feat: Implement College Marketplace with Authentication, Media Uploads, and Seller Controls

app/api/chat/messages/route.ts

@@ -157,4 +157,3 @@ export async function POST(req: Request) {
     )
   }
 }
-

app/api/products/[id]/available/route.ts

@@ -0,0 +1,80 @@
+import dbConnect from '@/lib/dbConnect'
+import { NextRequest, NextResponse } from 'next/server'
+import mongoose from 'mongoose'
+import Product from '@/model/Product'
+import { verifyJwt } from '@/lib/auth-utils'
+
+type RouteContext = { params: Promise<{ id: string }> }
+
+/**
+ * PATCH /api/products/:id/available
+ * Mark a product as available again. Only seller can do this.
+ */
+export async function PATCH(req: NextRequest, context: RouteContext) {
+  try {
+    await dbConnect()
+
+    const { id } = await context.params
+
+    if (!mongoose.Types.ObjectId.isValid(id)) {
+      return NextResponse.json(
+        { message: 'Invalid product ID' },
+        { status: 400 }
+      )
+    }
+
+    // Authenticate the user
+    const authResponse = await verifyJwt(req)
+    if (authResponse.status !== 200) {
+      return authResponse
+    }
+
+    const authData = await authResponse.json()
+    const userId = authData.userId as string
+
+    const product = await Product.findById(id)
+    if (!product) {
+      return NextResponse.json(
+        { message: 'Product not found' },
+        { status: 404 }
+      )
+    }
+
+    // Verify ownership — only the seller can mark as available
+    if (product.seller.toString() !== userId) {
+      return NextResponse.json(
+        { message: 'Forbidden — you can only update your own listings' },
+        { status: 403 }
+      )
+    }
+
+    if (!product.is_sold) {
+      return NextResponse.json(
+        { message: 'Product is already available' },
+        { status: 400 }
+      )
+    }
+
+    product.is_sold = false
+    product.show_when_sold = false
+    if (product.quantity <= 0) {
+      product.quantity = 1
+    }
+
+    await product.save()
+
+    return NextResponse.json(
+      { message: 'Product is available again', product },
+      { status: 200 }
+    )
+  } catch (error: unknown) {
+    console.error('PATCH /api/products/[id]/available error:', error)
+    return NextResponse.json(
+      {
+        message:
+          error instanceof Error ? error.message : 'Internal Server Error',
+      },
+      { status: 500 }
+    )
+  }
+}

app/api/products/[id]/comments/route.ts

@@ -0,0 +1,122 @@
+import dbConnect from '@/lib/dbConnect'
+import { NextRequest, NextResponse } from 'next/server'
+import mongoose from 'mongoose'
+import Product, { IComment } from '@/model/Product'
+import User from '@/model/User'
+import { verifyJwt } from '@/lib/auth-utils'
+
+type RouteContext = { params: Promise<{ id: string }> }
+
+/**
+ * POST /api/products/:id/comments
+ * Add a new comment or reply to an existing comment.
+ */
+export async function POST(req: NextRequest, context: RouteContext) {
+  try {
+    await dbConnect()
+
+    const { id } = await context.params
+
+    if (!mongoose.Types.ObjectId.isValid(id)) {
+      return NextResponse.json(
+        { message: 'Invalid product ID' },
+        { status: 400 }
+      )
+    }
+
+    // Authenticate the user
+    const authResponse = await verifyJwt(req)
+    if (authResponse.status !== 200) {
+      return authResponse
+    }
+
+    const authData = await authResponse.json()
+    const userId = authData.userId as string
+
+    const body = await req.json()
+    const { text, offerPrice, parentCommentId } = body
+
+    if (!text || !String(text).trim()) {
+      return NextResponse.json(
+        { message: 'Comment text is required' },
+        { status: 400 }
+      )
+    }
+
+    const product = await Product.findById(id)
+    if (!product) {
+      return NextResponse.json(
+        { message: 'Product not found' },
+        { status: 404 }
+      )
+    }
+
+    if (!product.comments) {
+      product.comments = []
+    }
+
+    const newReply = {
+      user: new mongoose.Types.ObjectId(userId),
+      text: String(text).trim().substring(0, 500),
+      createdAt: new Date(),
+    }
+
+    if (parentCommentId) {
+      // It's a reply
+      if (!mongoose.Types.ObjectId.isValid(parentCommentId)) {
+        return NextResponse.json(
+          { message: 'Invalid parent comment ID' },
+          { status: 400 }
+        )
+      }
+
+      const parentComment = product.comments.find(
+        (c: any) => c._id && c._id.toString() === parentCommentId
+      ) as any
+      if (!parentComment) {
+        return NextResponse.json(
+          { message: 'Parent comment not found' },
+          { status: 404 }
+        )
+      }
+
+      parentComment.replies.push(newReply)
+    } else {
+      // Top level comment
+      const newComment = {
+        user: new mongoose.Types.ObjectId(userId),
+        text: String(text).trim().substring(0, 1000),
+        offerPrice:
+          offerPrice !== undefined && offerPrice !== null && offerPrice !== ''
+            ? Number(offerPrice)
+            : undefined,
+        createdAt: new Date(),
+        replies: [],
+      }
+      product.comments.push(newComment as any)
+    }
+
+    await product.save()
+
+    // We want the populated user info back, so we populate the newly added part, or just fetch the whole product populated
+    const populatedProduct = await Product.findById(product._id)
+      .populate('seller', 'name email image')
+      .populate({ path: 'comments.user', select: 'name email image' })
+      .populate({ path: 'comments.replies.user', select: 'name email image' })
+      .lean()
+
+    return NextResponse.json(
+      { message: 'Comment added successfully', product: populatedProduct },
+      { status: 201 }
+    )
+  } catch (error: unknown) {
+    console.error('POST /api/products/[id]/comments error:', error)
+    return NextResponse.json(
+      {
+        message:
+          error instanceof Error ? error.message : 'Internal Server Error',
+      },
+      { status: 500 }
+    )
+  }
+}