17 lines
836 B
TypeScript
17 lines
836 B
TypeScript
import { z } from 'zod';
|
|
import { requireAdmin } from '../../../utils/auth';
|
|
import { updateOrderStatus } from '../../../utils/store';
|
|
import { recordAudit } from '../../../utils/audit';
|
|
|
|
const schema = z.object({ status: z.enum(['pending', 'paid', 'shipped', 'canceled']) });
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
const admin = await requireAdmin(event);
|
|
const id = getRouterParam(event, 'id')!;
|
|
const parsed = schema.safeParse(await readBody(event).catch(() => ({})));
|
|
if (!parsed.success) throw createError({ statusCode: 400, statusMessage: 'Invalid status' });
|
|
const order = await updateOrderStatus(id, parsed.data.status);
|
|
await recordAudit({ actorId: admin.id, action: 'order.status', target: id, meta: { status: parsed.data.status } });
|
|
return { order: { id: order.id, status: order.status } };
|
|
});
|