fix: opravy po review

server/src/index.ts

@@ -1,7 +1,7 @@
 import express from "express";
 import bodyParser from "body-parser";
 import cors from 'cors';
-import { getData, getDateForWeekIndex, getToday } from "./service";
+import { getData, addChoice, getDateForWeekIndex, getToday } from "./service";
 import { MealSlot } from "../../types/gen/types.gen";
 import dotenv from 'dotenv';
 import path from 'path';
@@ -9,8 +9,8 @@ import { getQr } from "./qr";
 import { generateToken, getLogin, verify } from "./auth";
 import { getIsWeekend, InsufficientPermissions, PizzaDayConflictError, parseToken } from "./utils";
 import { getPendingQrs } from "./pizza";
-import { initWebsocket } from "./websocket";
-import { startReminderScheduler } from "./pushReminder";
+import { initWebsocket, getWebsocket } from "./websocket";
+import { startReminderScheduler, verifyQuickChoiceToken } from "./pushReminder";
 import { storageReady } from "./storage";
 import pizzaDayRoutes from "./routes/pizzaDayRoutes";
 import foodRoutes, { refreshMetoda } from "./routes/foodRoutes";
@@ -116,6 +116,22 @@ app.get("/api/qr", async (req, res) => {
 // Přeskočení auth pro refresh dat xd
 app.use("/api/food/refresh", refreshMetoda);
 
+// Rychlá akce z push notifikace — autentizace pomocí HMAC tokenu z push payloadu (SW nemá přístup k JWT)
+app.post("/api/notifications/push/quickChoice", async (req, res, next) => {
+    try {
+        const { login, token } = req.body ?? {};
+        if (!login || typeof login !== 'string' || !token || typeof token !== 'string') {
+            return res.status(400).json({ error: 'Chybí login nebo token' });
+        }
+        if (!verifyQuickChoiceToken(login, token)) {
+            return res.status(403).json({ error: 'Neplatný token' });
+        }
+        const updatedData = await addChoice(login, false, 'NEOBEDVAM', undefined, undefined);
+        getWebsocket().emit("message", updatedData);
+        res.status(200).json({});
+    } catch (e: any) { next(e); }
+});
+
 /** Middleware ověřující JWT token */
 app.use("/api/", (req, res, next) => {
     if (HTTP_REMOTE_USER_ENABLED) {