yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(auth): centralize project/workspace authorization with checkProjectAccess across API routes

Browse Source
This commit is contained in:
Yusuf İpek
2026-02-24 17:18:04 +03:00
parent fa51847aa4
commit 354bc38d42
12 changed files with 110 additions and 422 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/comments/[commentId]/route.ts
+7 -60
View File
@@ -1,6 +1,6 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { auth, checkProjectAccess } from '@/lib/auth';
import { r2Client, R2_BUCKET_NAME } from '@/lib/r2';
import { DeleteObjectCommand } from '@aws-sdk/client-s3';
import { rateLimit } from '@/lib/rate-limit';
@@ -8,7 +8,6 @@ import { validateShareLinkAccess } from '@/lib/share-links';
import { getShareSessionFromRequest } from '@/lib/share-session';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
import { getGuestIdentityFromRequest } from '@/lib/guest-identity';
import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
type RouteParams = { params: Promise<{ commentId: string }> };
@@ -66,11 +65,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
include: {
video: {
include: {
project: {
include: {
members: { where: { userId: session?.user?.id || '' } },
},
},
project: true,
},
},
},
@@ -84,29 +79,9 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
// Authorization check: verify user has access to the project
const project = comment.version.video.project;
const isOwner = session?.user?.id === project.ownerId;
const isMember = project.members.length > 0;
const isPublic = project.visibility === 'PUBLIC';
const access = await checkProjectAccess(project, session?.user?.id);
// Check workspace membership for access
let isWorkspaceMember = false;
if (!isOwner && !isMember && !isPublic && session?.user?.id) {
const wsMember = await db.workspaceMember.findUnique({
where: {
workspaceId_userId: {
workspaceId: project.workspaceId,
userId: session.user.id,
},
},
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
}
if (!isOwner && !isMember && !isPublic && !isWorkspaceMember) {
if (!access.hasAccess) {
return apiErrors.forbidden('Access denied');
}
@@ -139,9 +114,7 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
include: {
video: {
include: {
project: {
include: { members: true },
},
project: true,
},
},
},
@@ -155,42 +128,16 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
const project = comment.version.video.project;
const userId = session?.user?.id ?? null;
const access = await checkProjectAccess(project, userId ?? undefined, { intent: 'manage' });
const isOwner = userId === project.ownerId;
const isAuthor = !!userId && comment.authorId === userId;
const projectMembership = userId
? project.members.find((member) => member.userId === userId) ?? null
: null;
const isProjectAdmin = projectMembership?.role === ProjectMemberRole.ADMIN;
const guestIdentityId = !userId ? getGuestIdentityFromRequest(request) : null;
const isGuestAuthor = !userId
&& !comment.authorId
&& !!comment.guestIdentityId
&& guestIdentityId === comment.guestIdentityId;
const canEditOwnContent = isAuthor || isGuestAuthor;
// Check workspace role for resolve permissions.
let workspaceRole: WorkspaceMemberRole | 'OWNER' | null = null;
if (!isOwner && userId) {
const wsMember = await db.workspaceMember.findUnique({
where: {
workspaceId_userId: {
workspaceId: project.workspaceId,
userId,
},
},
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
if (wsOwner?.ownerId === userId) {
workspaceRole = 'OWNER';
} else if (wsMember) {
workspaceRole = wsMember.role;
}
}
const isWorkspaceAdmin = workspaceRole === 'OWNER' || workspaceRole === WorkspaceMemberRole.ADMIN;
const canResolveComment = isOwner || isProjectAdmin || isWorkspaceAdmin;
const canResolveComment = access.canEdit;
if (!userId && !isGuestAuthor) {
const shareSession = getShareSessionFromRequest(request, comment.version.video.id);
app/api/projects/[projectId]/route.ts
+17 -70
View File
@@ -1,52 +1,12 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole, ProjectVisibility } from '@prisma/client';
import { auth, checkProjectAccess } from '@/lib/auth';
import { rateLimit } from '@/lib/rate-limit';
import { cleanupProjectMediaFiles } from '@/lib/r2-cleanup';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ projectId: string }> };
// Helper to check project access
async function checkProjectAccess(projectId: string, userId: string) {
const project = await db.project.findUnique({
where: { id: projectId },
include: {
members: { where: { userId } },
},
});
if (!project) return { project: null, role: null, canEdit: false, canDelete: false };
const isOwner = project.ownerId === userId;
const membership = project.members[0];
let role: string | null = isOwner ? 'OWNER' : membership?.role || null;
// Check workspace-level access if not already authorized
if (!isOwner && !membership) {
const wsMember = await db.workspaceMember.findUnique({
where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
if (wsOwner?.ownerId === userId) {
role = 'OWNER';
} else if (wsMember) {
role = wsMember.role; // ADMIN or COMMENTATOR from workspace
}
}
return {
project,
role,
canEdit: isOwner || role === 'OWNER' || role === ProjectMemberRole.ADMIN,
canDelete: isOwner || role === 'OWNER',
};
}
// GET /api/projects/[projectId] - Get a single project
export async function GET(request: NextRequest, { params }: RouteParams) {
try {
@@ -95,30 +55,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
return apiErrors.notFound('Project');
}
// Check access
const isPublic = project.visibility === ProjectVisibility.PUBLIC;
const isOwner = session?.user?.id === project.ownerId;
const isMember = project.members.some((m: { userId: string }) => m.userId === session?.user?.id);
// Check workspace membership
let isWorkspaceMember = false;
if (!isPublic && !isOwner && !isMember && session?.user?.id) {
const wsMember = await db.workspaceMember.findUnique({
where: {
workspaceId_userId: {
workspaceId: project.workspaceId,
userId: session.user.id,
},
},
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
}
if (!isPublic && !isOwner && !isMember && !isWorkspaceMember) {
const access = await checkProjectAccess(project, session?.user?.id);
if (!access.hasAccess) {
return apiErrors.forbidden('Access denied');
}
@@ -143,8 +81,14 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
return apiErrors.unauthorized();
}
const { canEdit } = await checkProjectAccess(projectId, session.user.id);
if (!canEdit) {
const projectAccessTarget = await db.project.findUnique({
where: { id: projectId },
select: { id: true, ownerId: true, workspaceId: true, visibility: true },
});
const access = projectAccessTarget
? await checkProjectAccess(projectAccessTarget, session.user.id, { intent: 'manage' })
: null;
if (!access?.canEdit) {
return apiErrors.forbidden('Access denied');
}
@@ -186,13 +130,16 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
return apiErrors.unauthorized();
}
const { canDelete, project } = await checkProjectAccess(projectId, session.user.id);
const project = await db.project.findUnique({
where: { id: projectId },
select: { id: true, ownerId: true, workspaceId: true, visibility: true },
});
if (!project) {
return apiErrors.notFound('Project');
}
if (!canDelete) {
const access = await checkProjectAccess(project, session.user.id, { intent: 'delete' });
if (!access.canDelete) {
return apiErrors.forbidden('Only the project owner can delete it');
}
app/api/projects/[projectId]/tags/[tagId]/route.ts
+15 -36
View File
@@ -1,42 +1,11 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { auth, checkProjectAccess } from '@/lib/auth';
import { rateLimit } from '@/lib/rate-limit';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ projectId: string; tagId: string }> };
// Helper to check project access
async function checkProjectAccess(projectId: string, userId: string) {
const project = await db.project.findUnique({
where: { id: projectId },
include: { members: { where: { userId } } },
});
if (!project) return { project: null, canEdit: false };
const isOwner = project.ownerId === userId;
const isAdmin = project.members[0]?.role === 'ADMIN';
// Check workspace-level access
let workspaceCanEdit = false;
if (!isOwner && !isAdmin) {
const wsMember = await db.workspaceMember.findUnique({
where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
workspaceCanEdit = wsOwner?.ownerId === userId || wsMember?.role === 'ADMIN';
}
return {
project,
canEdit: isOwner || isAdmin || workspaceCanEdit,
};
}
// PATCH /api/projects/[projectId]/tags/[tagId] - Update a tag
export async function PATCH(request: NextRequest, { params }: RouteParams) {
try {
@@ -50,11 +19,16 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
return apiErrors.unauthorized();
}
const { canEdit, project } = await checkProjectAccess(projectId, session.user.id);
const project = await db.project.findUnique({
where: { id: projectId },
select: { id: true, ownerId: true, workspaceId: true, visibility: true },
});
if (!project) {
return apiErrors.notFound('Project');
}
if (!canEdit) {
const access = await checkProjectAccess(project, session.user.id, { intent: 'manage' });
if (!access.canEdit) {
return apiErrors.forbidden('Access denied');
}
@@ -115,11 +89,16 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
return apiErrors.unauthorized();
}
const { canEdit, project } = await checkProjectAccess(projectId, session.user.id);
const project = await db.project.findUnique({
where: { id: projectId },
select: { id: true, ownerId: true, workspaceId: true, visibility: true },
});
if (!project) {
return apiErrors.notFound('Project');
}
if (!canEdit) {
const access = await checkProjectAccess(project, session.user.id, { intent: 'manage' });
if (!access.canEdit) {
return apiErrors.forbidden('Access denied');
}
app/api/projects/[projectId]/tags/route.ts
+11 -37
View File
@@ -1,6 +1,6 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { auth, checkProjectAccess } from '@/lib/auth';
import { rateLimit } from '@/lib/rate-limit';
import { validateShareLinkAccess } from '@/lib/share-links';
import { getShareSessionFromRequest } from '@/lib/share-session';
@@ -8,37 +8,6 @@ import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response
type RouteParams = { params: Promise<{ projectId: string }> };
// Helper to check project access
async function checkProjectAccess(projectId: string, userId: string) {
const project = await db.project.findUnique({
where: { id: projectId },
include: { members: { where: { userId } } },
});
if (!project) return { project: null, canEdit: false };
const isOwner = project.ownerId === userId;
const isAdmin = project.members[0]?.role === 'ADMIN';
// Check workspace-level access
let workspaceCanEdit = false;
if (!isOwner && !isAdmin) {
const wsMember = await db.workspaceMember.findUnique({
where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
workspaceCanEdit = wsOwner?.ownerId === userId || wsMember?.role === 'ADMIN';
}
return {
project,
canEdit: isOwner || isAdmin || workspaceCanEdit,
};
}
// GET /api/projects/[projectId]/tags - Get all tags for a project
export async function GET(request: NextRequest, { params }: RouteParams) {
try {
@@ -48,13 +17,13 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
const project = await db.project.findUnique({
where: { id: projectId },
select: { id: true, visibility: true },
select: { id: true, ownerId: true, workspaceId: true, visibility: true },
});
if (!project) return apiErrors.notFound('Project');
if (session?.user?.id) {
const { project: accessibleProject } = await checkProjectAccess(projectId, session.user.id);
if (!accessibleProject) {
const access = await checkProjectAccess(project, session.user.id);
if (!access.hasAccess) {
return apiErrors.notFound('Project');
}
} else {
@@ -113,11 +82,16 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
return apiErrors.unauthorized();
}
const { canEdit, project } = await checkProjectAccess(projectId, session.user.id);
const project = await db.project.findUnique({
where: { id: projectId },
select: { id: true, ownerId: true, workspaceId: true, visibility: true },
});
if (!project) {
return apiErrors.notFound('Project');
}
if (!canEdit) {
const access = await checkProjectAccess(project, session.user.id, { intent: 'manage' });
if (!access.canEdit) {
return apiErrors.forbidden('Access denied');
}
app/api/projects/[projectId]/videos/[videoId]/route.ts
+6 -38
View File
@@ -2,7 +2,6 @@ import { NextRequest } from 'next/server';
import { revalidatePath } from 'next/cache';
import { db } from '@/lib/db';
import { auth, checkProjectAccess } from '@/lib/auth';
import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
import { rateLimit } from '@/lib/rate-limit';
import { cleanupVideoMediaFiles } from '@/lib/r2-cleanup';
import { cleanupBunnyStreamVideos } from '@/lib/bunny-stream-cleanup';
@@ -151,16 +150,7 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
const video = await db.video.findFirst({
where: { id: videoId, projectId },
include: {
project: {
include: {
members: { where: { userId: session.user.id } },
workspace: {
include: {
members: { where: { userId: session.user.id } },
},
},
},
},
project: true,
},
});
@@ -168,14 +158,8 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
return apiErrors.notFound('Video');
}
const isOwner = video.project.ownerId === session.user.id;
const membership = video.project.members[0];
const workspaceMembership = video.project.workspace.members[0];
const canEdit = isOwner ||
membership?.role === ProjectMemberRole.ADMIN ||
workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
if (!canEdit) {
const access = await checkProjectAccess(video.project, session.user.id, { intent: 'manage' });
if (!access.canEdit) {
return apiErrors.forbidden('Access denied');
}
@@ -227,16 +211,7 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
videoId: true,
},
},
project: {
include: {
members: { where: { userId: session.user.id } },
workspace: {
include: {
members: { where: { userId: session.user.id } },
},
},
},
},
project: true,
},
});
@@ -244,15 +219,8 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
return apiErrors.notFound('Video');
}
const isOwner = video.project.ownerId === session.user.id;
const membership = video.project.members[0];
const workspaceMembership = video.project.workspace.members[0];
// Destructive actions limited to OWNER and ADMIN only
const canDelete = isOwner ||
membership?.role === ProjectMemberRole.ADMIN ||
workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
if (!canDelete) {
const access = await checkProjectAccess(video.project, session.user.id, { intent: 'manage' });
if (!access.canEdit) {
return apiErrors.forbidden('Only project owner or admin can delete videos');
}
app/api/projects/[projectId]/videos/[videoId]/versions/[versionId]/route.ts
+4 -19
View File
@@ -1,7 +1,6 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
import { auth, checkProjectAccess } from '@/lib/auth';
import { rateLimit } from '@/lib/rate-limit';
import { cleanupBunnyStreamVideos } from '@/lib/bunny-stream-cleanup';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
@@ -14,16 +13,7 @@ async function getVersionWithAccess(projectId: string, videoId: string, versionI
include: {
video: {
include: {
project: {
include: {
members: { where: { userId } },
workspace: {
include: {
members: { where: { userId } },
},
},
},
},
project: true,
},
},
},
@@ -34,14 +24,9 @@ async function getVersionWithAccess(projectId: string, videoId: string, versionI
}
const project = version.video.project;
const isOwner = project.ownerId === userId;
const membership = project.members[0];
const workspaceMembership = project.workspace.members[0];
const canEdit = isOwner ||
membership?.role === ProjectMemberRole.ADMIN ||
workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
const access = await checkProjectAccess(project, userId, { intent: 'manage' });
return { version, canEdit, isOwner };
return { version, canEdit: access.canEdit, isOwner: access.isOwner };
}
// PATCH /api/projects/[projectId]/videos/[videoId]/versions/[versionId]
app/api/projects/[projectId]/videos/[videoId]/versions/route.ts
+7 -28
View File
@@ -1,7 +1,6 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
import { auth, checkProjectAccess } from '@/lib/auth';
import { validateUrl, validateOptionalUrl } from '@/lib/validation';
import { rateLimit } from '@/lib/rate-limit';
import { notifyProjectOwner } from '@/lib/notifications';
@@ -19,9 +18,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
const video = await db.video.findFirst({
where: { id: videoId, projectId },
include: {
project: {
include: { members: { where: { userId: session?.user?.id || '' } } },
},
project: true,
},
});
@@ -29,11 +26,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
return apiErrors.notFound('Video');
}
const isOwner = session?.user?.id === video.project.ownerId;
const isMember = video.project.members.length > 0;
const isPublic = video.project.visibility === 'PUBLIC';
if (!isOwner && !isMember && !isPublic) {
const access = await checkProjectAccess(video.project, session?.user?.id);
if (!access.hasAccess) {
return apiErrors.forbidden('Access denied');
}
@@ -69,16 +63,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
const video = await db.video.findFirst({
where: { id: videoId, projectId },
include: {
project: {
include: {
members: { where: { userId: session.user.id } },
workspace: {
include: {
members: { where: { userId: session.user.id } },
},
},
},
},
project: true,
versions: { orderBy: { versionNumber: 'desc' }, take: 1 },
},
});
@@ -87,14 +72,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
return apiErrors.notFound('Video');
}
const isOwner = video.project.ownerId === session.user.id;
const membership = video.project.members[0];
const workspaceMembership = video.project.workspace.members[0];
const canEdit = isOwner ||
membership?.role === ProjectMemberRole.ADMIN ||
workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
if (!canEdit) {
const access = await checkProjectAccess(video.project, session.user.id, { intent: 'manage' });
if (!access.canEdit) {
return apiErrors.forbidden('Access denied');
}
app/api/projects/[projectId]/videos/bunny-init/route.ts
+4 -16
View File
@@ -1,7 +1,6 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
import { auth, checkProjectAccess } from '@/lib/auth';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
import { rateLimit } from '@/lib/rate-limit';
import crypto from 'crypto';
@@ -13,24 +12,13 @@ type RouteParams = { params: Promise<{ projectId: string }> };
async function getProjectWithEditAccess(projectId: string, userId: string) {
const project = await db.project.findUnique({
where: { id: projectId },
include: {
members: { where: { userId } },
workspace: {
include: {
members: { where: { userId } },
},
},
},
select: { id: true, name: true, ownerId: true, workspaceId: true, visibility: true },
});
if (!project) return null;
const isOwner = project.ownerId === userId;
const membership = project.members[0];
const workspaceMembership = project.workspace.members[0];
const canEdit = isOwner ||
membership?.role === ProjectMemberRole.ADMIN ||
workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
const access = await checkProjectAccess(project, userId, { intent: 'manage' });
const canEdit = access.canEdit;
if (!canEdit) return null;
app/api/projects/[projectId]/videos/route.ts
+7 -24
View File
@@ -1,7 +1,6 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { ProjectMemberRole, WorkspaceMemberRole } from '@prisma/client';
import { auth, checkProjectAccess } from '@/lib/auth';
import { validateUrl, validateOptionalUrl } from '@/lib/validation';
import { rateLimit } from '@/lib/rate-limit';
import { notifyProjectOwner } from '@/lib/notifications';
@@ -19,18 +18,15 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
// Check project exists and user has access
const project = await db.project.findUnique({
where: { id: projectId },
include: { members: { where: { userId: session?.user?.id || '' } } },
select: { id: true, ownerId: true, workspaceId: true, visibility: true },
});
if (!project) {
return apiErrors.notFound('Project');
}
const isOwner = session?.user?.id === project.ownerId;
const isMember = project.members.length > 0;
const isPublic = project.visibility === 'PUBLIC';
if (!isOwner && !isMember && !isPublic) {
const access = await checkProjectAccess(project, session?.user?.id);
if (!access.hasAccess) {
return apiErrors.forbidden('Access denied');
}
@@ -78,28 +74,15 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
// Check project access (must be owner, project admin, or workspace admin)
const project = await db.project.findUnique({
where: { id: projectId },
include: {
members: { where: { userId: session.user.id } },
workspace: {
include: {
members: { where: { userId: session.user.id } },
},
},
},
select: { id: true, name: true, ownerId: true, workspaceId: true, visibility: true },
});
if (!project) {
return apiErrors.notFound('Project');
}
const isOwner = project.ownerId === session.user.id;
const membership = project.members[0];
const workspaceMembership = project.workspace.members[0];
const canEdit = isOwner ||
membership?.role === ProjectMemberRole.ADMIN ||
workspaceMembership?.role === WorkspaceMemberRole.ADMIN;
if (!canEdit) {
const access = await checkProjectAccess(project, session.user.id, { intent: 'manage' });
if (!access.canEdit) {
return apiErrors.forbidden('Access denied');
}
app/api/versions/[versionId]/comments/export/route.ts
+3 -28
View File
@@ -1,5 +1,5 @@
import { NextRequest } from 'next/server';
import { auth } from '@/lib/auth';
import { auth, checkProjectAccess } from '@/lib/auth';
import { db } from '@/lib/db';
import {
buildCommentsCsv,
@@ -50,10 +50,6 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
ownerId: true,
workspaceId: true,
visibility: true,
members: {
where: { userId: session.user.id },
select: { id: true },
},
},
},
},
@@ -66,30 +62,9 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
}
const project = version.video.project;
const isOwner = session.user.id === project.ownerId;
const isMember = project.members.length > 0;
const access = await checkProjectAccess(project, session.user.id);
let isWorkspaceMember = false;
if (!isOwner && !isMember) {
const [workspaceMember, workspace] = await Promise.all([
db.workspaceMember.findUnique({
where: {
workspaceId_userId: {
workspaceId: project.workspaceId,
userId: session.user.id,
},
},
select: { id: true },
}),
db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
}),
]);
isWorkspaceMember = !!workspaceMember || workspace?.ownerId === session.user.id;
}
if (!isOwner && !isMember && !isWorkspaceMember) {
if (!access.hasAccess) {
return apiErrors.notFound('Version');
}
app/api/versions/[versionId]/comments/route.ts
+7 -55
View File
@@ -1,6 +1,6 @@
import { NextRequest, NextResponse } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { auth, checkProjectAccess } from '@/lib/auth';
import { rateLimit } from '@/lib/rate-limit';
import { notifyProjectOwner } from '@/lib/notifications';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
@@ -52,11 +52,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
include: {
video: {
include: {
project: {
include: {
members: { where: { userId: session?.user?.id || '' } },
},
},
project: true,
},
},
},
@@ -67,28 +63,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
}
const project = version.video.project;
const access = await checkProjectAccess(project, session?.user?.id);
const shareSession = getShareSessionFromRequest(request, version.video.id);
const isOwner = session?.user?.id === project.ownerId;
const isMember = project.members.length > 0;
const isPublic = project.visibility === 'PUBLIC';
// Check workspace membership for access
let isWorkspaceMember = false;
if (!isOwner && !isMember && !isPublic && session?.user?.id) {
const wsMember = await db.workspaceMember.findUnique({
where: {
workspaceId_userId: {
workspaceId: project.workspaceId,
userId: session.user.id,
},
},
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
}
const shareAccess = shareSession
? await validateShareLinkAccess({
@@ -100,7 +76,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
})
: { hasAccess: false, requiresPassword: false };
if (!isOwner && !isMember && !isPublic && !isWorkspaceMember && !shareAccess.hasAccess) {
if (!access.hasAccess && !shareAccess.hasAccess) {
return apiErrors.forbidden('Access denied');
}
@@ -208,11 +184,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
include: {
video: {
include: {
project: {
include: {
members: { where: { userId: session?.user?.id || '' } },
},
},
project: true,
},
},
},
@@ -223,28 +195,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
}
const project = version.video.project;
const access = await checkProjectAccess(project, session?.user?.id);
const shareSession = getShareSessionFromRequest(request, version.video.id);
const isOwner = session?.user?.id === project.ownerId;
const isMember = project.members.length > 0;
const isPublic = project.visibility === 'PUBLIC';
// Check workspace membership for comment access
let isWorkspaceMember = false;
if (!isOwner && !isMember && !isPublic && session?.user?.id) {
const wsMember = await db.workspaceMember.findUnique({
where: {
workspaceId_userId: {
workspaceId: project.workspaceId,
userId: session.user.id,
},
},
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
}
const shareAccess = shareSession
? await validateShareLinkAccess({
@@ -257,7 +209,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
: { hasAccess: false, canComment: false, canDownload: false, allowGuests: false, requiresPassword: false };
// Check if user can comment
const canComment = isOwner || isMember || isPublic || isWorkspaceMember || shareAccess.canComment;
const canComment = access.hasAccess || shareAccess.canComment;
if (!canComment) {
return apiErrors.forbidden('Access denied');
}
lib/auth.ts
+22 -11
View File
@@ -87,11 +87,15 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
},
});
type ProjectAccessIntent = 'view' | 'manage' | 'delete';
// Helper to check project access including workspace membership
export async function checkProjectAccess(
project: { id: string; ownerId: string; workspaceId: string; visibility: string },
userId: string | undefined
userId: string | undefined,
options?: { intent?: ProjectAccessIntent }
) {
const intent = options?.intent ?? 'view';
const isOwner = userId === project.ownerId;
const isPublic = project.visibility === 'PUBLIC';
@@ -104,16 +108,23 @@ export async function checkProjectAccess(
const isProjectMember = !!projectMember;
const isProjectAdmin = projectMember?.role === ProjectMemberRole.ADMIN;
// Check workspace membership
let workspaceRole: string | null = null;
if (!isOwner && !isProjectMember && userId) {
const wsMember = await db.workspaceMember.findUnique({
where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
const needsWorkspaceForAccess = !!userId && !isOwner && !isProjectMember && !isPublic;
const needsWorkspaceForActions = !!userId && !isOwner && intent !== 'view';
const shouldLoadWorkspaceRole = needsWorkspaceForAccess || needsWorkspaceForActions;
// Check workspace membership/role
let workspaceRole: WorkspaceMemberRole | 'OWNER' | null = null;
if (shouldLoadWorkspaceRole && userId) {
const [wsMember, wsOwner] = await Promise.all([
db.workspaceMember.findUnique({
where: { workspaceId_userId: { workspaceId: project.workspaceId, userId } },
}),
db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
}),
]);
if (wsOwner?.ownerId === userId) {
workspaceRole = 'OWNER';
} else if (wsMember) {