From 413fc9cec67a61077ee315b668e2c12aa05f0d6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yusuf=20=C4=B0pek?= <yusufipek@protonmail.com>
Date: Sat, 14 Feb 2026 15:28:50 +0300
Subject: [PATCH] fix(api): add project access validation to video progress
 route

---
 app/api/watch/[videoId]/progress/route.ts | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/app/api/watch/[videoId]/progress/route.ts b/app/api/watch/[videoId]/progress/route.ts
index 8bbbd39..fe784ca 100644
--- a/app/api/watch/[videoId]/progress/route.ts
+++ b/app/api/watch/[videoId]/progress/route.ts
@@ -1,6 +1,6 @@
 import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
-import { auth } from '@/lib/auth';
+import { auth, checkProjectAccess } from '@/lib/auth';
 import { apiErrors, successResponse } from '@/lib/api-response';
 
 type RouteParams = { params: Promise<{ videoId: string }> };
@@ -20,6 +20,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
         const video = await db.video.findUnique({
             where: { id: videoId },
             include: {
+                project: true,
                 versions: {
                     where: { isActive: true },
                     take: 1,
@@ -31,6 +32,13 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Video');
         }
 
+        // Check access including workspace membership
+        const access = await checkProjectAccess(video.project, session?.user?.id);
+
+        if (!access.hasAccess) {
+            return apiErrors.forbidden('Access denied');
+        }
+
         const activeVersion = video.versions[0];
         if (!activeVersion) {
             return apiErrors.notFound('Video version');
@@ -82,6 +90,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             const video = await db.video.findUnique({
                 where: { id: videoId },
                 include: {
+                    project: true,
                     versions: {
                         where: { isActive: true },
                         take: 1,
@@ -93,6 +102,13 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
                 return apiErrors.notFound('Video');
             }
 
+            // Check access including workspace membership
+            const access = await checkProjectAccess(video.project, session?.user?.id);
+
+            if (!access.hasAccess) {
+                return apiErrors.forbidden('Access denied');
+            }
+
             const activeVersion = video.versions[0];
             if (!activeVersion) {
                 return apiErrors.notFound('Video version');