mirror of
https://github.com/yusufipk/OpenFrame.git
synced 2026-09-11 17:46:06 +00:00
refactor: eslint and prettier conflict will be resolved and formatted
This commit is contained in:
Enes Köksal
@@ -18,349 +18,374 @@ type RouteParams = { params: Promise<{ commentId: string }> };
|
||||
|
||||
// GET /api/comments/[commentId]
|
||||
export async function GET(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const session = await auth();
|
||||
const { commentId } = await params;
|
||||
try {
|
||||
const session = await auth();
|
||||
const { commentId } = await params;
|
||||
|
||||
const comment = await db.comment.findUnique({
|
||||
where: { id: commentId },
|
||||
select: {
|
||||
id: true,
|
||||
content: true,
|
||||
timestamp: true,
|
||||
timestampEnd: true,
|
||||
createdAt: true,
|
||||
updatedAt: true,
|
||||
isResolved: true,
|
||||
resolvedAt: true,
|
||||
voiceUrl: true,
|
||||
voiceDuration: true,
|
||||
imageUrl: true,
|
||||
parentId: true,
|
||||
authorId: true,
|
||||
tagId: true,
|
||||
versionId: true,
|
||||
guestName: true,
|
||||
author: { select: { id: true, name: true, image: true } },
|
||||
tag: { select: { id: true, name: true, color: true } },
|
||||
replies: {
|
||||
orderBy: { createdAt: 'asc' },
|
||||
select: {
|
||||
id: true,
|
||||
content: true,
|
||||
timestamp: true,
|
||||
timestampEnd: true,
|
||||
createdAt: true,
|
||||
updatedAt: true,
|
||||
isResolved: true,
|
||||
resolvedAt: true,
|
||||
voiceUrl: true,
|
||||
voiceDuration: true,
|
||||
imageUrl: true,
|
||||
parentId: true,
|
||||
authorId: true,
|
||||
tagId: true,
|
||||
versionId: true,
|
||||
guestName: true,
|
||||
author: { select: { id: true, name: true, image: true } },
|
||||
tag: { select: { id: true, name: true, color: true } },
|
||||
},
|
||||
},
|
||||
version: {
|
||||
include: {
|
||||
video: {
|
||||
include: {
|
||||
project: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
const comment = await db.comment.findUnique({
|
||||
where: { id: commentId },
|
||||
select: {
|
||||
id: true,
|
||||
content: true,
|
||||
timestamp: true,
|
||||
timestampEnd: true,
|
||||
createdAt: true,
|
||||
updatedAt: true,
|
||||
isResolved: true,
|
||||
resolvedAt: true,
|
||||
voiceUrl: true,
|
||||
voiceDuration: true,
|
||||
imageUrl: true,
|
||||
parentId: true,
|
||||
authorId: true,
|
||||
tagId: true,
|
||||
versionId: true,
|
||||
guestName: true,
|
||||
author: { select: { id: true, name: true, image: true } },
|
||||
tag: { select: { id: true, name: true, color: true } },
|
||||
replies: {
|
||||
orderBy: { createdAt: 'asc' },
|
||||
select: {
|
||||
id: true,
|
||||
content: true,
|
||||
timestamp: true,
|
||||
timestampEnd: true,
|
||||
createdAt: true,
|
||||
updatedAt: true,
|
||||
isResolved: true,
|
||||
resolvedAt: true,
|
||||
voiceUrl: true,
|
||||
voiceDuration: true,
|
||||
imageUrl: true,
|
||||
parentId: true,
|
||||
authorId: true,
|
||||
tagId: true,
|
||||
versionId: true,
|
||||
guestName: true,
|
||||
author: { select: { id: true, name: true, image: true } },
|
||||
tag: { select: { id: true, name: true, color: true } },
|
||||
},
|
||||
},
|
||||
version: {
|
||||
include: {
|
||||
video: {
|
||||
include: {
|
||||
project: true,
|
||||
},
|
||||
},
|
||||
});
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
if (!comment) {
|
||||
return apiErrors.notFound('Comment');
|
||||
}
|
||||
|
||||
// Authorization check: verify user has access to the project
|
||||
const project = comment.version.video.project;
|
||||
const access = await checkProjectAccess(project, session?.user?.id);
|
||||
|
||||
if (!access.hasAccess) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
|
||||
// Strip internal project data from response
|
||||
const commentData = { ...comment } as Omit<typeof comment, 'version'> & { version?: unknown };
|
||||
delete commentData.version;
|
||||
const response = successResponse(commentData);
|
||||
return withCacheControl(response, 'private, no-cache');
|
||||
} catch (error) {
|
||||
logError('Error fetching comment:', error);
|
||||
return apiErrors.internalError('Failed to fetch comment');
|
||||
if (!comment) {
|
||||
return apiErrors.notFound('Comment');
|
||||
}
|
||||
|
||||
// Authorization check: verify user has access to the project
|
||||
const project = comment.version.video.project;
|
||||
const access = await checkProjectAccess(project, session?.user?.id);
|
||||
|
||||
if (!access.hasAccess) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
|
||||
// Strip internal project data from response
|
||||
const commentData = { ...comment } as Omit<typeof comment, 'version'> & { version?: unknown };
|
||||
delete commentData.version;
|
||||
const response = successResponse(commentData);
|
||||
return withCacheControl(response, 'private, no-cache');
|
||||
} catch (error) {
|
||||
logError('Error fetching comment:', error);
|
||||
return apiErrors.internalError('Failed to fetch comment');
|
||||
}
|
||||
}
|
||||
|
||||
// PATCH /api/comments/[commentId]
|
||||
export async function PATCH(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const limited = await rateLimit(request, 'mutate');
|
||||
if (limited) return limited;
|
||||
try {
|
||||
const limited = await rateLimit(request, 'mutate');
|
||||
if (limited) return limited;
|
||||
|
||||
const session = await auth();
|
||||
const { commentId } = await params;
|
||||
const body = await request.json();
|
||||
const { content, isResolved, tagId, annotationData } = body;
|
||||
const session = await auth();
|
||||
const { commentId } = await params;
|
||||
const body = await request.json();
|
||||
const { content, isResolved, tagId, annotationData } = body;
|
||||
|
||||
const comment = await db.comment.findUnique({
|
||||
where: { id: commentId },
|
||||
include: {
|
||||
version: {
|
||||
include: {
|
||||
video: {
|
||||
include: {
|
||||
project: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
const comment = await db.comment.findUnique({
|
||||
where: { id: commentId },
|
||||
include: {
|
||||
version: {
|
||||
include: {
|
||||
video: {
|
||||
include: {
|
||||
project: true,
|
||||
},
|
||||
},
|
||||
});
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
if (!comment) {
|
||||
return apiErrors.notFound('Comment');
|
||||
}
|
||||
|
||||
const project = comment.version.video.project;
|
||||
const userId = session?.user?.id ?? null;
|
||||
const access = await checkProjectAccess(project, userId ?? undefined, { intent: 'manage' });
|
||||
const isOwner = userId === project.ownerId;
|
||||
const isAuthor = !!userId && comment.authorId === userId;
|
||||
const guestIdentityId = !userId ? getGuestIdentityFromRequest(request) : null;
|
||||
const isGuestAuthor = !userId
|
||||
&& !comment.authorId
|
||||
&& !!comment.guestIdentityId
|
||||
&& guestIdentityId === comment.guestIdentityId;
|
||||
const canEditOwnContent = isAuthor || isGuestAuthor;
|
||||
const canResolveComment = access.canEdit;
|
||||
|
||||
if (!userId && !isGuestAuthor) {
|
||||
const shareSession = getShareSessionFromRequest(request, comment.version.video.id);
|
||||
const shareAccess = shareSession
|
||||
? await validateShareLinkAccess({
|
||||
token: shareSession.token,
|
||||
projectId: project.id,
|
||||
videoId: comment.version.video.id,
|
||||
requiredPermission: 'COMMENT',
|
||||
passwordVerified: shareSession.passwordVerified,
|
||||
})
|
||||
: { hasAccess: false, canComment: false, canDownload: false, allowGuests: false, requiresPassword: false };
|
||||
const hasGuestAccess = project.visibility === 'PUBLIC' || (shareAccess.canComment && shareAccess.allowGuests);
|
||||
if (!hasGuestAccess) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
}
|
||||
|
||||
// Only author can edit content or tag
|
||||
if ((content !== undefined || tagId !== undefined || annotationData !== undefined) && !canEditOwnContent) {
|
||||
return apiErrors.forbidden('Only the author can edit comment content');
|
||||
}
|
||||
|
||||
// Owner, author, members, or workspace members can resolve/unresolve
|
||||
if (isResolved !== undefined && !canResolveComment) {
|
||||
return apiErrors.forbidden('Only admins can resolve comments');
|
||||
}
|
||||
|
||||
const updateData: Record<string, unknown> = {};
|
||||
if (content !== undefined && typeof content === 'string') updateData.content = content.trim();
|
||||
if (tagId !== undefined) {
|
||||
// Verify tag belongs to this project to prevent cross-project tag leakage (IDOR)
|
||||
if (tagId !== null) {
|
||||
const tag = await db.commentTag.findFirst({
|
||||
where: { id: tagId, projectId: project.id },
|
||||
});
|
||||
if (!tag) {
|
||||
return apiErrors.badRequest('Tag not found');
|
||||
}
|
||||
}
|
||||
updateData.tagId = tagId;
|
||||
}
|
||||
if (annotationData !== undefined) {
|
||||
if (annotationData === null) {
|
||||
updateData.annotationData = null;
|
||||
} else {
|
||||
if (!Array.isArray(annotationData)) {
|
||||
return apiErrors.badRequest('annotationData must be an array of valid stroke objects');
|
||||
}
|
||||
const validStrokes = validateAnnotationStrokes(annotationData);
|
||||
if (validStrokes === null) {
|
||||
return apiErrors.badRequest('annotationData must be an array of valid stroke objects');
|
||||
}
|
||||
updateData.annotationData = JSON.stringify(validStrokes);
|
||||
}
|
||||
}
|
||||
if (isResolved !== undefined) {
|
||||
updateData.isResolved = isResolved;
|
||||
updateData.resolvedAt = isResolved ? new Date() : null;
|
||||
}
|
||||
|
||||
const updatedComment = await db.comment.update({
|
||||
where: { id: commentId },
|
||||
data: updateData,
|
||||
include: {
|
||||
author: { select: { id: true, name: true, image: true } },
|
||||
tag: { select: { id: true, name: true, color: true } },
|
||||
replies: {
|
||||
include: {
|
||||
author: { select: { id: true, name: true, image: true } },
|
||||
tag: { select: { id: true, name: true, color: true } },
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
const updatedCommentData = Object.fromEntries(
|
||||
Object.entries(updatedComment).filter(([key]) => key !== 'guestIdentityId')
|
||||
);
|
||||
const response = successResponse({
|
||||
...updatedCommentData,
|
||||
canEdit: canEditOwnContent,
|
||||
canDelete: canEditOwnContent || isOwner,
|
||||
replies: updatedComment.replies.map((reply) => {
|
||||
const canEditReply = !!userId
|
||||
? reply.authorId === userId
|
||||
: !!guestIdentityId
|
||||
&& !reply.authorId
|
||||
&& !!reply.guestIdentityId
|
||||
&& reply.guestIdentityId === guestIdentityId;
|
||||
const replyData = Object.fromEntries(
|
||||
Object.entries(reply).filter(([key]) => key !== 'guestIdentityId')
|
||||
);
|
||||
return {
|
||||
...replyData,
|
||||
canEdit: canEditReply,
|
||||
canDelete: canEditReply || isOwner,
|
||||
};
|
||||
}),
|
||||
});
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error updating comment:', error);
|
||||
return apiErrors.internalError('Failed to update comment');
|
||||
if (!comment) {
|
||||
return apiErrors.notFound('Comment');
|
||||
}
|
||||
|
||||
const project = comment.version.video.project;
|
||||
const userId = session?.user?.id ?? null;
|
||||
const access = await checkProjectAccess(project, userId ?? undefined, { intent: 'manage' });
|
||||
const isOwner = userId === project.ownerId;
|
||||
const isAuthor = !!userId && comment.authorId === userId;
|
||||
const guestIdentityId = !userId ? getGuestIdentityFromRequest(request) : null;
|
||||
const isGuestAuthor =
|
||||
!userId &&
|
||||
!comment.authorId &&
|
||||
!!comment.guestIdentityId &&
|
||||
guestIdentityId === comment.guestIdentityId;
|
||||
const canEditOwnContent = isAuthor || isGuestAuthor;
|
||||
const canResolveComment = access.canEdit;
|
||||
|
||||
if (!userId && !isGuestAuthor) {
|
||||
const shareSession = getShareSessionFromRequest(request, comment.version.video.id);
|
||||
const shareAccess = shareSession
|
||||
? await validateShareLinkAccess({
|
||||
token: shareSession.token,
|
||||
projectId: project.id,
|
||||
videoId: comment.version.video.id,
|
||||
requiredPermission: 'COMMENT',
|
||||
passwordVerified: shareSession.passwordVerified,
|
||||
})
|
||||
: {
|
||||
hasAccess: false,
|
||||
canComment: false,
|
||||
canDownload: false,
|
||||
allowGuests: false,
|
||||
requiresPassword: false,
|
||||
};
|
||||
const hasGuestAccess =
|
||||
project.visibility === 'PUBLIC' || (shareAccess.canComment && shareAccess.allowGuests);
|
||||
if (!hasGuestAccess) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
}
|
||||
|
||||
// Only author can edit content or tag
|
||||
if (
|
||||
(content !== undefined || tagId !== undefined || annotationData !== undefined) &&
|
||||
!canEditOwnContent
|
||||
) {
|
||||
return apiErrors.forbidden('Only the author can edit comment content');
|
||||
}
|
||||
|
||||
// Owner, author, members, or workspace members can resolve/unresolve
|
||||
if (isResolved !== undefined && !canResolveComment) {
|
||||
return apiErrors.forbidden('Only admins can resolve comments');
|
||||
}
|
||||
|
||||
const updateData: Record<string, unknown> = {};
|
||||
if (content !== undefined && typeof content === 'string') updateData.content = content.trim();
|
||||
if (tagId !== undefined) {
|
||||
// Verify tag belongs to this project to prevent cross-project tag leakage (IDOR)
|
||||
if (tagId !== null) {
|
||||
const tag = await db.commentTag.findFirst({
|
||||
where: { id: tagId, projectId: project.id },
|
||||
});
|
||||
if (!tag) {
|
||||
return apiErrors.badRequest('Tag not found');
|
||||
}
|
||||
}
|
||||
updateData.tagId = tagId;
|
||||
}
|
||||
if (annotationData !== undefined) {
|
||||
if (annotationData === null) {
|
||||
updateData.annotationData = null;
|
||||
} else {
|
||||
if (!Array.isArray(annotationData)) {
|
||||
return apiErrors.badRequest('annotationData must be an array of valid stroke objects');
|
||||
}
|
||||
const validStrokes = validateAnnotationStrokes(annotationData);
|
||||
if (validStrokes === null) {
|
||||
return apiErrors.badRequest('annotationData must be an array of valid stroke objects');
|
||||
}
|
||||
updateData.annotationData = JSON.stringify(validStrokes);
|
||||
}
|
||||
}
|
||||
if (isResolved !== undefined) {
|
||||
updateData.isResolved = isResolved;
|
||||
updateData.resolvedAt = isResolved ? new Date() : null;
|
||||
}
|
||||
|
||||
const updatedComment = await db.comment.update({
|
||||
where: { id: commentId },
|
||||
data: updateData,
|
||||
include: {
|
||||
author: { select: { id: true, name: true, image: true } },
|
||||
tag: { select: { id: true, name: true, color: true } },
|
||||
replies: {
|
||||
include: {
|
||||
author: { select: { id: true, name: true, image: true } },
|
||||
tag: { select: { id: true, name: true, color: true } },
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
const updatedCommentData = Object.fromEntries(
|
||||
Object.entries(updatedComment).filter(([key]) => key !== 'guestIdentityId')
|
||||
);
|
||||
const response = successResponse({
|
||||
...updatedCommentData,
|
||||
canEdit: canEditOwnContent,
|
||||
canDelete: canEditOwnContent || isOwner,
|
||||
replies: updatedComment.replies.map((reply) => {
|
||||
const canEditReply = !!userId
|
||||
? reply.authorId === userId
|
||||
: !!guestIdentityId &&
|
||||
!reply.authorId &&
|
||||
!!reply.guestIdentityId &&
|
||||
reply.guestIdentityId === guestIdentityId;
|
||||
const replyData = Object.fromEntries(
|
||||
Object.entries(reply).filter(([key]) => key !== 'guestIdentityId')
|
||||
);
|
||||
return {
|
||||
...replyData,
|
||||
canEdit: canEditReply,
|
||||
canDelete: canEditReply || isOwner,
|
||||
};
|
||||
}),
|
||||
});
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error updating comment:', error);
|
||||
return apiErrors.internalError('Failed to update comment');
|
||||
}
|
||||
}
|
||||
|
||||
// DELETE /api/comments/[commentId]
|
||||
export async function DELETE(request: NextRequest, { params }: RouteParams) {
|
||||
try {
|
||||
const limited = await rateLimit(request, 'mutate');
|
||||
if (limited) return limited;
|
||||
try {
|
||||
const limited = await rateLimit(request, 'mutate');
|
||||
if (limited) return limited;
|
||||
|
||||
const session = await auth();
|
||||
const { commentId } = await params;
|
||||
const session = await auth();
|
||||
const { commentId } = await params;
|
||||
|
||||
const comment = await db.comment.findUnique({
|
||||
where: { id: commentId },
|
||||
include: {
|
||||
version: {
|
||||
include: {
|
||||
video: {
|
||||
include: {
|
||||
project: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
replies: { select: { voiceUrl: true, imageUrl: true } },
|
||||
const comment = await db.comment.findUnique({
|
||||
where: { id: commentId },
|
||||
include: {
|
||||
version: {
|
||||
include: {
|
||||
video: {
|
||||
include: {
|
||||
project: true,
|
||||
},
|
||||
},
|
||||
});
|
||||
},
|
||||
},
|
||||
replies: { select: { voiceUrl: true, imageUrl: true } },
|
||||
},
|
||||
});
|
||||
|
||||
if (!comment) {
|
||||
return apiErrors.notFound('Comment');
|
||||
if (!comment) {
|
||||
return apiErrors.notFound('Comment');
|
||||
}
|
||||
|
||||
const project = comment.version.video.project;
|
||||
const userId = session?.user?.id ?? null;
|
||||
const isAuthor = !!userId && comment.authorId === userId;
|
||||
|
||||
// Project owners/admins and workspace admins can delete any comment
|
||||
const access = userId ? await checkProjectAccess(project, userId, { intent: 'manage' }) : null;
|
||||
const isPrivilegedUser = !!access?.canEdit;
|
||||
|
||||
let canDelete = isAuthor || isPrivilegedUser;
|
||||
if (!canDelete && !userId) {
|
||||
const guestIdentityId = getGuestIdentityFromRequest(request);
|
||||
const isGuestAuthor =
|
||||
!comment.authorId &&
|
||||
!!comment.guestIdentityId &&
|
||||
guestIdentityId === comment.guestIdentityId;
|
||||
|
||||
if (isGuestAuthor) {
|
||||
const shareSession = getShareSessionFromRequest(request, comment.version.video.id);
|
||||
const shareAccess = shareSession
|
||||
? await validateShareLinkAccess({
|
||||
token: shareSession.token,
|
||||
projectId: project.id,
|
||||
videoId: comment.version.video.id,
|
||||
requiredPermission: 'COMMENT',
|
||||
passwordVerified: shareSession.passwordVerified,
|
||||
})
|
||||
: {
|
||||
hasAccess: false,
|
||||
canComment: false,
|
||||
canDownload: false,
|
||||
allowGuests: false,
|
||||
requiresPassword: false,
|
||||
};
|
||||
const hasGuestAccess =
|
||||
project.visibility === 'PUBLIC' || (shareAccess.canComment && shareAccess.allowGuests);
|
||||
if (!hasGuestAccess) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
canDelete = true;
|
||||
}
|
||||
}
|
||||
|
||||
const project = comment.version.video.project;
|
||||
const userId = session?.user?.id ?? null;
|
||||
const isAuthor = !!userId && comment.authorId === userId;
|
||||
if (!canDelete) {
|
||||
return apiErrors.forbidden('You do not have permission to delete this comment');
|
||||
}
|
||||
|
||||
// Project owners/admins and workspace admins can delete any comment
|
||||
const access = userId ? await checkProjectAccess(project, userId, { intent: 'manage' }) : null;
|
||||
const isPrivilegedUser = !!access?.canEdit;
|
||||
// Collect all media URLs to delete from R2 (comment + its replies)
|
||||
const mediaUrls: string[] = [];
|
||||
if (comment.voiceUrl) mediaUrls.push(comment.voiceUrl);
|
||||
if (comment.imageUrl) mediaUrls.push(comment.imageUrl);
|
||||
for (const reply of comment.replies) {
|
||||
if (reply.voiceUrl) mediaUrls.push(reply.voiceUrl);
|
||||
if (reply.imageUrl) mediaUrls.push(reply.imageUrl);
|
||||
}
|
||||
|
||||
let canDelete = isAuthor || isPrivilegedUser;
|
||||
if (!canDelete && !userId) {
|
||||
const guestIdentityId = getGuestIdentityFromRequest(request);
|
||||
const isGuestAuthor = !comment.authorId
|
||||
&& !!comment.guestIdentityId
|
||||
&& guestIdentityId === comment.guestIdentityId;
|
||||
await db.comment.delete({ where: { id: commentId } });
|
||||
|
||||
if (isGuestAuthor) {
|
||||
const shareSession = getShareSessionFromRequest(request, comment.version.video.id);
|
||||
const shareAccess = shareSession
|
||||
? await validateShareLinkAccess({
|
||||
token: shareSession.token,
|
||||
projectId: project.id,
|
||||
videoId: comment.version.video.id,
|
||||
requiredPermission: 'COMMENT',
|
||||
passwordVerified: shareSession.passwordVerified,
|
||||
})
|
||||
: { hasAccess: false, canComment: false, canDownload: false, allowGuests: false, requiresPassword: false };
|
||||
const hasGuestAccess = project.visibility === 'PUBLIC' || (shareAccess.canComment && shareAccess.allowGuests);
|
||||
if (!hasGuestAccess) {
|
||||
return apiErrors.forbidden('Access denied');
|
||||
}
|
||||
canDelete = true;
|
||||
}
|
||||
}
|
||||
|
||||
if (!canDelete) {
|
||||
return apiErrors.forbidden('You do not have permission to delete this comment');
|
||||
}
|
||||
|
||||
// Collect all media URLs to delete from R2 (comment + its replies)
|
||||
const mediaUrls: string[] = [];
|
||||
if (comment.voiceUrl) mediaUrls.push(comment.voiceUrl);
|
||||
if (comment.imageUrl) mediaUrls.push(comment.imageUrl);
|
||||
for (const reply of comment.replies) {
|
||||
if (reply.voiceUrl) mediaUrls.push(reply.voiceUrl);
|
||||
if (reply.imageUrl) mediaUrls.push(reply.imageUrl);
|
||||
}
|
||||
|
||||
await db.comment.delete({ where: { id: commentId } });
|
||||
|
||||
// Clean up media files from R2 (best-effort, don't block on failure)
|
||||
const AUDIO_PREFIX = '/api/upload/audio/';
|
||||
const IMAGE_PREFIX = '/api/upload/image/';
|
||||
const mediaKeys = [...new Set(mediaUrls.map((url) => {
|
||||
// Clean up media files from R2 (best-effort, don't block on failure)
|
||||
const AUDIO_PREFIX = '/api/upload/audio/';
|
||||
const IMAGE_PREFIX = '/api/upload/image/';
|
||||
const mediaKeys = [
|
||||
...new Set(
|
||||
mediaUrls
|
||||
.map((url) => {
|
||||
// Extract filename using string parsing (safe against ReDoS)
|
||||
if (url.includes(AUDIO_PREFIX)) {
|
||||
const filename = url.slice(url.indexOf(AUDIO_PREFIX) + AUDIO_PREFIX.length);
|
||||
return filename ? `voice/${filename}` : null;
|
||||
const filename = url.slice(url.indexOf(AUDIO_PREFIX) + AUDIO_PREFIX.length);
|
||||
return filename ? `voice/${filename}` : null;
|
||||
}
|
||||
if (url.includes(IMAGE_PREFIX)) {
|
||||
const filename = url.slice(url.indexOf(IMAGE_PREFIX) + IMAGE_PREFIX.length);
|
||||
return filename ? `images/${filename}` : null;
|
||||
const filename = url.slice(url.indexOf(IMAGE_PREFIX) + IMAGE_PREFIX.length);
|
||||
return filename ? `images/${filename}` : null;
|
||||
}
|
||||
return null;
|
||||
}).filter((key): key is string => Boolean(key)))];
|
||||
})
|
||||
.filter((key): key is string => Boolean(key))
|
||||
),
|
||||
];
|
||||
|
||||
await runWithConcurrency(mediaKeys, CLEANUP_DELETE_CONCURRENCY, async (key) => {
|
||||
try {
|
||||
await r2Client.send(
|
||||
new DeleteObjectCommand({
|
||||
Bucket: R2_BUCKET_NAME,
|
||||
Key: key,
|
||||
})
|
||||
);
|
||||
} catch (err) {
|
||||
logError(`Failed to delete media from R2 (key: ${key}):`, err);
|
||||
}
|
||||
});
|
||||
await runWithConcurrency(mediaKeys, CLEANUP_DELETE_CONCURRENCY, async (key) => {
|
||||
try {
|
||||
await r2Client.send(
|
||||
new DeleteObjectCommand({
|
||||
Bucket: R2_BUCKET_NAME,
|
||||
Key: key,
|
||||
})
|
||||
);
|
||||
} catch (err) {
|
||||
logError(`Failed to delete media from R2 (key: ${key}):`, err);
|
||||
}
|
||||
});
|
||||
|
||||
const response = successResponse({ message: 'Comment deleted' });
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error deleting comment:', error);
|
||||
return apiErrors.internalError('Failed to delete comment');
|
||||
}
|
||||
const response = successResponse({ message: 'Comment deleted' });
|
||||
return withCacheControl(response, 'private, no-store');
|
||||
} catch (error) {
|
||||
logError('Error deleting comment:', error);
|
||||
return apiErrors.internalError('Failed to delete comment');
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user