chore(idempotency): default userIdResolver to cookie session (#118)

Drop the `resolveUserIdForIdempotency` helper that was duplicated across
three PWA write routes. `withIdempotency` now reads the userId from
`getSession()` by default; routes that authenticate via Bearer token can
still pass a custom resolver.

Net: −15 LOC across the route layer, +2 test cases for the new default.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/api/measurements/route.ts

@@ -2,7 +2,12 @@ import { prisma } from "@/lib/db";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
 import { auditLog } from "@/lib/auth/audit";
-import { apiSuccess, apiError, getClientIp, safeJson } from "@/lib/api-response";
+import {
+  apiSuccess,
+  apiError,
+  getClientIp,
+  safeJson,
+} from "@/lib/api-response";
 import {
   createMeasurementSchema,
   createBatchMeasurementSchema,
@@ -10,7 +15,6 @@ import {
   getUnitForType,
 } from "@/lib/validations/measurement";
 import { withIdempotency } from "@/lib/idempotency";
-import { getSession } from "@/lib/auth/session";
 import { NextRequest } from "next/server";
 import type {
   MeasurementType,
@@ -19,11 +23,6 @@ import type {
 } from "@/generated/prisma/client";
 import { Prisma } from "@/generated/prisma/client";
 
-async function resolveUserIdForIdempotency(): Promise<string | null> {
-  const session = await getSession().catch(() => null);
-  return session?.user.id ?? null;
-}
-
 export const GET = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
 
@@ -66,9 +65,7 @@ export const GET = apiHandler(async (request: NextRequest) => {
   });
 });
 
-export const POST = apiHandler(
-  withIdempotency<[NextRequest]>(postMeasurement, resolveUserIdForIdempotency),
-);
+export const POST = apiHandler(withIdempotency<[NextRequest]>(postMeasurement));
 
 async function postMeasurement(request: NextRequest) {
   const { user } = await requireAuth();
@@ -149,7 +146,10 @@ async function postMeasurement(request: NextRequest) {
       },
     });
   } catch (err) {
-    if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
+    if (
+      err instanceof Prisma.PrismaClientKnownRequestError &&
+      err.code === "P2002"
+    ) {
       return apiError("A measurement with this data already exists", 409);
     }
     throw err;

src/app/api/medications/[id]/intake/route.ts

@@ -2,27 +2,23 @@ import { prisma } from "@/lib/db";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
 import { auditLog } from "@/lib/auth/audit";
-import { apiSuccess, apiError, getClientIp, safeJson } from "@/lib/api-response";
+import {
+  apiSuccess,
+  apiError,
+  getClientIp,
+  safeJson,
+} from "@/lib/api-response";
 import {
   intakeSchema,
   listIntakeEventsSchema,
 } from "@/lib/validations/medication";
 import { withIdempotency } from "@/lib/idempotency";
-import { getSession } from "@/lib/auth/session";
 import { NextRequest } from "next/server";
 
 type RouteParams = { params: Promise<{ id: string }> };
 
-async function resolveUserIdForIdempotency(): Promise<string | null> {
-  const session = await getSession().catch(() => null);
-  return session?.user.id ?? null;
-}
-
 export const POST = apiHandler(
-  withIdempotency<[NextRequest, RouteParams]>(
-    postIntake,
-    resolveUserIdForIdempotency,
-  ),
+  withIdempotency<[NextRequest, RouteParams]>(postIntake),
 );
 
 async function postIntake(request: NextRequest, { params }: RouteParams) {
@@ -116,38 +112,40 @@ async function postIntake(request: NextRequest, { params }: RouteParams) {
   return apiSuccess(event, 201);
 }
 
-export const GET = apiHandler(async (request: NextRequest, { params }: RouteParams) => {
-  const { user } = await requireAuth();
+export const GET = apiHandler(
+  async (request: NextRequest, { params }: RouteParams) => {
+    const { user } = await requireAuth();
 
-  const { id } = await params;
-  const medication = await prisma.medication.findUnique({ where: { id } });
-  if (!medication || medication.userId !== user.id) {
-    return apiError("Medication not found", 404);
-  }
+    const { id } = await params;
+    const medication = await prisma.medication.findUnique({ where: { id } });
+    if (!medication || medication.userId !== user.id) {
+      return apiError("Medication not found", 404);
+    }
 
-  const searchParams = Object.fromEntries(request.nextUrl.searchParams);
-  const parsed = listIntakeEventsSchema.safeParse(searchParams);
-  if (!parsed.success) {
-    return apiError(parsed.error.issues[0].message, 422);
-  }
+    const searchParams = Object.fromEntries(request.nextUrl.searchParams);
+    const parsed = listIntakeEventsSchema.safeParse(searchParams);
+    if (!parsed.success) {
+      return apiError(parsed.error.issues[0].message, 422);
+    }
 
-  const { limit, offset, sortBy, sortDir } = parsed.data;
-  const where = { medicationId: id, userId: user.id };
+    const { limit, offset, sortBy, sortDir } = parsed.data;
+    const where = { medicationId: id, userId: user.id };
 
-  const [events, total] = await Promise.all([
-    prisma.medicationIntakeEvent.findMany({
-      where,
-      orderBy: { [sortBy]: sortDir },
-      take: limit,
-      skip: offset,
-    }),
-    prisma.medicationIntakeEvent.count({ where }),
-  ]);
+    const [events, total] = await Promise.all([
+      prisma.medicationIntakeEvent.findMany({
+        where,
+        orderBy: { [sortBy]: sortDir },
+        take: limit,
+        skip: offset,
+      }),
+      prisma.medicationIntakeEvent.count({ where }),
+    ]);
 
-  annotate({
-    action: { name: "medication.intake.list" },
-    meta: { medication_id: id, total },
-  });
+    annotate({
+      action: { name: "medication.intake.list" },
+      meta: { medication_id: id, total },
+    });
 
-  return apiSuccess({ events, meta: { total, limit, offset } });
-});
+    return apiSuccess({ events, meta: { total, limit, offset } });
+  },
+);

src/app/api/mood-entries/route.ts

@@ -1,6 +1,11 @@
 import { prisma } from "@/lib/db";
 import { auditLog } from "@/lib/auth/audit";
-import { apiSuccess, apiError, getClientIp, safeJson } from "@/lib/api-response";
+import {
+  apiSuccess,
+  apiError,
+  getClientIp,
+  safeJson,
+} from "@/lib/api-response";
 import {
   createMoodEntrySchema,
   listMoodEntriesSchema,
@@ -11,12 +16,6 @@ import { Prisma } from "@/generated/prisma/client";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
 import { withIdempotency } from "@/lib/idempotency";
-import { getSession } from "@/lib/auth/session";
-
-async function resolveUserIdForIdempotency(): Promise<string | null> {
-  const session = await getSession().catch(() => null);
-  return session?.user.id ?? null;
-}
 
 function toBerlinDate(date: Date): string {
   return new Intl.DateTimeFormat("sv-SE", {
@@ -67,7 +66,10 @@ export const GET = apiHandler(async (request: NextRequest) => {
     prisma.moodEntry.count({ where }),
   ]);
 
-  annotate({ action: { name: "mood-entries.list" }, meta: { total, limit, offset } });
+  annotate({
+    action: { name: "mood-entries.list" },
+    meta: { total, limit, offset },
+  });
 
   const entriesWithParsedTags = entries.map((e) => ({
     ...e,
@@ -80,9 +82,7 @@ export const GET = apiHandler(async (request: NextRequest) => {
   });
 });
 
-export const POST = apiHandler(
-  withIdempotency<[NextRequest]>(postMoodEntry, resolveUserIdForIdempotency),
-);
+export const POST = apiHandler(withIdempotency<[NextRequest]>(postMoodEntry));
 
 async function postMoodEntry(request: NextRequest) {
   const { user } = await requireAuth();
@@ -118,15 +118,18 @@ async function postMoodEntry(request: NextRequest) {
       details: { moodEntryId: entry.id, mood },
     });
 
-    annotate({ action: { name: "mood-entries.create" }, meta: { moodEntryId: entry.id, mood } });
+    annotate({
+      action: { name: "mood-entries.create" },
+      meta: { moodEntryId: entry.id, mood },
+    });
 
     return apiSuccess({ ...entry, tags: parseTags(entry.tags) }, 201);
   } catch (err) {
-    if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
-      return apiError(
-        "A mood entry with this data already exists",
-        409,
-      );
+    if (
+      err instanceof Prisma.PrismaClientKnownRequestError &&
+      err.code === "P2002"
+    ) {
+      return apiError("A mood entry with this data already exists", 409);
     }
     throw err;
   }