Spaces:
Sleeping
Sleeping
Commit ·
bdeb9b7
1
Parent(s): 73a629a
refactor(cart): remove duplicate endpoint for cart retrieval
Browse filesThe endpoint `/appointment/{customer_id}` was redundant since the same functionality is already provided by `/appointment` which uses the customer ID from the auth token. This simplifies the API surface while maintaining security.
- app/routers/cart.py +1 -16
app/routers/cart.py
CHANGED
|
@@ -44,22 +44,7 @@ async def get_from_cart(current_user: dict = Depends(get_current_user)):
|
|
| 44 |
return await retrieve_appointment_from_cart(customer_id)
|
| 45 |
except Exception as e:
|
| 46 |
raise HTTPException(status_code=500, detail=f"Failed to retrieve from cart: {e}")
|
| 47 |
-
|
| 48 |
-
@router.get("/appointment/{customer_id}")
|
| 49 |
-
async def get_from_cart_by_customer_id(customer_id: str, current_user: dict = Depends(get_current_user)):
|
| 50 |
-
try:
|
| 51 |
-
# Extract customer_id from current_user token
|
| 52 |
-
token_customer_id = current_user.get("sub")
|
| 53 |
-
if not token_customer_id:
|
| 54 |
-
raise HTTPException(status_code=401, detail="Invalid token: missing customer ID")
|
| 55 |
-
|
| 56 |
-
# For security, ensure the path customer_id matches the token customer_id
|
| 57 |
-
if customer_id != token_customer_id:
|
| 58 |
-
raise HTTPException(status_code=403, detail="Access denied: cannot access other customer's cart")
|
| 59 |
-
|
| 60 |
-
return await retrieve_appointment_from_cart(customer_id)
|
| 61 |
-
except Exception as e:
|
| 62 |
-
raise HTTPException(status_code=500, detail=f"Failed to retrieve from cart: {e}")
|
| 63 |
|
| 64 |
@router.delete("/appointment")
|
| 65 |
async def delete_from_cart(current_user: dict = Depends(get_current_user)):
|
|
|
|
| 44 |
return await retrieve_appointment_from_cart(customer_id)
|
| 45 |
except Exception as e:
|
| 46 |
raise HTTPException(status_code=500, detail=f"Failed to retrieve from cart: {e}")
|
| 47 |
+
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 48 |
|
| 49 |
@router.delete("/appointment")
|
| 50 |
async def delete_from_cart(current_user: dict = Depends(get_current_user)):
|