refactor(auth): centralize project/workspace authorization with checkProjectAccess across API routes

app/api/projects/[projectId]/route.ts

@@ -1,52 +1,12 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
-import { ProjectMemberRole, ProjectVisibility } from '@prisma/client';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { rateLimit } from '@/lib/rate-limit';
 import { cleanupProjectMediaFiles } from '@/lib/r2-cleanup';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 
 type RouteParams = { params: Promise<{ projectId: string }> };
 
-// Helper to check project access
-async function checkProjectAccess(projectId: string, userId: string) {
-    const project = await db.project.findUnique({
-        where: { id: projectId },
-        include: {
-            members: { where: { userId } },
-        },
-    });
-
-    if (!project) return { project: null, role: null, canEdit: false, canDelete: false };
-
-    const isOwner = project.ownerId === userId;
-    const membership = project.members[0];
-    let role: string | null = isOwner ? 'OWNER' : membership?.role || null;
-
-    // Check workspace-level access if not already authorized
-    if (!isOwner && !membership) {
-        const wsMember = await db.workspaceMember.findUnique({
-            where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
-        });
-        const wsOwner = await db.workspace.findUnique({
-            where: { id: project.workspaceId },
-            select: { ownerId: true },
-        });
-        if (wsOwner?.ownerId === userId) {
-            role = 'OWNER';
-        } else if (wsMember) {
-            role = wsMember.role; // ADMIN or COMMENTATOR from workspace
-        }
-    }
-
-    return {
-        project,
-        role,
-        canEdit: isOwner || role === 'OWNER' || role === ProjectMemberRole.ADMIN,
-        canDelete: isOwner || role === 'OWNER',
-    };
-}
-
 // GET /api/projects/[projectId] - Get a single project
 export async function GET(request: NextRequest, { params }: RouteParams) {
     try {
@@ -95,30 +55,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Project');
         }
 
-        // Check access
-        const isPublic = project.visibility === ProjectVisibility.PUBLIC;
-        const isOwner = session?.user?.id === project.ownerId;
-        const isMember = project.members.some((m: { userId: string }) => m.userId === session?.user?.id);
-
-        // Check workspace membership
-        let isWorkspaceMember = false;
-        if (!isPublic && !isOwner && !isMember && session?.user?.id) {
-            const wsMember = await db.workspaceMember.findUnique({
-                where: {
-                    workspaceId_userId: {
-                        workspaceId: project.workspaceId,
-                        userId: session.user.id,
-                    },
-                },
-            });
-            const wsOwner = await db.workspace.findUnique({
-                where: { id: project.workspaceId },
-                select: { ownerId: true },
-            });
-            isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
-        }
-
-        if (!isPublic && !isOwner && !isMember && !isWorkspaceMember) {
+        const access = await checkProjectAccess(project, session?.user?.id);
+        if (!access.hasAccess) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -143,8 +81,14 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
             return apiErrors.unauthorized();
         }
 
-        const { canEdit } = await checkProjectAccess(projectId, session.user.id);
-        if (!canEdit) {
+        const projectAccessTarget = await db.project.findUnique({
+            where: { id: projectId },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+        });
+        const access = projectAccessTarget
+            ? await checkProjectAccess(projectAccessTarget, session.user.id, { intent: 'manage' })
+            : null;
+        if (!access?.canEdit) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -186,13 +130,16 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
             return apiErrors.unauthorized();
         }
 
-        const { canDelete, project } = await checkProjectAccess(projectId, session.user.id);
-
+        const project = await db.project.findUnique({
+            where: { id: projectId },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+        });
         if (!project) {
             return apiErrors.notFound('Project');
         }
 
-        if (!canDelete) {
+        const access = await checkProjectAccess(project, session.user.id, { intent: 'delete' });
+        if (!access.canDelete) {
             return apiErrors.forbidden('Only the project owner can delete it');
         }
 

app/api/projects/[projectId]/tags/[tagId]/route.ts

@@ -1,42 +1,11 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { rateLimit } from '@/lib/rate-limit';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 
 type RouteParams = { params: Promise<{ projectId: string; tagId: string }> };
 
-// Helper to check project access
-async function checkProjectAccess(projectId: string, userId: string) {
-    const project = await db.project.findUnique({
-        where: { id: projectId },
-        include: { members: { where: { userId } } },
-    });
-
-    if (!project) return { project: null, canEdit: false };
-
-    const isOwner = project.ownerId === userId;
-    const isAdmin = project.members[0]?.role === 'ADMIN';
-
-    // Check workspace-level access
-    let workspaceCanEdit = false;
-    if (!isOwner && !isAdmin) {
-        const wsMember = await db.workspaceMember.findUnique({
-            where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
-        });
-        const wsOwner = await db.workspace.findUnique({
-            where: { id: project.workspaceId },
-            select: { ownerId: true },
-        });
-        workspaceCanEdit = wsOwner?.ownerId === userId || wsMember?.role === 'ADMIN';
-    }
-
-    return {
-        project,
-        canEdit: isOwner || isAdmin || workspaceCanEdit,
-    };
-}
-
 // PATCH /api/projects/[projectId]/tags/[tagId] - Update a tag
 export async function PATCH(request: NextRequest, { params }: RouteParams) {
     try {
@@ -50,11 +19,16 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
             return apiErrors.unauthorized();
         }
 
-        const { canEdit, project } = await checkProjectAccess(projectId, session.user.id);
+        const project = await db.project.findUnique({
+            where: { id: projectId },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+        });
         if (!project) {
             return apiErrors.notFound('Project');
         }
-        if (!canEdit) {
+
+        const access = await checkProjectAccess(project, session.user.id, { intent: 'manage' });
+        if (!access.canEdit) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -115,11 +89,16 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
             return apiErrors.unauthorized();
         }
 
-        const { canEdit, project } = await checkProjectAccess(projectId, session.user.id);
+        const project = await db.project.findUnique({
+            where: { id: projectId },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+        });
         if (!project) {
             return apiErrors.notFound('Project');
         }
-        if (!canEdit) {
+
+        const access = await checkProjectAccess(project, session.user.id, { intent: 'manage' });
+        if (!access.canEdit) {
             return apiErrors.forbidden('Access denied');
         }
 

app/api/projects/[projectId]/tags/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { rateLimit } from '@/lib/rate-limit';
 import { validateShareLinkAccess } from '@/lib/share-links';
 import { getShareSessionFromRequest } from '@/lib/share-session';
@@ -8,37 +8,6 @@ import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response
 
 type RouteParams = { params: Promise<{ projectId: string }> };
 
-// Helper to check project access
-async function checkProjectAccess(projectId: string, userId: string) {
-    const project = await db.project.findUnique({
-        where: { id: projectId },
-        include: { members: { where: { userId } } },
-    });
-
-    if (!project) return { project: null, canEdit: false };
-
-    const isOwner = project.ownerId === userId;
-    const isAdmin = project.members[0]?.role === 'ADMIN';
-
-    // Check workspace-level access
-    let workspaceCanEdit = false;
-    if (!isOwner && !isAdmin) {
-        const wsMember = await db.workspaceMember.findUnique({
-            where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
-        });
-        const wsOwner = await db.workspace.findUnique({
-            where: { id: project.workspaceId },
-            select: { ownerId: true },
-        });
-        workspaceCanEdit = wsOwner?.ownerId === userId || wsMember?.role === 'ADMIN';
-    }
-
-    return {
-        project,
-        canEdit: isOwner || isAdmin || workspaceCanEdit,
-    };
-}
-
 // GET /api/projects/[projectId]/tags - Get all tags for a project
 export async function GET(request: NextRequest, { params }: RouteParams) {
     try {
@@ -48,13 +17,13 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
 
         const project = await db.project.findUnique({
             where: { id: projectId },
-            select: { id: true, visibility: true },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
         });
         if (!project) return apiErrors.notFound('Project');
 
         if (session?.user?.id) {
-            const { project: accessibleProject } = await checkProjectAccess(projectId, session.user.id);
-            if (!accessibleProject) {
+            const access = await checkProjectAccess(project, session.user.id);
+            if (!access.hasAccess) {
                 return apiErrors.notFound('Project');
             }
         } else {
@@ -113,11 +82,16 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             return apiErrors.unauthorized();
         }
 
-        const { canEdit, project } = await checkProjectAccess(projectId, session.user.id);
+        const project = await db.project.findUnique({
+            where: { id: projectId },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+        });
         if (!project) {
             return apiErrors.notFound('Project');
         }
-        if (!canEdit) {
+
+        const access = await checkProjectAccess(project, session.user.id, { intent: 'manage' });
+        if (!access.canEdit) {
             return apiErrors.forbidden('Access denied');
         }
 

app/api/projects/[projectId]/videos/[videoId]/route.ts

@@ -2,7 +2,6 @@ import { NextRequest } from 'next/server';
 import { revalidatePath } from 'next/cache';
 import { db } from '@/lib/db';
 import { auth, checkProjectAccess } from '@/lib/auth';
-import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
 import { rateLimit } from '@/lib/rate-limit';
 import { cleanupVideoMediaFiles } from '@/lib/r2-cleanup';
 import { cleanupBunnyStreamVideos } from '@/lib/bunny-stream-cleanup';
@@ -151,16 +150,7 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
         const video = await db.video.findFirst({
             where: { id: videoId, projectId },
             include: {
-                project: {
-                    include: {
-                        members: { where: { userId: session.user.id } },
-                        workspace: {
-                            include: {
-                                members: { where: { userId: session.user.id } },
-                            },
-                        },
-                    },
-                },
+                project: true,
             },
         });
 
@@ -168,14 +158,8 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Video');
         }
 
-        const isOwner = video.project.ownerId === session.user.id;
-        const membership = video.project.members[0];
-        const workspaceMembership = video.project.workspace.members[0];
-        const canEdit = isOwner ||
-            membership?.role === ProjectMemberRole.ADMIN ||
-            workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
-
-        if (!canEdit) {
+        const access = await checkProjectAccess(video.project, session.user.id, { intent: 'manage' });
+        if (!access.canEdit) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -227,16 +211,7 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
                         videoId: true,
                     },
                 },
-                project: {
-                    include: {
-                        members: { where: { userId: session.user.id } },
-                        workspace: {
-                            include: {
-                                members: { where: { userId: session.user.id } },
-                            },
-                        },
-                    },
-                },
+                project: true,
             },
         });
 
@@ -244,15 +219,8 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Video');
         }
 
-        const isOwner = video.project.ownerId === session.user.id;
-        const membership = video.project.members[0];
-        const workspaceMembership = video.project.workspace.members[0];
-        // Destructive actions limited to OWNER and ADMIN only
-        const canDelete = isOwner ||
-            membership?.role === ProjectMemberRole.ADMIN ||
-            workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
-
-        if (!canDelete) {
+        const access = await checkProjectAccess(video.project, session.user.id, { intent: 'manage' });
+        if (!access.canEdit) {
             return apiErrors.forbidden('Only project owner or admin can delete videos');
         }
 

app/api/projects/[projectId]/videos/[videoId]/versions/[versionId]/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
-import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { rateLimit } from '@/lib/rate-limit';
 import { cleanupBunnyStreamVideos } from '@/lib/bunny-stream-cleanup';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
@@ -14,16 +13,7 @@ async function getVersionWithAccess(projectId: string, videoId: string, versionI
         include: {
             video: {
                 include: {
-                    project: {
-                        include: {
-                            members: { where: { userId } },
-                            workspace: {
-                                include: {
-                                    members: { where: { userId } },
-                                },
-                            },
-                        },
-                    },
+                    project: true,
                 },
             },
         },
@@ -34,14 +24,9 @@ async function getVersionWithAccess(projectId: string, videoId: string, versionI
     }
 
     const project = version.video.project;
-    const isOwner = project.ownerId === userId;
-    const membership = project.members[0];
-    const workspaceMembership = project.workspace.members[0];
-    const canEdit = isOwner ||
-        membership?.role === ProjectMemberRole.ADMIN ||
-        workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
+    const access = await checkProjectAccess(project, userId, { intent: 'manage' });
 
-    return { version, canEdit, isOwner };
+    return { version, canEdit: access.canEdit, isOwner: access.isOwner };
 }
 
 // PATCH /api/projects/[projectId]/videos/[videoId]/versions/[versionId]

app/api/projects/[projectId]/videos/[videoId]/versions/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
-import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { validateUrl, validateOptionalUrl } from '@/lib/validation';
 import { rateLimit } from '@/lib/rate-limit';
 import { notifyProjectOwner } from '@/lib/notifications';
@@ -19,9 +18,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
         const video = await db.video.findFirst({
             where: { id: videoId, projectId },
             include: {
-                project: {
-                    include: { members: { where: { userId: session?.user?.id || '' } } },
-                },
+                project: true,
             },
         });
 
@@ -29,11 +26,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Video');
         }
 
-        const isOwner = session?.user?.id === video.project.ownerId;
-        const isMember = video.project.members.length > 0;
-        const isPublic = video.project.visibility === 'PUBLIC';
-
-        if (!isOwner && !isMember && !isPublic) {
+        const access = await checkProjectAccess(video.project, session?.user?.id);
+        if (!access.hasAccess) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -69,16 +63,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
         const video = await db.video.findFirst({
             where: { id: videoId, projectId },
             include: {
-                project: {
-                    include: {
-                        members: { where: { userId: session.user.id } },
-                        workspace: {
-                            include: {
-                                members: { where: { userId: session.user.id } },
-                            },
-                        },
-                    },
-                },
+                project: true,
                 versions: { orderBy: { versionNumber: 'desc' }, take: 1 },
             },
         });
@@ -87,14 +72,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Video');
         }
 
-        const isOwner = video.project.ownerId === session.user.id;
-        const membership = video.project.members[0];
-        const workspaceMembership = video.project.workspace.members[0];
-        const canEdit = isOwner ||
-            membership?.role === ProjectMemberRole.ADMIN ||
-            workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
-
-        if (!canEdit) {
+        const access = await checkProjectAccess(video.project, session.user.id, { intent: 'manage' });
+        if (!access.canEdit) {
             return apiErrors.forbidden('Access denied');
         }
 

app/api/projects/[projectId]/videos/bunny-init/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
-import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 import { rateLimit } from '@/lib/rate-limit';
 import crypto from 'crypto';
@@ -13,24 +12,13 @@ type RouteParams = { params: Promise<{ projectId: string }> };
 async function getProjectWithEditAccess(projectId: string, userId: string) {
     const project = await db.project.findUnique({
         where: { id: projectId },
-        include: {
-            members: { where: { userId } },
-            workspace: {
-                include: {
-                    members: { where: { userId } },
-                },
-            },
-        },
+        select: { id: true, name: true, ownerId: true, workspaceId: true, visibility: true },
     });
 
     if (!project) return null;
 
-    const isOwner = project.ownerId === userId;
-    const membership = project.members[0];
-    const workspaceMembership = project.workspace.members[0];
-    const canEdit = isOwner ||
-        membership?.role === ProjectMemberRole.ADMIN ||
-        workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
+    const access = await checkProjectAccess(project, userId, { intent: 'manage' });
+    const canEdit = access.canEdit;
 
     if (!canEdit) return null;
 

app/api/projects/[projectId]/videos/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
-import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { validateUrl, validateOptionalUrl } from '@/lib/validation';
 import { rateLimit } from '@/lib/rate-limit';
 import { notifyProjectOwner } from '@/lib/notifications';
@@ -19,18 +18,15 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
         // Check project exists and user has access
         const project = await db.project.findUnique({
             where: { id: projectId },
-            include: { members: { where: { userId: session?.user?.id || '' } } },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
         });
 
         if (!project) {
             return apiErrors.notFound('Project');
         }
 
-        const isOwner = session?.user?.id === project.ownerId;
-        const isMember = project.members.length > 0;
-        const isPublic = project.visibility === 'PUBLIC';
-
-        if (!isOwner && !isMember && !isPublic) {
+        const access = await checkProjectAccess(project, session?.user?.id);
+        if (!access.hasAccess) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -78,28 +74,15 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
         // Check project access (must be owner, project admin, or workspace admin)
         const project = await db.project.findUnique({
             where: { id: projectId },
-            include: {
-                members: { where: { userId: session.user.id } },
-                workspace: {
-                    include: {
-                        members: { where: { userId: session.user.id } },
-                    },
-                },
-            },
+            select: { id: true, name: true, ownerId: true, workspaceId: true, visibility: true },
         });
 
         if (!project) {
             return apiErrors.notFound('Project');
         }
 
-        const isOwner = project.ownerId === session.user.id;
-        const membership = project.members[0];
-        const workspaceMembership = project.workspace.members[0];
-        const canEdit = isOwner ||
-            membership?.role === ProjectMemberRole.ADMIN ||
-            workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
-
-        if (!canEdit) {
+        const access = await checkProjectAccess(project, session.user.id, { intent: 'manage' });
+        if (!access.canEdit) {
             return apiErrors.forbidden('Access denied');
         }