fix(api): add rate limiting, file size validation, and timeout handling

- Add Content-Length header check for early file size validation on audio upload
- Add rate limiting (60 req/min) to public watch endpoint
- Add 10-second timeout with AbortController for YouTube and Vimeo oEmbed requests
- Add automatic rate limit cleanup interval for self-hosted servers
- Fix null check for comment.replies in video page content
- Add checkWorkspaceAccess helper for workspace authorization

lib/auth.ts

@@ -125,3 +125,33 @@ export async function checkProjectAccess(
     canDelete,
   };
 }
+
+// Helper to check workspace access
+export async function checkWorkspaceAccess(
+  workspace: { id: string; ownerId: string },
+  userId: string | undefined
+) {
+  const isOwner = userId === workspace.ownerId;
+
+  // Get workspace membership
+  const workspaceMember = userId
+    ? await db.workspaceMember.findUnique({
+        where: { workspaceId_userId: { workspaceId: workspace.id, userId } },
+      })
+    : null;
+  const isMember = !!workspaceMember;
+  const isAdmin = workspaceMember?.role === WorkspaceMemberRole.ADMIN;
+
+  const hasAccess = isOwner || isMember;
+  const canEdit = isOwner || isAdmin;
+  const canDelete = isOwner;
+
+  return {
+    isOwner,
+    isMember,
+    isAdmin,
+    hasAccess,
+    canEdit,
+    canDelete,
+  };
+}

lib/rate-limit.ts

@@ -160,6 +160,14 @@ export async function cleanupRateLimits(): Promise<void> {
     }
 }
 
+// Start cleanup interval when the module is loaded (for self-hosted servers)
+// Cleanup runs every 5 minutes to remove expired rate limit entries
+if (typeof setInterval !== 'undefined') {
+    setInterval(() => {
+        cleanupRateLimits().catch(console.error);
+    }, 5 * 60 * 1000);
+}
+
 /**
  * One-call rate limit check that returns a 429 NextResponse if blocked, or null if allowed.
  * Use at the top of any API handler:

lib/video-providers/vimeo.ts

@@ -65,9 +65,14 @@ export const vimeoProvider: VideoProvider = {
     const cached = getCachedMetadata(cacheKey);
     if (cached) return cached;
     try {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 10000); // 10 second timeout
+
       const response = await fetch(
-        `https://vimeo.com/api/oembed.json?url=https://vimeo.com/${videoId}`
+        `https://vimeo.com/api/oembed.json?url=https://vimeo.com/${videoId}`,
+        { signal: controller.signal }
       );
+      clearTimeout(timeoutId);
       
       if (!response.ok) {
         throw new Error('Failed to fetch video metadata');

lib/video-providers/youtube.ts

@@ -64,9 +64,14 @@ export const youtubeProvider: VideoProvider = {
     // Using oEmbed API - no API key required
     // For production, you might want to use YouTube Data API for more data
     try {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 10000); // 10 second timeout
+
       const response = await fetch(
-        `https://www.youtube.com/oembed?url=https://www.youtube.com/watch?v=${videoId}&format=json`
+        `https://www.youtube.com/oembed?url=https://www.youtube.com/watch?v=${videoId}&format=json`,
+        { signal: controller.signal }
       );
+      clearTimeout(timeoutId);
       
       if (!response.ok) {
         throw new Error('Failed to fetch video metadata');