yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): add project access validation to video progress route

Browse Source
This commit is contained in:
Yusuf İpek
2026-02-14 15:28:50 +03:00
parent 88c74d646e
commit 413fc9cec6
1 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/watch/[videoId]/progress/route.ts
+17 -1
View File
@@ -1,6 +1,6 @@
import { NextRequest } from 'next/server';
import { db } from '@/lib/db';
import { auth } from '@/lib/auth';
import { auth, checkProjectAccess } from '@/lib/auth';
import { apiErrors, successResponse } from '@/lib/api-response';
type RouteParams = { params: Promise<{ videoId: string }> };
@@ -20,6 +20,7 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
const video = await db.video.findUnique({
where: { id: videoId },
include: {
project: true,
versions: {
where: { isActive: true },
take: 1,
@@ -31,6 +32,13 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
return apiErrors.notFound('Video');
}
// Check access including workspace membership
const access = await checkProjectAccess(video.project, session?.user?.id);
if (!access.hasAccess) {
return apiErrors.forbidden('Access denied');
}
const activeVersion = video.versions[0];
if (!activeVersion) {
return apiErrors.notFound('Video version');
@@ -82,6 +90,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
const video = await db.video.findUnique({
where: { id: videoId },
include: {
project: true,
versions: {
where: { isActive: true },
take: 1,
@@ -93,6 +102,13 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
return apiErrors.notFound('Video');
}
// Check access including workspace membership
const access = await checkProjectAccess(video.project, session?.user?.id);
if (!access.hasAccess) {
return apiErrors.forbidden('Access denied');
}
const activeVersion = video.versions[0];
if (!activeVersion) {
return apiErrors.notFound('Video version');