Merge branch 'main' of https://git.coastit.co.za/caitlin/CRM_ENVR

src/app/api/conversations/[id]/messages/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"
+import { avatarSvgUrl } from "@/lib/avatar"
 
 export async function GET(
   _request: NextRequest,
@@ -12,18 +13,40 @@ export async function GET(
 
     const { id } = await params
 
+    const { searchParams } = new URL(_request.url)
+    const limit = parseInt(searchParams.get("limit") || "100", 10)
+    const offset = parseInt(searchParams.get("offset") || "0", 10)
+    const before = searchParams.get("before") || ""
+
+    // Verify user is a participant
+    const partCheck = await query(
+      `SELECT 1 FROM conversation_participants WHERE conversation_id = $1 AND user_id = $2`,
+      [id, user.id]
+    )
+    if (partCheck.rows.length === 0) {
+      return NextResponse.json({ error: "Not a participant" }, { status: 403 })
+    }
+
+    let msgSql = `SELECT m.id, m.sender_id, m.content, m.created_at, m.updated_at, m.deleted_at,
+                         u.first_name || ' ' || u.last_name AS sender_name,
+                         u.email AS sender_email,
+                         u.avatar_url AS sender_avatar_url
+                  FROM messages m
+                  JOIN users u ON u.id = m.sender_id
+                  WHERE m.conversation_id = $1 AND m.deleted_at IS NULL`
+    const msgParams: any[] = [id]
+
+    if (before) {
+      msgSql += ` AND m.created_at < $2`
+      msgParams.push(before)
+    }
+
+    msgSql += ` ORDER BY m.created_at ASC`
+    msgSql += ` LIMIT $${msgParams.length + 1} OFFSET $${msgParams.length + 2}`
+    msgParams.push(limit, offset)
+
     const [msgResult, otherReadResult] = await Promise.all([
-      query(
-        `SELECT m.id, m.sender_id, m.content, m.created_at, m.updated_at, m.deleted_at,
-                u.first_name || ' ' || u.last_name AS sender_name,
-                u.email AS sender_email,
-                u.avatar_url AS sender_avatar_url
-         FROM messages m
-         JOIN users u ON u.id = m.sender_id
-         WHERE m.conversation_id = $1 AND m.deleted_at IS NULL
-         ORDER BY m.created_at ASC`,
-        [id],
-      ),
+      query(msgSql, msgParams),
       query(
         `SELECT last_read_at FROM conversation_participants
          WHERE conversation_id = $1 AND user_id != $2`,
@@ -40,7 +63,7 @@ export async function GET(
       conversationId: id,
       senderId: row.sender_id,
       senderName: row.sender_name,
-      senderAvatar: row.sender_avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(row.sender_name)}&background=1d4ed8&color=fff&size=128`,
+      senderAvatar: avatarSvgUrl(row.sender_name),
       content: row.content,
       timestamp: formatTime(new Date(row.created_at)),
       createdAt: row.created_at,
@@ -65,8 +88,17 @@ export async function POST(
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
     const { id } = await params
-    const { content } = await request.json()
 
+    // Verify user is a participant
+    const partCheck = await query(
+      `SELECT 1 FROM conversation_participants WHERE conversation_id = $1 AND user_id = $2`,
+      [id, user.id]
+    )
+    if (partCheck.rows.length === 0) {
+      return NextResponse.json({ error: "Not a participant" }, { status: 403 })
+    }
+
+    const { content } = await request.json()
     if (!content?.trim()) {
       return NextResponse.json({ error: "Message content is required" }, { status: 400 })
     }

src/app/api/conversations/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"
+import { avatarSvgUrl } from "@/lib/avatar"
 
 export async function GET() {
   try {
@@ -26,7 +27,8 @@ export async function GET() {
        WHERE c.id IN (
          SELECT conversation_id FROM conversation_participants WHERE user_id = $1
        )
-       ORDER BY c.updated_at DESC`,
+        ORDER BY c.updated_at DESC
+        LIMIT 50`,
       [user.id],
     )
 
@@ -37,7 +39,7 @@ export async function GET() {
         id: row.other_user_id,
         name: row.other_user_name,
         email: row.other_user_email,
-        avatar: row.other_user_avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(row.other_user_name)}&background=1d4ed8&color=fff&size=128`,
+        avatar: avatarSvgUrl(row.other_user_name),
       },
       lastMessage: row.last_message || "",
       lastMessageTime: row.last_message_time ? timeAgo(new Date(row.last_message_time)) : "",
@@ -103,7 +105,7 @@ export async function POST(request: NextRequest) {
           id: other.id,
           name: other.name,
           email: other.email,
-          avatar: other.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(other.name)}&background=1d4ed8&color=fff&size=128`,
+          avatar: avatarSvgUrl(other.name),
         },
         lastMessage: "",
         lastMessageTime: "",