yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(auth): centralize project/workspace authorization with checkProjectAccess across API routes

Browse Source
This commit is contained in:
Yusuf İpek
2026-02-24 17:18:04 +03:00
parent fa51847aa4
commit 354bc38d42
12 changed files with 110 additions and 422 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/projects/[projectId]/videos/[videoId]/versions/[versionId]/route.ts
+4 -19
View File
@@ -1,7 +1,6 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
import { auth, checkProjectAccess } from '@/lib/auth';
import { rateLimit } from '@/lib/rate-limit';
import { cleanupBunnyStreamVideos } from '@/lib/bunny-stream-cleanup';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
@@ -14,16 +13,7 @@ async function getVersionWithAccess(projectId: string, videoId: string, versionI
include: {
video: {
include: {
project: {
include: {
members: { where: { userId } },
workspace: {
include: {
members: { where: { userId } },
},
},
},
},
project: true,
},
},
},
@@ -34,14 +24,9 @@ async function getVersionWithAccess(projectId: string, videoId: string, versionI
}
const project = version.video.project;
const isOwner = project.ownerId === userId;
const membership = project.members[0];
const workspaceMembership = project.workspace.members[0];
const canEdit = isOwner ||
membership?.role === ProjectMemberRole.ADMIN ||
workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
const access = await checkProjectAccess(project, userId, { intent: 'manage' });
return { version, canEdit, isOwner };
return { version, canEdit: access.canEdit, isOwner: access.isOwner };
}
// PATCH /api/projects/[projectId]/videos/[videoId]/versions/[versionId]
app/api/projects/[projectId]/videos/[videoId]/versions/route.ts
+7 -28
View File
@@ -1,7 +1,6 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
import { auth, checkProjectAccess } from '@/lib/auth';
import { validateUrl, validateOptionalUrl } from '@/lib/validation';
import { rateLimit } from '@/lib/rate-limit';
import { notifyProjectOwner } from '@/lib/notifications';
@@ -19,9 +18,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
const video = await db.video.findFirst({
where: { id: videoId, projectId },
include: {
project: {
include: { members: { where: { userId: session?.user?.id || '' } } },
},
project: true,
},
});
@@ -29,11 +26,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
return apiErrors.notFound('Video');
}
const isOwner = session?.user?.id === video.project.ownerId;
const isMember = video.project.members.length > 0;
const isPublic = video.project.visibility === 'PUBLIC';
if (!isOwner && !isMember && !isPublic) {
const access = await checkProjectAccess(video.project, session?.user?.id);
if (!access.hasAccess) {
return apiErrors.forbidden('Access denied');
}
@@ -69,16 +63,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
const video = await db.video.findFirst({
where: { id: videoId, projectId },
include: {
project: {
include: {
members: { where: { userId: session.user.id } },
workspace: {
include: {
members: { where: { userId: session.user.id } },
},
},
},
},
project: true,
versions: { orderBy: { versionNumber: 'desc' }, take: 1 },
},
});
@@ -87,14 +72,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
return apiErrors.notFound('Video');
}
const isOwner = video.project.ownerId === session.user.id;
const membership = video.project.members[0];
const workspaceMembership = video.project.workspace.members[0];
const canEdit = isOwner ||
membership?.role === ProjectMemberRole.ADMIN ||
workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
if (!canEdit) {
const access = await checkProjectAccess(video.project, session.user.id, { intent: 'manage' });
if (!access.canEdit) {
return apiErrors.forbidden('Access denied');
}