yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(watch-progress): validate versionId and enforce video access/version ownership before saving progress

Browse Source
This commit is contained in:
Yusuf İpek
2026-02-24 17:20:45 +03:00
parent 354bc38d42
commit 68c63ce020
1 changed files with 27 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/watch/[videoId]/progress/route.ts
+10 -12
View File
@@ -88,16 +88,18 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
return apiErrors.badRequest('Invalid progress value'); return apiErrors.badRequest('Invalid progress value');
} }
// Get the video version if (versionId !== undefined && typeof versionId !== 'string') {
let targetVersionId = versionId; return apiErrors.badRequest('Invalid versionId');
}
if (!targetVersionId) { // Always load the requested video and validate access before writing progress.
// If versionId is provided, verify it belongs to this video; otherwise resolve active version.
const video = await db.video.findUnique({ const video = await db.video.findUnique({
where: { id: videoId }, where: { id: videoId },
include: { include: {
project: true, project: true,
versions: { versions: {
where: { isActive: true }, where: versionId ? { id: versionId } : { isActive: true },
take: 1, take: 1,
}, },
}, },
@@ -107,19 +109,15 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
return apiErrors.notFound('Video'); return apiErrors.notFound('Video');
} }
// Check access including workspace membership
const access = await checkProjectAccess(video.project, session?.user?.id); const access = await checkProjectAccess(video.project, session?.user?.id);
if (!access.hasAccess) { if (!access.hasAccess) {
return apiErrors.forbidden('Access denied'); return apiErrors.forbidden('Access denied');
} }
const activeVersion = video.versions[0]; const targetVersion = video.versions[0];
if (!activeVersion) { if (!targetVersion) {
return apiErrors.notFound('Video version'); return apiErrors.notFound('Video version');
} }
targetVersionId = activeVersion.id;
}
// Calculate percentage // Calculate percentage
const safeDuration = duration || 0; const safeDuration = duration || 0;
@@ -130,7 +128,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
where: { where: {
userId_versionId: { userId_versionId: {
userId: session.user.id, userId: session.user.id,
versionId: targetVersionId, versionId: targetVersion.id,
}, },
}, },
update: { update: {
@@ -140,7 +138,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
}, },
create: { create: {
userId: session.user.id, userId: session.user.id,
versionId: targetVersionId, versionId: targetVersion.id,
progress, progress,
duration: safeDuration, duration: safeDuration,
percentage, percentage,