NightSpire/web-next/app/api/forum/moderate/route.ts

import { getSession } from '@/lib/session'
import { getTopic } from '@/lib/forum'
import { getPost, setTopicFlag, setPostDeleted } from '@/lib/forum-write'
import { forumIsModerator } from '@/lib/forum-perm'

/**
 * Moderación del foro (solo moderadores), por POST para no mutar con GET.
 * kind='post'  → action: delete | undelete
 * kind='topic' → action: delete | undelete | lock | unlock
 */
export async function POST(request: Request) {
  const session = await getSession()
  if (!session.accountId) return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
  if (!(await forumIsModerator(session))) return Response.json({ success: false, error: 'forbidden' }, { status: 403 })

  let b: Record<string, string> = {}
  try {
    b = await request.json()
  } catch {
    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
  }
  const kind = String(b.kind ?? '')
  const id = Number(b.id)
  const action = String(b.action ?? '')
  if (!id || (kind !== 'post' && kind !== 'topic'))
    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })

  if (kind === 'post') {
    const post = await getPost(id)
    if (!post) return Response.json({ success: false, error: 'postNotFound' }, { status: 404 })
    if (action === 'delete') await setPostDeleted(id, true)
    else if (action === 'undelete') await setPostDeleted(id, false)
    else return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
    return Response.json({ success: true })
  }

  const topic = await getTopic(id, true)
  if (!topic) return Response.json({ success: false, error: 'topicNotFound' }, { status: 404 })
  switch (action) {
    case 'delete':
      await setTopicFlag(id, 'deleted', true)
      break
    case 'undelete':
      await setTopicFlag(id, 'deleted', false)
      break
    case 'lock':
      await setTopicFlag(id, 'locked', true)
      break
    case 'unlock':
      await setTopicFlag(id, 'locked', false)
      break
    default:
      return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
  }
  return Response.json({ success: true })
}