yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(auth): Centralize project access checks

Browse Source 
- Move `checkProjectAccess` function to `lib/auth.ts`
- Consolidate project access logic into a single utility
- Simplify access checks in video API routes
- Remove redundant project member inclusions from queries
This commit is contained in:
Yusuf İpek
2026-02-08 14:17:12 +03:00
parent 05150d5a20
commit 062a0aec83
3 changed files with 61 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/projects/[projectId]/videos/[videoId]/route.ts
+5 -9
View File
@@ -1,7 +1,7 @@
import { NextRequest } from 'next/server';
import { revalidatePath } from 'next/cache';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { auth, checkProjectAccess } from '@/lib/auth';
import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
import { rateLimit } from '@/lib/rate-limit';
import { cleanupVideoVoiceFiles } from '@/lib/r2-cleanup';
@@ -18,9 +18,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
const video = await db.video.findFirst({
where: { id: videoId, projectId },
include: {
project: {
include: { members: { where: { userId: session?.user?.id || '' } } },
},
project: true,
versions: {
orderBy: { versionNumber: 'desc' },
include: {
@@ -49,12 +47,10 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
return apiErrors.notFound('Video');
}
// Check access
const isOwner = session?.user?.id === video.project.ownerId;
const isMember = video.project.members.length > 0;
const isPublic = video.project.visibility === 'PUBLIC';
// Check access including workspace membership
const access = await checkProjectAccess(video.project, session?.user?.id);
if (!isOwner && !isMember && !isPublic) {
if (!access.hasAccess) {
return apiErrors.forbidden('Access denied');
}
app/api/watch/[videoId]/route.ts
+3 -34
View File
@@ -1,37 +1,10 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { auth, checkProjectAccess } from '@/lib/auth';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ videoId: string }> };
// Helper to check project access including workspace membership
async function checkProjectAccess(project: { ownerId: string; workspaceId: string; visibility: string; members: { userId: string }[] }, userId: string | undefined) {
const isOwner = userId === project.ownerId;
const isMember = project.members.some(m => m.userId === userId);
const isPublic = project.visibility === 'PUBLIC';
// Check workspace membership for access
let isWorkspaceMember = false;
if (!isOwner && !isMember && !isPublic && userId) {
const wsMember = await db.workspaceMember.findUnique({
where: {
workspaceId_userId: {
workspaceId: project.workspaceId,
userId: userId,
},
},
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
isWorkspaceMember = !!wsMember || wsOwner?.ownerId === userId;
}
return { isOwner, isMember, isPublic, isWorkspaceMember, hasAccess: isOwner || isMember || isPublic || isWorkspaceMember };
}
// GET /api/watch/[videoId] - Public watch endpoint (no projectId needed)
export async function GET(request: NextRequest, { params }: RouteParams) {
try {
@@ -41,11 +14,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
const video = await db.video.findUnique({
where: { id: videoId },
include: {
project: {
include: {
members: { where: { userId: session?.user?.id || '' } },
},
},
project: true,
versions: {
orderBy: { versionNumber: 'desc' },
include: {
@@ -92,7 +61,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
visibility: project.visibility,
},
isAuthenticated: !!session?.user?.id,
canComment: access.isOwner || access.isMember || access.isPublic || access.isWorkspaceMember,
canComment: access.hasAccess,
});
return withCacheControl(response, 'private, no-cache');