook.test.ts` (3) — handleDocumentExpired flips the document to `expired`, also flips the linked interest's `eoiStatus`, writes a `documentEvents` row, and is a no-op (not a throw) when the documensoId is unknown. Refactors: - `src/app/api/v1/saved-views/[id]/route.ts` extracts `patchHandler` / `deleteHandler` (and the shared `assertViewOwner`) into `handlers.ts`. The route file is now a 4-line `withAuth(handler)` wrapper. - `src/app/api/v1/berth-reservations/route.ts` extracts `listHandler` similarly. Tests import directly from `handlers.ts`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> 2026-05-02 23:17:08 +02:00			`export const GET = withAuth(withPermission('reservations', 'view', listHandler));`