Add public profiles and cosmetic shop

lib/cosmetics-api.ts

@@ -0,0 +1,52 @@
+import "server-only";
+import { NextRequest, NextResponse } from "next/server";
+import { profileCosmeticActionSchema } from "@/shared/profile-cosmetics";
+import { admin, required, user } from "./supabase";
+import { browserAccount } from "./request-security";
+import { profileCosmeticsState } from "./profile-cosmetics";
+
+type Context = {
+  jsonBody: (request: NextRequest) => Promise<unknown>;
+  limit: (key: string, count: number, seconds: number) => Promise<void>;
+};
+
+const json = (body: unknown, status = 200) =>
+  NextResponse.json(body, { status, headers: { "Cache-Control": "no-store" } });
+
+export async function cosmeticsApi(
+  request: NextRequest,
+  path: string[],
+  context: Context,
+) {
+  if (path.length !== 1) return json({ error: "Not found" }, 404);
+  const account = await browserAccount(request, user);
+  if (request.method === "GET")
+    return json({ shop: await profileCosmeticsState(account.id) });
+  if (request.method !== "POST")
+    return json({ error: "Method not allowed" }, 405);
+
+  const body = profileCosmeticActionSchema.parse(
+    await context.jsonBody(request),
+  );
+  if (body.action === "purchase") {
+    await context.limit("cosmetic-purchase:" + account.id, 8, 60);
+    return json({
+      shop: required(
+        await admin().rpc("buy_profile_cosmetic", {
+          p_user: account.id,
+          p_cosmetic_id: body.cosmeticId,
+        }),
+      ),
+    });
+  }
+
+  await context.limit("cosmetic-equip:" + account.id, 30, 60);
+  return json({
+    shop: required(
+      await admin().rpc("equip_profile_cosmetic", {
+        p_user: account.id,
+        p_cosmetic_id: body.cosmeticId,
+      }),
+    ),
+  });
+}