From 4083651025c4abb33afdcd477657cf3d98d6f4ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yusuf=20=C4=B0pek?= <yusufipek@protonmail.com>
Date: Tue, 24 Feb 2026 15:03:42 +0300
Subject: [PATCH] Restrict guest CSV comment export in UI and fix
 lint/typecheck cleanup in comment APIs

---
 app/api/comments/[commentId]/route.ts         |  8 +++++--
 .../versions/[versionId]/comments/route.ts    |  4 +++-
 app/api/watch/[videoId]/route.ts              | 22 +++++++++----------
 components/video-page-content.tsx             |  4 ++--
 4 files changed, 22 insertions(+), 16 deletions(-)

diff --git a/app/api/comments/[commentId]/route.ts b/app/api/comments/[commentId]/route.ts
index a5ad423..0249bb8 100644
--- a/app/api/comments/[commentId]/route.ts
+++ b/app/api/comments/[commentId]/route.ts
@@ -243,7 +243,9 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
             },
         });
 
-        const { guestIdentityId: _updatedGuestIdentityId, ...updatedCommentData } = updatedComment;
+        const updatedCommentData = Object.fromEntries(
+            Object.entries(updatedComment).filter(([key]) => key !== 'guestIdentityId')
+        );
         const response = successResponse({
             ...updatedCommentData,
             canEdit: canEditOwnContent,
@@ -255,7 +257,9 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
                     && !reply.authorId
                     && !!reply.guestIdentityId
                     && reply.guestIdentityId === guestIdentityId;
-                const { guestIdentityId: _replyGuestIdentityId, ...replyData } = reply;
+                const replyData = Object.fromEntries(
+                    Object.entries(reply).filter(([key]) => key !== 'guestIdentityId')
+                );
                 return {
                     ...replyData,
                     canEdit: canEditReply,
diff --git a/app/api/versions/[versionId]/comments/route.ts b/app/api/versions/[versionId]/comments/route.ts
index 2b1c7be..511b483 100644
--- a/app/api/versions/[versionId]/comments/route.ts
+++ b/app/api/versions/[versionId]/comments/route.ts
@@ -362,7 +362,9 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             : !!viewerGuestIdentityId
             && !!comment.guestIdentityId
             && comment.guestIdentityId === viewerGuestIdentityId;
-        const { guestIdentityId: _guestIdentityId, ...commentData } = comment;
+        const commentData = Object.fromEntries(
+            Object.entries(comment).filter(([key]) => key !== 'guestIdentityId')
+        );
 
         const response = successResponse({
             ...commentData,
diff --git a/app/api/watch/[videoId]/route.ts b/app/api/watch/[videoId]/route.ts
index 9ca3a9c..5af3cd3 100644
--- a/app/api/watch/[videoId]/route.ts
+++ b/app/api/watch/[videoId]/route.ts
@@ -138,12 +138,12 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
                         && !!comment.guestIdentityId
                         && comment.guestIdentityId === viewerGuestIdentityId;
                     const canDeleteComment = canEditComment || isProjectOwner;
-                    const {
-                        authorId: _commentAuthorId,
-                        guestIdentityId: _commentGuestIdentityId,
-                        replies,
-                        ...commentData
-                    } = comment;
+                    const replies = comment.replies;
+                    const commentData = Object.fromEntries(
+                        Object.entries(comment).filter(
+                            ([key]) => key !== 'authorId' && key !== 'guestIdentityId' && key !== 'replies'
+                        )
+                    );
 
                     return {
                         ...commentData,
@@ -156,11 +156,11 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
                                 && !!reply.guestIdentityId
                                 && reply.guestIdentityId === viewerGuestIdentityId;
                             const canDeleteReply = canEditReply || isProjectOwner;
-                            const {
-                                authorId: _replyAuthorId,
-                                guestIdentityId: _replyGuestIdentityId,
-                                ...replyData
-                            } = reply;
+                            const replyData = Object.fromEntries(
+                                Object.entries(reply).filter(
+                                    ([key]) => key !== 'authorId' && key !== 'guestIdentityId'
+                                )
+                            );
                             return {
                                 ...replyData,
                                 canEdit: canEditReply,
diff --git a/components/video-page-content.tsx b/components/video-page-content.tsx
index 7d0305b..1b5cd46 100644
--- a/components/video-page-content.tsx
+++ b/components/video-page-content.tsx
@@ -3551,12 +3551,12 @@ export function VideoPageContent({ mode, videoId, projectId: propProjectId }: Vi
                 variant="ghost"
                 size="icon"
                 className="h-8 w-8"
-                disabled={!activeVersion || isExportingCsv || isExportingPdf}
+                disabled={!activeVersion || isGuest || isExportingCsv || isExportingPdf}
                 onClick={(e) => {
                   e.stopPropagation();
                   handleExportComments('csv');
                 }}
-                title="Download comments as CSV"
+                title={isGuest ? 'CSV export requires an authenticated account' : 'Download comments as CSV'}
               >
                 {isExportingCsv ? <Loader2 className="h-4 w-4 animate-spin" /> : <Download className="h-4 w-4" />}
               </Button>