feat: add project bulk download and bulk video delete

Add a "Download project" / "Download selected" flow that builds a server-side manifest of downloadable media, plus a selection mode with bulk delete for project videos. Gate viewer downloads behind a new project allowDownloads setting (default off, opt-in). Admins can always download; enabling on a public project allows anonymous visitors to download. Enforce the setting on every download surface (manifest, version, asset, watch, video routes) via canDownloadProjectMedia. Add rate limits for the manifest endpoint, host allowlisting for direct download URLs, and configurable file/byte caps. Closes #16 Closes #19
2026-09-11 17:46:06 +00:00 · 2026-06-27 13:24:05 +02:00
parent 9613c4f2c6
commit 52e4169db2
22 changed files with 1138 additions and 50 deletions
@@ -0,0 +1,82 @@
+import { NextRequest } from 'next/server';
+import { auth, checkProjectAccess } from '@/lib/auth';
+import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
+import { db } from '@/lib/db';
+import { logCleanupWarnings } from '@/lib/cleanup-warnings';
+import { logError } from '@/lib/logger';
+import { rateLimit } from '@/lib/rate-limit';
+import { deleteProjectVideosWithCleanup } from '@/lib/video-delete';
+
+type RouteParams = { params: Promise<{ projectId: string }> };
+
+const MAX_BULK_DELETE = 50;
+
+// POST /api/projects/[projectId]/videos/bulk-delete
+export async function POST(request: NextRequest, { params }: RouteParams) {
+  try {
+    const limited = await rateLimit(request, 'mutate');
+    if (limited) return limited;
+
+    const session = await auth();
+    const { projectId } = await params;
+
+    if (!session?.user?.id) {
+      return apiErrors.unauthorized();
+    }
+
+    const project = await db.project.findUnique({
+      where: { id: projectId },
+      select: { id: true, ownerId: true, workspaceId: true, visibility: true },
+    });
+    if (!project) {
+      return apiErrors.notFound('Project');
+    }
+
+    const access = await checkProjectAccess(project, session.user.id, { intent: 'manage' });
+    if (!access.canEdit) {
+      return apiErrors.forbidden('Only project owner or admin can delete videos');
+    }
+
+    const body = await request.json();
+    const { videoIds } = body as { videoIds?: unknown };
+
+    if (!Array.isArray(videoIds) || videoIds.length === 0) {
+      return apiErrors.badRequest('videoIds must be a non-empty array');
+    }
+    if (videoIds.length > MAX_BULK_DELETE) {
+      return apiErrors.badRequest(`You can delete at most ${MAX_BULK_DELETE} videos at once`);
+    }
+    if (!videoIds.every((id) => typeof id === 'string' && id.trim().length > 0)) {
+      return apiErrors.badRequest('Each video id must be a non-empty string');
+    }
+
+    const normalizedIds = [...new Set(videoIds.map((id) => id.trim()))];
+
+    let result;
+    try {
+      result = await deleteProjectVideosWithCleanup(projectId, normalizedIds);
+    } catch (error) {
+      if (error instanceof Error && error.message === 'VIDEO_NOT_FOUND') {
+        return apiErrors.badRequest('One or more selected videos do not belong to this project');
+      }
+      throw error;
+    }
+
+    if (result.cleanupWarnings) {
+      logCleanupWarnings(
+        { entityType: 'video', entityId: `bulk:${normalizedIds.join(',')}` },
+        result.cleanupInput
+      );
+    }
+
+    const response = successResponse({
+      message: `${result.deletedCount} video${result.deletedCount === 1 ? '' : 's'} deleted`,
+      deletedCount: result.deletedCount,
+      ...(result.cleanupWarnings ? { cleanupWarnings: result.cleanupWarnings } : {}),
+    });
+    return withCacheControl(response, 'private, no-store');
+  } catch (error) {
+    logError('Error bulk deleting videos:', error);
+    return apiErrors.internalError('Failed to delete selected videos');
+  }
+}