feat: implement R2 audio file management and rate limiting enhancements

- Add R2 client setup and audio upload functionality in lib/r2.ts.
- Create audio file cleanup functions in lib/r2-cleanup.ts to delete voice files associated with videos, projects, and workspaces.
- Enhance rate limiting in lib/rate-limit.ts with new action-specific limits and improved IP validation.
- Introduce a unified rate limit check function that returns a 429 response when limits are exceeded.
- Update package.json to include the AWS SDK for S3.

app/api/workspaces/[workspaceId]/members/[memberId]/route.ts

@@ -2,12 +2,16 @@ import { NextRequest, NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { auth } from '@/lib/auth';
 import { WorkspaceMemberRole } from '@prisma/client';
+import { rateLimit } from '@/lib/rate-limit';
 
 type RouteParams = { params: Promise<{ workspaceId: string; memberId: string }> };
 
 // PATCH /api/workspaces/[workspaceId]/members/[memberId] - Update member role
 export async function PATCH(request: NextRequest, { params }: RouteParams) {
     try {
+        const limited = await rateLimit(request, 'manage-member');
+        if (limited) return limited;
+
         const session = await auth();
         const { workspaceId, memberId } = await params;
 
@@ -64,6 +68,9 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
 // DELETE /api/workspaces/[workspaceId]/members/[memberId] - Remove member
 export async function DELETE(request: NextRequest, { params }: RouteParams) {
     try {
+        const limited = await rateLimit(request, 'manage-member');
+        if (limited) return limited;
+
         const session = await auth();
         const { workspaceId, memberId } = await params;
 

app/api/workspaces/[workspaceId]/members/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { auth } from '@/lib/auth';
 import { WorkspaceMemberRole } from '@prisma/client';
+import { rateLimit } from '@/lib/rate-limit';
 
 type RouteParams = { params: Promise<{ workspaceId: string }> };
 
@@ -60,6 +61,9 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
 // POST /api/workspaces/[workspaceId]/members - Invite a member
 export async function POST(request: NextRequest, { params }: RouteParams) {
     try {
+        const limited = await rateLimit(request, 'invite-member');
+        if (limited) return limited;
+
         const session = await auth();
         const { workspaceId } = await params;
 

app/api/workspaces/[workspaceId]/route.ts

@@ -1,6 +1,8 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { auth } from '@/lib/auth';
+import { rateLimit } from '@/lib/rate-limit';
+import { cleanupWorkspaceVoiceFiles } from '@/lib/r2-cleanup';
 
 type RouteParams = { params: Promise<{ workspaceId: string }> };
 
@@ -81,6 +83,9 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
 // PATCH /api/workspaces/[workspaceId] - Update a workspace
 export async function PATCH(request: NextRequest, { params }: RouteParams) {
     try {
+        const limited = await rateLimit(request, 'mutate');
+        if (limited) return limited;
+
         const session = await auth();
         const { workspaceId } = await params;
 
@@ -122,6 +127,9 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
 // DELETE /api/workspaces/[workspaceId] - Delete a workspace
 export async function DELETE(request: NextRequest, { params }: RouteParams) {
     try {
+        const limited = await rateLimit(request, 'mutate');
+        if (limited) return limited;
+
         const session = await auth();
         const { workspaceId } = await params;
 
@@ -142,6 +150,9 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
             );
         }
 
+        // Clean up voice files from R2 before cascade delete removes comment rows
+        await cleanupWorkspaceVoiceFiles(workspaceId);
+
         await db.workspace.delete({ where: { id: workspaceId } });
 
         return NextResponse.json({ success: true, message: 'Workspace deleted' });