import { NextRequest, NextResponse } from 'next/server' import { createServerSupabaseClient } from '@/lib/supabase' export async function DELETE( req: NextRequest, { params }: { params: { messageId: string } } ) { try { const { messageId } = params if (!messageId) { return NextResponse.json({ error: 'Message ID is required' }, { status: 400 }) } const supabase = createServerSupabaseClient() // Get current user session from auth header const authHeader = req.headers.get('authorization') let user try { if (authHeader) { const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(authHeader.replace('Bearer ', '')) if (!authError) user = authUser } else { const { data: { user: sessionUser }, error: sessionError } = await supabase.auth.getUser() if (!sessionError) user = sessionUser } } catch (e) { // Ignore auth errors } if (!user) { return NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) } // First, get the message to verify ownership and get chat_id const { data: message, error: fetchError } = await supabase .from('messages') .select('id, chat_id, type, content') .eq('id', messageId) .single() if (fetchError) { if (fetchError.code === 'PGRST116') { return NextResponse.json({ error: 'Message not found' }, { status: 404 }) } console.error('Error fetching message:', fetchError) return NextResponse.json({ error: 'Failed to fetch message' }, { status: 500 }) } // Verify the user has access to this message through the chat const { data: chat, error: chatError } = await supabase .from('chats') .select('id, user_id, chat_type, book_id') .eq('id', message.chat_id) .single() if (chatError || !chat) { console.error('Error fetching chat:', chatError) return NextResponse.json({ error: 'Chat not found' }, { status: 404 }) } // Check if user owns the chat (for standalone chats) or the book (for book chats) let hasAccess = false if (chat.chat_type === 'standalone') { // For standalone chats, user must own the chat hasAccess = chat.user_id === user.id } else if (chat.chat_type === 'book' && chat.book_id) { // For book chats, user must own the book hasAccess = await checkBookOwnership(supabase, chat.book_id, user.id) } if (!hasAccess) { console.log('Authorization failed:', { messageId, chatType: chat.chat_type, chatUserId: chat.user_id, currentUserId: user.id, bookId: chat.book_id }) return NextResponse.json({ error: 'Unauthorized' }, { status: 403 }) } // Delete the message const { error: deleteError } = await supabase .from('messages') .delete() .eq('id', messageId) if (deleteError) { console.error('Error deleting message:', deleteError) return NextResponse.json({ error: 'Failed to delete message' }, { status: 500 }) } console.log('Message deleted successfully:', { messageId, chatId: message.chat_id }) return NextResponse.json({ success: true, messageId }) } catch (error) { console.error('Error in message deletion:', error) return NextResponse.json({ error: 'Internal server error' }, { status: 500 }) } } // Helper function to check if user owns a book async function checkBookOwnership(supabase: any, bookId: string, userId: string): Promise { const { data: book, error } = await supabase .from('books') .select('id') .eq('id', bookId) .eq('user_id', userId) .single() return !error && !!book }