yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(watch-progress): validate versionId and enforce video access/version ownership before saving progress

Browse Source
This commit is contained in:
Yusuf İpek
2026-02-24 17:20:45 +03:00
parent 354bc38d42
commit 68c63ce020
1 changed files with 27 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/watch/[videoId]/progress/route.ts
+27 -29
View File
@@ -88,37 +88,35 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
return apiErrors.badRequest('Invalid progress value'); return apiErrors.badRequest('Invalid progress value');
} }
// Get the video version if (versionId !== undefined && typeof versionId !== 'string') {
let targetVersionId = versionId; return apiErrors.badRequest('Invalid versionId');
}
if (!targetVersionId) {
const video = await db.video.findUnique({ // Always load the requested video and validate access before writing progress.
where: { id: videoId }, // If versionId is provided, verify it belongs to this video; otherwise resolve active version.
include: { const video = await db.video.findUnique({
project: true, where: { id: videoId },
versions: { include: {
where: { isActive: true }, project: true,
take: 1, versions: {
}, where: versionId ? { id: versionId } : { isActive: true },
take: 1,
}, },
}); },
});
if (!video) { if (!video) {
return apiErrors.notFound('Video'); return apiErrors.notFound('Video');
} }
// Check access including workspace membership const access = await checkProjectAccess(video.project, session?.user?.id);
const access = await checkProjectAccess(video.project, session?.user?.id); if (!access.hasAccess) {
return apiErrors.forbidden('Access denied');
}
if (!access.hasAccess) { const targetVersion = video.versions[0];
return apiErrors.forbidden('Access denied'); if (!targetVersion) {
} return apiErrors.notFound('Video version');
const activeVersion = video.versions[0];
if (!activeVersion) {
return apiErrors.notFound('Video version');
}
targetVersionId = activeVersion.id;
} }
// Calculate percentage // Calculate percentage
@@ -130,7 +128,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
where: { where: {
userId_versionId: { userId_versionId: {
userId: session.user.id, userId: session.user.id,
versionId: targetVersionId, versionId: targetVersion.id,
}, },
}, },
update: { update: {
@@ -140,7 +138,7 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
}, },
create: { create: {
userId: session.user.id, userId: session.user.id,
versionId: targetVersionId, versionId: targetVersion.id,
progress, progress,
duration: safeDuration, duration: safeDuration,
percentage, percentage,