refactor(auth): centralize project/workspace authorization with checkProjectAccess across API routes

app/api/comments/[commentId]/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { r2Client, R2_BUCKET_NAME } from '@/lib/r2';
 import { DeleteObjectCommand } from '@aws-sdk/client-s3';
 import { rateLimit } from '@/lib/rate-limit';
@@ -8,7 +8,6 @@ import { validateShareLinkAccess } from '@/lib/share-links';
 import { getShareSessionFromRequest } from '@/lib/share-session';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 import { getGuestIdentityFromRequest } from '@/lib/guest-identity';
-import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
 
 type RouteParams = { params: Promise<{ commentId: string }> };
 
@@ -66,11 +65,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
                     include: {
                         video: {
                             include: {
-                                project: {
+                                project: true,
-                                    include: {
-                                        members: { where: { userId: session?.user?.id || '' } },
-                                    },
-                                },
                             },
                         },
                     },
@@ -84,29 +79,9 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
 
         // Authorization check: verify user has access to the project
         const project = comment.version.video.project;
-        const isOwner = session?.user?.id === project.ownerId;
+        const access = await checkProjectAccess(project, session?.user?.id);
-        const isMember = project.members.length > 0;
-        const isPublic = project.visibility === 'PUBLIC';
 
-        // Check workspace membership for access
+        if (!access.hasAccess) {
-        let isWorkspaceMember = false;
-        if (!isOwner && !isMember && !isPublic && session?.user?.id) {
-            const wsMember = await db.workspaceMember.findUnique({
-                where: {
-                    workspaceId_userId: {
-                        workspaceId: project.workspaceId,
-                        userId: session.user.id,
-                    },
-                },
-            });
-            const wsOwner = await db.workspace.findUnique({
-                where: { id: project.workspaceId },
-                select: { ownerId: true },
-            });
-            isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
-        }
-
-        if (!isOwner && !isMember && !isPublic && !isWorkspaceMember) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -139,9 +114,7 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
                     include: {
                         video: {
                             include: {
-                                project: {
+                                project: true,
-                                    include: { members: true },
-                                },
                             },
                         },
                     },
@@ -155,42 +128,16 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
 
         const project = comment.version.video.project;
         const userId = session?.user?.id ?? null;
+        const access = await checkProjectAccess(project, userId ?? undefined, { intent: 'manage' });
         const isOwner = userId === project.ownerId;
         const isAuthor = !!userId && comment.authorId === userId;
-        const projectMembership = userId
-            ? project.members.find((member) => member.userId === userId) ?? null
-            : null;
-        const isProjectAdmin = projectMembership?.role === ProjectMemberRole.ADMIN;
         const guestIdentityId = !userId ? getGuestIdentityFromRequest(request) : null;
         const isGuestAuthor = !userId
             && !comment.authorId
             && !!comment.guestIdentityId
             && guestIdentityId === comment.guestIdentityId;
         const canEditOwnContent = isAuthor || isGuestAuthor;
-
+        const canResolveComment = access.canEdit;
-        // Check workspace role for resolve permissions.
-        let workspaceRole: WorkspaceMemberRole | 'OWNER' | null = null;
-        if (!isOwner && userId) {
-            const wsMember = await db.workspaceMember.findUnique({
-                where: {
-                    workspaceId_userId: {
-                        workspaceId: project.workspaceId,
-                        userId,
-                    },
-                },
-            });
-            const wsOwner = await db.workspace.findUnique({
-                where: { id: project.workspaceId },
-                select: { ownerId: true },
-            });
-            if (wsOwner?.ownerId === userId) {
-                workspaceRole = 'OWNER';
-            } else if (wsMember) {
-                workspaceRole = wsMember.role;
-            }
-        }
-        const isWorkspaceAdmin = workspaceRole === 'OWNER' || workspaceRole === WorkspaceMemberRole.ADMIN;
-        const canResolveComment = isOwner || isProjectAdmin || isWorkspaceAdmin;
 
         if (!userId && !isGuestAuthor) {
             const shareSession = getShareSessionFromRequest(request, comment.version.video.id);

app/api/projects/[projectId]/route.ts

@@ -1,52 +1,12 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
-import { ProjectMemberRole, ProjectVisibility } from '@prisma/client';
 import { rateLimit } from '@/lib/rate-limit';
 import { cleanupProjectMediaFiles } from '@/lib/r2-cleanup';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 
 type RouteParams = { params: Promise<{ projectId: string }> };
 
-// Helper to check project access
-async function checkProjectAccess(projectId: string, userId: string) {
-    const project = await db.project.findUnique({
-        where: { id: projectId },
-        include: {
-            members: { where: { userId } },
-        },
-    });
-
-    if (!project) return { project: null, role: null, canEdit: false, canDelete: false };
-
-    const isOwner = project.ownerId === userId;
-    const membership = project.members[0];
-    let role: string | null = isOwner ? 'OWNER' : membership?.role || null;
-
-    // Check workspace-level access if not already authorized
-    if (!isOwner && !membership) {
-        const wsMember = await db.workspaceMember.findUnique({
-            where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
-        });
-        const wsOwner = await db.workspace.findUnique({
-            where: { id: project.workspaceId },
-            select: { ownerId: true },
-        });
-        if (wsOwner?.ownerId === userId) {
-            role = 'OWNER';
-        } else if (wsMember) {
-            role = wsMember.role; // ADMIN or COMMENTATOR from workspace
-        }
-    }
-
-    return {
-        project,
-        role,
-        canEdit: isOwner || role === 'OWNER' || role === ProjectMemberRole.ADMIN,
-        canDelete: isOwner || role === 'OWNER',
-    };
-}
-
 // GET /api/projects/[projectId] - Get a single project
 export async function GET(request: NextRequest, { params }: RouteParams) {
     try {
@@ -95,30 +55,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Project');
         }
 
-        // Check access
+        const access = await checkProjectAccess(project, session?.user?.id);
-        const isPublic = project.visibility === ProjectVisibility.PUBLIC;
+        if (!access.hasAccess) {
-        const isOwner = session?.user?.id === project.ownerId;
-        const isMember = project.members.some((m: { userId: string }) => m.userId === session?.user?.id);
-
-        // Check workspace membership
-        let isWorkspaceMember = false;
-        if (!isPublic && !isOwner && !isMember && session?.user?.id) {
-            const wsMember = await db.workspaceMember.findUnique({
-                where: {
-                    workspaceId_userId: {
-                        workspaceId: project.workspaceId,
-                        userId: session.user.id,
-                    },
-                },
-            });
-            const wsOwner = await db.workspace.findUnique({
-                where: { id: project.workspaceId },
-                select: { ownerId: true },
-            });
-            isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
-        }
-
-        if (!isPublic && !isOwner && !isMember && !isWorkspaceMember) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -143,8 +81,14 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
             return apiErrors.unauthorized();
         }
 
-        const { canEdit } = await checkProjectAccess(projectId, session.user.id);
+        const projectAccessTarget = await db.project.findUnique({
-        if (!canEdit) {
+            where: { id: projectId },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+        });
+        const access = projectAccessTarget
+            ? await checkProjectAccess(projectAccessTarget, session.user.id, { intent: 'manage' })
+            : null;
+        if (!access?.canEdit) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -186,13 +130,16 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
             return apiErrors.unauthorized();
         }
 
-        const { canDelete, project } = await checkProjectAccess(projectId, session.user.id);
+        const project = await db.project.findUnique({
-
+            where: { id: projectId },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+        });
         if (!project) {
             return apiErrors.notFound('Project');
         }
 
-        if (!canDelete) {
+        const access = await checkProjectAccess(project, session.user.id, { intent: 'delete' });
+        if (!access.canDelete) {
             return apiErrors.forbidden('Only the project owner can delete it');
         }
 

app/api/projects/[projectId]/tags/[tagId]/route.ts

@@ -1,42 +1,11 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { rateLimit } from '@/lib/rate-limit';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 
 type RouteParams = { params: Promise<{ projectId: string; tagId: string }> };
 
-// Helper to check project access
-async function checkProjectAccess(projectId: string, userId: string) {
-    const project = await db.project.findUnique({
-        where: { id: projectId },
-        include: { members: { where: { userId } } },
-    });
-
-    if (!project) return { project: null, canEdit: false };
-
-    const isOwner = project.ownerId === userId;
-    const isAdmin = project.members[0]?.role === 'ADMIN';
-
-    // Check workspace-level access
-    let workspaceCanEdit = false;
-    if (!isOwner && !isAdmin) {
-        const wsMember = await db.workspaceMember.findUnique({
-            where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
-        });
-        const wsOwner = await db.workspace.findUnique({
-            where: { id: project.workspaceId },
-            select: { ownerId: true },
-        });
-        workspaceCanEdit = wsOwner?.ownerId === userId || wsMember?.role === 'ADMIN';
-    }
-
-    return {
-        project,
-        canEdit: isOwner || isAdmin || workspaceCanEdit,
-    };
-}
-
 // PATCH /api/projects/[projectId]/tags/[tagId] - Update a tag
 export async function PATCH(request: NextRequest, { params }: RouteParams) {
     try {
@@ -50,11 +19,16 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
             return apiErrors.unauthorized();
         }
 
-        const { canEdit, project } = await checkProjectAccess(projectId, session.user.id);
+        const project = await db.project.findUnique({
+            where: { id: projectId },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+        });
         if (!project) {
             return apiErrors.notFound('Project');
         }
-        if (!canEdit) {
+
+        const access = await checkProjectAccess(project, session.user.id, { intent: 'manage' });
+        if (!access.canEdit) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -115,11 +89,16 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
             return apiErrors.unauthorized();
         }
 
-        const { canEdit, project } = await checkProjectAccess(projectId, session.user.id);
+        const project = await db.project.findUnique({
+            where: { id: projectId },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+        });
         if (!project) {
             return apiErrors.notFound('Project');
         }
-        if (!canEdit) {
+
+        const access = await checkProjectAccess(project, session.user.id, { intent: 'manage' });
+        if (!access.canEdit) {
             return apiErrors.forbidden('Access denied');
         }
 

app/api/projects/[projectId]/tags/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { rateLimit } from '@/lib/rate-limit';
 import { validateShareLinkAccess } from '@/lib/share-links';
 import { getShareSessionFromRequest } from '@/lib/share-session';
@@ -8,37 +8,6 @@ import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response
 
 type RouteParams = { params: Promise<{ projectId: string }> };
 
-// Helper to check project access
-async function checkProjectAccess(projectId: string, userId: string) {
-    const project = await db.project.findUnique({
-        where: { id: projectId },
-        include: { members: { where: { userId } } },
-    });
-
-    if (!project) return { project: null, canEdit: false };
-
-    const isOwner = project.ownerId === userId;
-    const isAdmin = project.members[0]?.role === 'ADMIN';
-
-    // Check workspace-level access
-    let workspaceCanEdit = false;
-    if (!isOwner && !isAdmin) {
-        const wsMember = await db.workspaceMember.findUnique({
-            where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
-        });
-        const wsOwner = await db.workspace.findUnique({
-            where: { id: project.workspaceId },
-            select: { ownerId: true },
-        });
-        workspaceCanEdit = wsOwner?.ownerId === userId || wsMember?.role === 'ADMIN';
-    }
-
-    return {
-        project,
-        canEdit: isOwner || isAdmin || workspaceCanEdit,
-    };
-}
-
 // GET /api/projects/[projectId]/tags - Get all tags for a project
 export async function GET(request: NextRequest, { params }: RouteParams) {
     try {
@@ -48,13 +17,13 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
 
         const project = await db.project.findUnique({
             where: { id: projectId },
-            select: { id: true, visibility: true },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
         });
         if (!project) return apiErrors.notFound('Project');
 
         if (session?.user?.id) {
-            const { project: accessibleProject } = await checkProjectAccess(projectId, session.user.id);
+            const access = await checkProjectAccess(project, session.user.id);
-            if (!accessibleProject) {
+            if (!access.hasAccess) {
                 return apiErrors.notFound('Project');
             }
         } else {
@@ -113,11 +82,16 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             return apiErrors.unauthorized();
         }
 
-        const { canEdit, project } = await checkProjectAccess(projectId, session.user.id);
+        const project = await db.project.findUnique({
+            where: { id: projectId },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+        });
         if (!project) {
             return apiErrors.notFound('Project');
         }
-        if (!canEdit) {
+
+        const access = await checkProjectAccess(project, session.user.id, { intent: 'manage' });
+        if (!access.canEdit) {
             return apiErrors.forbidden('Access denied');
         }
 

app/api/projects/[projectId]/videos/[videoId]/route.ts

@@ -2,7 +2,6 @@ import { NextRequest } from 'next/server';
 import { revalidatePath } from 'next/cache';
 import { db } from '@/lib/db';
 import { auth, checkProjectAccess } from '@/lib/auth';
-import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
 import { rateLimit } from '@/lib/rate-limit';
 import { cleanupVideoMediaFiles } from '@/lib/r2-cleanup';
 import { cleanupBunnyStreamVideos } from '@/lib/bunny-stream-cleanup';
@@ -151,16 +150,7 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
         const video = await db.video.findFirst({
             where: { id: videoId, projectId },
             include: {
-                project: {
+                project: true,
-                    include: {
-                        members: { where: { userId: session.user.id } },
-                        workspace: {
-                            include: {
-                                members: { where: { userId: session.user.id } },
-                            },
-                        },
-                    },
-                },
             },
         });
 
@@ -168,14 +158,8 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Video');
         }
 
-        const isOwner = video.project.ownerId === session.user.id;
+        const access = await checkProjectAccess(video.project, session.user.id, { intent: 'manage' });
-        const membership = video.project.members[0];
+        if (!access.canEdit) {
-        const workspaceMembership = video.project.workspace.members[0];
-        const canEdit = isOwner ||
-            membership?.role === ProjectMemberRole.ADMIN ||
-            workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
-
-        if (!canEdit) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -227,16 +211,7 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
                         videoId: true,
                     },
                 },
-                project: {
+                project: true,
-                    include: {
-                        members: { where: { userId: session.user.id } },
-                        workspace: {
-                            include: {
-                                members: { where: { userId: session.user.id } },
-                            },
-                        },
-                    },
-                },
             },
         });
 
@@ -244,15 +219,8 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Video');
         }
 
-        const isOwner = video.project.ownerId === session.user.id;
+        const access = await checkProjectAccess(video.project, session.user.id, { intent: 'manage' });
-        const membership = video.project.members[0];
+        if (!access.canEdit) {
-        const workspaceMembership = video.project.workspace.members[0];
-        // Destructive actions limited to OWNER and ADMIN only
-        const canDelete = isOwner ||
-            membership?.role === ProjectMemberRole.ADMIN ||
-            workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
-
-        if (!canDelete) {
             return apiErrors.forbidden('Only project owner or admin can delete videos');
         }
 

app/api/projects/[projectId]/videos/[videoId]/versions/[versionId]/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
-import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
 import { rateLimit } from '@/lib/rate-limit';
 import { cleanupBunnyStreamVideos } from '@/lib/bunny-stream-cleanup';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
@@ -14,16 +13,7 @@ async function getVersionWithAccess(projectId: string, videoId: string, versionI
         include: {
             video: {
                 include: {
-                    project: {
+                    project: true,
-                        include: {
-                            members: { where: { userId } },
-                            workspace: {
-                                include: {
-                                    members: { where: { userId } },
-                                },
-                            },
-                        },
-                    },
                 },
             },
         },
@@ -34,14 +24,9 @@ async function getVersionWithAccess(projectId: string, videoId: string, versionI
     }
 
     const project = version.video.project;
-    const isOwner = project.ownerId === userId;
+    const access = await checkProjectAccess(project, userId, { intent: 'manage' });
-    const membership = project.members[0];
-    const workspaceMembership = project.workspace.members[0];
-    const canEdit = isOwner ||
-        membership?.role === ProjectMemberRole.ADMIN ||
-        workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
 
-    return { version, canEdit, isOwner };
+    return { version, canEdit: access.canEdit, isOwner: access.isOwner };
 }
 
 // PATCH /api/projects/[projectId]/videos/[videoId]/versions/[versionId]

app/api/projects/[projectId]/videos/[videoId]/versions/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
-import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
 import { validateUrl, validateOptionalUrl } from '@/lib/validation';
 import { rateLimit } from '@/lib/rate-limit';
 import { notifyProjectOwner } from '@/lib/notifications';
@@ -19,9 +18,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
         const video = await db.video.findFirst({
             where: { id: videoId, projectId },
             include: {
-                project: {
+                project: true,
-                    include: { members: { where: { userId: session?.user?.id || '' } } },
-                },
             },
         });
 
@@ -29,11 +26,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Video');
         }
 
-        const isOwner = session?.user?.id === video.project.ownerId;
+        const access = await checkProjectAccess(video.project, session?.user?.id);
-        const isMember = video.project.members.length > 0;
+        if (!access.hasAccess) {
-        const isPublic = video.project.visibility === 'PUBLIC';
-
-        if (!isOwner && !isMember && !isPublic) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -69,16 +63,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
         const video = await db.video.findFirst({
             where: { id: videoId, projectId },
             include: {
-                project: {
+                project: true,
-                    include: {
-                        members: { where: { userId: session.user.id } },
-                        workspace: {
-                            include: {
-                                members: { where: { userId: session.user.id } },
-                            },
-                        },
-                    },
-                },
                 versions: { orderBy: { versionNumber: 'desc' }, take: 1 },
             },
         });
@@ -87,14 +72,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Video');
         }
 
-        const isOwner = video.project.ownerId === session.user.id;
+        const access = await checkProjectAccess(video.project, session.user.id, { intent: 'manage' });
-        const membership = video.project.members[0];
+        if (!access.canEdit) {
-        const workspaceMembership = video.project.workspace.members[0];
-        const canEdit = isOwner ||
-            membership?.role === ProjectMemberRole.ADMIN ||
-            workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
-
-        if (!canEdit) {
             return apiErrors.forbidden('Access denied');
         }
 

app/api/projects/[projectId]/videos/bunny-init/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
-import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 import { rateLimit } from '@/lib/rate-limit';
 import crypto from 'crypto';
@@ -13,24 +12,13 @@ type RouteParams = { params: Promise<{ projectId: string }> };
 async function getProjectWithEditAccess(projectId: string, userId: string) {
     const project = await db.project.findUnique({
         where: { id: projectId },
-        include: {
+        select: { id: true, name: true, ownerId: true, workspaceId: true, visibility: true },
-            members: { where: { userId } },
-            workspace: {
-                include: {
-                    members: { where: { userId } },
-                },
-            },
-        },
     });
 
     if (!project) return null;
 
-    const isOwner = project.ownerId === userId;
+    const access = await checkProjectAccess(project, userId, { intent: 'manage' });
-    const membership = project.members[0];
+    const canEdit = access.canEdit;
-    const workspaceMembership = project.workspace.members[0];
-    const canEdit = isOwner ||
-        membership?.role === ProjectMemberRole.ADMIN ||
-        workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
 
     if (!canEdit) return null;
 

app/api/projects/[projectId]/videos/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
-import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
 import { validateUrl, validateOptionalUrl } from '@/lib/validation';
 import { rateLimit } from '@/lib/rate-limit';
 import { notifyProjectOwner } from '@/lib/notifications';
@@ -19,18 +18,15 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
         // Check project exists and user has access
         const project = await db.project.findUnique({
             where: { id: projectId },
-            include: { members: { where: { userId: session?.user?.id || '' } } },
+            select: { id: true, ownerId: true, workspaceId: true, visibility: true },
         });
 
         if (!project) {
             return apiErrors.notFound('Project');
         }
 
-        const isOwner = session?.user?.id === project.ownerId;
+        const access = await checkProjectAccess(project, session?.user?.id);
-        const isMember = project.members.length > 0;
+        if (!access.hasAccess) {
-        const isPublic = project.visibility === 'PUBLIC';
-
-        if (!isOwner && !isMember && !isPublic) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -78,28 +74,15 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
         // Check project access (must be owner, project admin, or workspace admin)
         const project = await db.project.findUnique({
             where: { id: projectId },
-            include: {
+            select: { id: true, name: true, ownerId: true, workspaceId: true, visibility: true },
-                members: { where: { userId: session.user.id } },
-                workspace: {
-                    include: {
-                        members: { where: { userId: session.user.id } },
-                    },
-                },
-            },
         });
 
         if (!project) {
             return apiErrors.notFound('Project');
         }
 
-        const isOwner = project.ownerId === session.user.id;
+        const access = await checkProjectAccess(project, session.user.id, { intent: 'manage' });
-        const membership = project.members[0];
+        if (!access.canEdit) {
-        const workspaceMembership = project.workspace.members[0];
-        const canEdit = isOwner ||
-            membership?.role === ProjectMemberRole.ADMIN ||
-            workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
-
-        if (!canEdit) {
             return apiErrors.forbidden('Access denied');
         }
 

app/api/versions/[versionId]/comments/export/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest } from 'next/server';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { db } from '@/lib/db';
 import {
   buildCommentsCsv,
@@ -50,10 +50,6 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
                 ownerId: true,
                 workspaceId: true,
                 visibility: true,
-                members: {
-                  where: { userId: session.user.id },
-                  select: { id: true },
-                },
               },
             },
           },
@@ -66,30 +62,9 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
     }
 
     const project = version.video.project;
-    const isOwner = session.user.id === project.ownerId;
+    const access = await checkProjectAccess(project, session.user.id);
-    const isMember = project.members.length > 0;
 
-    let isWorkspaceMember = false;
+    if (!access.hasAccess) {
-    if (!isOwner && !isMember) {
-      const [workspaceMember, workspace] = await Promise.all([
-        db.workspaceMember.findUnique({
-          where: {
-            workspaceId_userId: {
-              workspaceId: project.workspaceId,
-              userId: session.user.id,
-            },
-          },
-          select: { id: true },
-        }),
-        db.workspace.findUnique({
-          where: { id: project.workspaceId },
-          select: { ownerId: true },
-        }),
-      ]);
-      isWorkspaceMember = !!workspaceMember || workspace?.ownerId === session.user.id;
-    }
-
-    if (!isOwner && !isMember && !isWorkspaceMember) {
       return apiErrors.notFound('Version');
     }
 

app/api/versions/[versionId]/comments/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { rateLimit } from '@/lib/rate-limit';
 import { notifyProjectOwner } from '@/lib/notifications';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
@@ -52,11 +52,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             include: {
                 video: {
                     include: {
-                        project: {
+                        project: true,
-                            include: {
-                                members: { where: { userId: session?.user?.id || '' } },
-                            },
-                        },
                     },
                 },
             },
@@ -67,28 +63,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
         }
 
         const project = version.video.project;
+        const access = await checkProjectAccess(project, session?.user?.id);
         const shareSession = getShareSessionFromRequest(request, version.video.id);
-        const isOwner = session?.user?.id === project.ownerId;
-        const isMember = project.members.length > 0;
-        const isPublic = project.visibility === 'PUBLIC';
-
-        // Check workspace membership for access
-        let isWorkspaceMember = false;
-        if (!isOwner && !isMember && !isPublic && session?.user?.id) {
-            const wsMember = await db.workspaceMember.findUnique({
-                where: {
-                    workspaceId_userId: {
-                        workspaceId: project.workspaceId,
-                        userId: session.user.id,
-                    },
-                },
-            });
-            const wsOwner = await db.workspace.findUnique({
-                where: { id: project.workspaceId },
-                select: { ownerId: true },
-            });
-            isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
-        }
 
         const shareAccess = shareSession
             ? await validateShareLinkAccess({
@@ -100,7 +76,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             })
             : { hasAccess: false, requiresPassword: false };
 
-        if (!isOwner && !isMember && !isPublic && !isWorkspaceMember && !shareAccess.hasAccess) {
+        if (!access.hasAccess && !shareAccess.hasAccess) {
             return apiErrors.forbidden('Access denied');
         }
 
@@ -208,11 +184,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             include: {
                 video: {
                     include: {
-                        project: {
+                        project: true,
-                            include: {
-                                members: { where: { userId: session?.user?.id || '' } },
-                            },
-                        },
                     },
                 },
             },
@@ -223,28 +195,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
         }
 
         const project = version.video.project;
+        const access = await checkProjectAccess(project, session?.user?.id);
         const shareSession = getShareSessionFromRequest(request, version.video.id);
-        const isOwner = session?.user?.id === project.ownerId;
-        const isMember = project.members.length > 0;
-        const isPublic = project.visibility === 'PUBLIC';
-
-        // Check workspace membership for comment access
-        let isWorkspaceMember = false;
-        if (!isOwner && !isMember && !isPublic && session?.user?.id) {
-            const wsMember = await db.workspaceMember.findUnique({
-                where: {
-                    workspaceId_userId: {
-                        workspaceId: project.workspaceId,
-                        userId: session.user.id,
-                    },
-                },
-            });
-            const wsOwner = await db.workspace.findUnique({
-                where: { id: project.workspaceId },
-                select: { ownerId: true },
-            });
-            isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
-        }
 
         const shareAccess = shareSession
             ? await validateShareLinkAccess({
@@ -257,7 +209,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             : { hasAccess: false, canComment: false, canDownload: false, allowGuests: false, requiresPassword: false };
 
         // Check if user can comment
-        const canComment = isOwner || isMember || isPublic || isWorkspaceMember || shareAccess.canComment;
+        const canComment = access.hasAccess || shareAccess.canComment;
         if (!canComment) {
             return apiErrors.forbidden('Access denied');
         }

lib/auth.ts

@@ -87,11 +87,15 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
   },
 });
 
+type ProjectAccessIntent = 'view' | 'manage' | 'delete';
+
 // Helper to check project access including workspace membership
 export async function checkProjectAccess(
   project: { id: string; ownerId: string; workspaceId: string; visibility: string },
-  userId: string | undefined
+  userId: string | undefined,
+  options?: { intent?: ProjectAccessIntent }
 ) {
+  const intent = options?.intent ?? 'view';
   const isOwner = userId === project.ownerId;
   const isPublic = project.visibility === 'PUBLIC';
 
@@ -104,16 +108,23 @@ export async function checkProjectAccess(
   const isProjectMember = !!projectMember;
   const isProjectAdmin = projectMember?.role === ProjectMemberRole.ADMIN;
 
-  // Check workspace membership
+  const needsWorkspaceForAccess = !!userId && !isOwner && !isProjectMember && !isPublic;
-  let workspaceRole: string | null = null;
+  const needsWorkspaceForActions = !!userId && !isOwner && intent !== 'view';
-  if (!isOwner && !isProjectMember && userId) {
+  const shouldLoadWorkspaceRole = needsWorkspaceForAccess || needsWorkspaceForActions;
-    const wsMember = await db.workspaceMember.findUnique({
+
-      where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
+  // Check workspace membership/role
-    });
+  let workspaceRole: WorkspaceMemberRole | 'OWNER' | null = null;
-    const wsOwner = await db.workspace.findUnique({
+  if (shouldLoadWorkspaceRole && userId) {
-      where: { id: project.workspaceId },
+    const [wsMember, wsOwner] = await Promise.all([
-      select: { ownerId: true },
+      db.workspaceMember.findUnique({
-    });
+        where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
+      }),
+      db.workspace.findUnique({
+        where: { id: project.workspaceId },
+        select: { ownerId: true },
+      }),
+    ]);
+
     if (wsOwner?.ownerId === userId) {
       workspaceRole = 'OWNER';
     } else if (wsMember) {