yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(comments): Grant workspace members access to comments

Browse Source 
- Allow workspace members to view comments
- Enable workspace members to resolve/unresolve comments
- Permit workspace members to delete comments
- Verify workspace membership or ownership for access
This commit is contained in:
Yusuf İpek
2026-02-08 13:54:04 +03:00
parent f8afec0291
commit 05150d5a20
6 changed files with 189 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/projects/[projectId]/videos/[videoId]/route.ts
+28 -5
View File
@@ -2,7 +2,7 @@ import { NextRequest } from 'next/server';
import { revalidatePath } from 'next/cache';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole } from '@prisma/client';
import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
import { rateLimit } from '@/lib/rate-limit';
import { cleanupVideoVoiceFiles } from '@/lib/r2-cleanup';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
@@ -86,7 +86,16 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
const video = await db.video.findFirst({
where: { id: videoId, projectId },
include: {
project: { include: { members: { where: { userId: session.user.id } } } },
project: {
include: {
members: { where: { userId: session.user.id } },
workspace: {
include: {
members: { where: { userId: session.user.id } },
},
},
},
},
},
});
@@ -96,8 +105,10 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
const isOwner = video.project.ownerId === session.user.id;
const membership = video.project.members[0];
const workspaceMembership = video.project.workspace.members[0];
const canEdit = isOwner ||
membership?.role === ProjectMemberRole.ADMIN;
membership?.role === ProjectMemberRole.ADMIN ||
workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
if (!canEdit) {
return apiErrors.forbidden('Access denied');
@@ -144,7 +155,16 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
const video = await db.video.findFirst({
where: { id: videoId, projectId },
include: {
project: { include: { members: { where: { userId: session.user.id } } } },
project: {
include: {
members: { where: { userId: session.user.id } },
workspace: {
include: {
members: { where: { userId: session.user.id } },
},
},
},
},
},
});
@@ -154,8 +174,11 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
const isOwner = video.project.ownerId === session.user.id;
const membership = video.project.members[0];
const workspaceMembership = video.project.workspace.members[0];
// Destructive actions limited to OWNER and ADMIN only
const canDelete = isOwner || membership?.role === ProjectMemberRole.ADMIN;
const canDelete = isOwner ||
membership?.role === ProjectMemberRole.ADMIN ||
workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
if (!canDelete) {
return apiErrors.forbidden('Only project owner or admin can delete videos');
app/api/projects/[projectId]/videos/[videoId]/versions/route.ts
+14 -3
View File
@@ -1,7 +1,7 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole } from '@prisma/client';
import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
import { validateUrl, validateOptionalUrl } from '@/lib/validation';
import { rateLimit } from '@/lib/rate-limit';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
@@ -67,7 +67,16 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
const video = await db.video.findFirst({
where: { id: videoId, projectId },
include: {
project: { include: { members: { where: { userId: session.user.id } } } },
project: {
include: {
members: { where: { userId: session.user.id } },
workspace: {
include: {
members: { where: { userId: session.user.id } },
},
},
},
},
versions: { orderBy: { versionNumber: 'desc' }, take: 1 },
},
});
@@ -78,8 +87,10 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
const isOwner = video.project.ownerId === session.user.id;
const membership = video.project.members[0];
const workspaceMembership = video.project.workspace.members[0];
const canEdit = isOwner ||
membership?.role === ProjectMemberRole.ADMIN;
membership?.role === ProjectMemberRole.ADMIN ||
workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
if (!canEdit) {
return apiErrors.forbidden('Access denied');
app/api/projects/[projectId]/videos/route.ts
+13 -4
View File
@@ -1,7 +1,7 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole } from '@prisma/client';
import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
import { validateUrl, validateOptionalUrl } from '@/lib/validation';
import { rateLimit } from '@/lib/rate-limit';
import { notifyProjectOwner } from '@/lib/notifications';
@@ -68,10 +68,17 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
return apiErrors.unauthorized();
}
// Check project access (must be owner or admin)
// Check project access (must be owner, project admin, or workspace admin)
const project = await db.project.findUnique({
where: { id: projectId },
include: { members: { where: { userId: session.user.id } } },
include: {
members: { where: { userId: session.user.id } },
workspace: {
include: {
members: { where: { userId: session.user.id } },
},
},
},
});
if (!project) {
@@ -80,8 +87,10 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
const isOwner = project.ownerId === session.user.id;
const membership = project.members[0];
const workspaceMembership = project.workspace.members[0];
const canEdit = isOwner ||
membership?.role === ProjectMemberRole.ADMIN;
membership?.role === ProjectMemberRole.ADMIN ||
workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
if (!canEdit) {
return apiErrors.forbidden('Access denied');