Delete bookmarked searches in the backend

backend/api/src/app.ts

@@ -61,6 +61,7 @@ import {vote} from "api/vote";
 import {contact} from "api/contact";
 import {saveSubscription} from "api/save-subscription";
 import {createBookmarkedSearch} from './create-bookmarked-search'
+import {deleteBookmarkedSearch} from './delete-bookmarked-search'
 
 // const corsOptions: CorsOptions = {
 //   origin: ['*'], // Only allow requests from this domain
@@ -187,6 +188,7 @@ const handlers: { [k in APIPath]: APIHandler<k> } = {
   'set-last-online-time': setLastOnlineTime,
   'save-subscription': saveSubscription,
   'create-bookmarked-search': createBookmarkedSearch,
+    'delete-bookmarked-search': deleteBookmarkedSearch,
 }
 
 Object.entries(handlers).forEach(([path, handler]) => {

backend/api/src/delete-bookmarked-search.ts

@@ -0,0 +1,23 @@
+import {APIHandler} from './helpers/endpoint'
+import {createSupabaseDirectClient} from 'shared/supabase/init'
+
+export const deleteBookmarkedSearch: APIHandler<'delete-bookmarked-search'> = async (
+  props,
+  auth
+) => {
+  const creator_id = auth.uid
+  const {id} = props
+
+  const pg = createSupabaseDirectClient()
+
+  // Only allow deleting your own bookmarked searches
+  await pg.none(
+    `
+      DELETE FROM bookmarked_searches
+      WHERE id = $1 AND creator_id = $2
+    `,
+    [id, creator_id]
+  )
+
+  return {}
+}

common/src/api/schema.ts

@@ -595,6 +595,15 @@ export const API = (_apiTypeCheck = {
         search_name: z.string().nullable().optional(),
       }),
   },
+  'delete-bookmarked-search': {
+    method: 'POST',
+    authed: true,
+    rateLimited: true,
+    returns: {} as any,
+    props: z.object({
+      id: z.number(),
+    }),
+  },
 } as const)
 
 export type APIPath = keyof typeof API

web/lib/supabase/searches.ts

@@ -46,9 +46,6 @@ export const deleteBookmarkedSearch = async (
   id: number,
 ) => {
   if (!id) return
-  await run(
-    db.from('bookmarked_searches').delete().eq('id', id)
-  ).then(() => {
-    track('bookmarked_searches delete', {id})
-  })
+  await api('delete-bookmarked-search', {id})
+  track('bookmarked_searches delete', {id})
 }