feat: Introduce guest access for video viewing, implement user notification settings via email and Telegram, and add rate limiting infrastructure.

2026-09-11 17:46:06 +00:00 · 2026-02-07 13:56:26 +03:00
parent 296c5257a7
commit 88dcf9514c
17 changed files with 1566 additions and 39 deletions
@@ -54,7 +54,10 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
            return NextResponse.json({ error: 'Access denied' }, { status: 403 });
        }

-        return NextResponse.json(video);
+        return NextResponse.json({
+            ...video,
+            isAuthenticated: !!session?.user?.id,
+        });
    } catch (error) {
        console.error('Error fetching video:', error);
        return NextResponse.json(
@@ -4,6 +4,7 @@ import { auth } from '@/lib/auth';
 import { ProjectMemberRole } from '@prisma/client';
 import { validateUrl, validateOptionalUrl } from '@/lib/validation';
 import { rateLimit } from '@/lib/rate-limit';
+import { notifyProjectOwner } from '@/lib/notifications';

 type RouteParams = { params: Promise<{ projectId: string }> };

@@ -141,6 +142,18 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
            },
        });

+        // Notify project owner (fire-and-forget, skip if they added it themselves)
+        if (project.ownerId !== session.user.id) {
+            const baseUrl = process.env.NEXTAUTH_URL || '';
+            notifyProjectOwner(project.ownerId, {
+                type: 'new_video',
+                projectName: project.name,
+                videoTitle: title.trim(),
+                addedBy: session.user.name || 'A team member',
+                url: `${baseUrl}/watch/${video.id}`,
+            }).catch((err) => console.error('Notification failed:', err));
+        }
+
        return NextResponse.json(video, { status: 201 });
    } catch (error) {
        console.error('Error creating video:', error);
@@ -0,0 +1,220 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+import { auth } from '@/lib/auth';
+import { rateLimit } from '@/lib/rate-limit';
+import nodemailer from 'nodemailer';
+import { testEmailHtml } from '@/lib/notifications';
+
+// GET /api/settings/notifications — Fetch current notification preferences
+export async function GET() {
+    try {
+        const session = await auth();
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        const settings = await db.notificationSetting.findUnique({
+            where: { userId: session.user.id },
+        });
+
+        // Return defaults if no settings exist yet
+        return NextResponse.json(
+            settings ?? {
+                telegramBotToken: null,
+                telegramChatId: null,
+                telegramEnabled: false,
+                emailEnabled: false,
+                onNewVideo: true,
+                onNewComment: true,
+                onNewReply: true,
+                timezone: 'UTC',
+            }
+        );
+    } catch (error) {
+        console.error('Error fetching notification settings:', error);
+        return NextResponse.json(
+            { error: 'Failed to fetch settings' },
+            { status: 500 }
+        );
+    }
+}
+
+// PUT /api/settings/notifications — Update notification preferences
+export async function PUT(request: NextRequest) {
+    try {
+        const limited = await rateLimit(request, 'mutate');
+        if (limited) return limited;
+
+        const session = await auth();
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        const body = await request.json();
+        const {
+            telegramBotToken,
+            telegramChatId,
+            telegramEnabled,
+            emailEnabled,
+            onNewVideo,
+            onNewComment,
+            onNewReply,
+            timezone,
+        } = body;
+
+        // Validate: if enabling Telegram, both token and chatId are required
+        if (telegramEnabled && (!telegramBotToken || !telegramChatId)) {
+            return NextResponse.json(
+                { error: 'Telegram Bot Token and Chat ID are required to enable Telegram notifications' },
+                { status: 400 }
+            );
+        }
+
+        const settings = await db.notificationSetting.upsert({
+            where: { userId: session.user.id },
+            create: {
+                userId: session.user.id,
+                telegramBotToken: telegramBotToken || null,
+                telegramChatId: telegramChatId || null,
+                telegramEnabled: !!telegramEnabled,
+                emailEnabled: !!emailEnabled,
+                onNewVideo: onNewVideo ?? true,
+                onNewComment: onNewComment ?? true,
+                onNewReply: onNewReply ?? true,
+                timezone: timezone || 'UTC',
+            },
+            update: {
+                telegramBotToken: telegramBotToken || null,
+                telegramChatId: telegramChatId || null,
+                telegramEnabled: !!telegramEnabled,
+                emailEnabled: !!emailEnabled,
+                onNewVideo: onNewVideo ?? true,
+                onNewComment: onNewComment ?? true,
+                onNewReply: onNewReply ?? true,
+                timezone: timezone || 'UTC',
+            },
+        });
+
+        return NextResponse.json(settings);
+    } catch (error) {
+        console.error('Error updating notification settings:', error);
+        return NextResponse.json(
+            { error: 'Failed to update settings' },
+            { status: 500 }
+        );
+    }
+}
+
+// POST /api/settings/notifications — Test a notification channel
+export async function POST(request: NextRequest) {
+    try {
+        const limited = await rateLimit(request, 'mutate');
+        if (limited) return limited;
+
+        const session = await auth();
+        if (!session?.user?.id) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+
+        const body = await request.json();
+        const { channel, telegramBotToken, telegramChatId } = body;
+
+        if (channel === 'telegram') {
+            if (!telegramBotToken || !telegramChatId) {
+                return NextResponse.json(
+                    { error: 'Bot Token and Chat ID are required' },
+                    { status: 400 }
+                );
+            }
+
+            const settingsUrl = `${process.env.NEXTAUTH_URL || ''}/settings`;
+            const telegramPayload: Record<string, unknown> = {
+                chat_id: telegramChatId,
+                text: '✅ OpenFrame notifications connected successfully!\n\nYou will receive notifications here when activity happens on your projects.',
+                link_preview_options: { is_disabled: true },
+            };
+            // Telegram inline keyboard buttons require HTTPS URLs
+            if (settingsUrl.startsWith('https://')) {
+                telegramPayload.reply_markup = {
+                    inline_keyboard: [[{ text: 'Open Settings', url: settingsUrl }]],
+                };
+            }
+            const res = await fetch(`https://api.telegram.org/bot${telegramBotToken}/sendMessage`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(telegramPayload),
+            });
+
+            if (!res.ok) {
+                const data = await res.json().catch(() => ({}));
+                const desc = (data as { description?: string }).description || 'Unknown error';
+                return NextResponse.json(
+                    { error: `Telegram test failed: ${desc}` },
+                    { status: 400 }
+                );
+            }
+
+            return NextResponse.json({ success: true, message: 'Test message sent to Telegram' });
+        }
+
+        if (channel === 'email') {
+            const user = await db.user.findUnique({
+                where: { id: session.user.id },
+                select: { email: true },
+            });
+
+            if (!user?.email) {
+                return NextResponse.json(
+                    { error: 'No email address on your account' },
+                    { status: 400 }
+                );
+            }
+
+            const smtpHost = process.env.SMTP_HOST;
+            const smtpPort = Number(process.env.SMTP_PORT || '587');
+            const smtpUser = process.env.SMTP_USER;
+            const smtpPass = process.env.SMTP_PASSWORD;
+
+            if (!smtpHost || !smtpUser || !smtpPass) {
+                return NextResponse.json(
+                    { error: 'Email service not configured (SMTP settings missing)' },
+                    { status: 500 }
+                );
+            }
+
+            const transporter = nodemailer.createTransport({
+                host: smtpHost,
+                port: smtpPort,
+                secure: smtpPort === 465,
+                auth: { user: smtpUser, pass: smtpPass },
+            });
+
+            const fromAddress = process.env.SMTP_FROM || process.env.EMAIL_FROM || 'OpenFrame <[email protected]>';
+
+            try {
+                await transporter.sendMail({
+                    from: fromAddress,
+                    to: user.email,
+                    subject: '[OpenFrame] Test notification',
+                    html: testEmailHtml(),
+                });
+            } catch (emailErr) {
+                console.error('SMTP test email failed:', emailErr);
+                return NextResponse.json(
+                    { error: 'Failed to send test email — check SMTP settings' },
+                    { status: 500 }
+                );
+            }
+
+            return NextResponse.json({ success: true, message: `Test email sent to ${user.email}` });
+        }
+
+        return NextResponse.json({ error: 'Unknown channel' }, { status: 400 });
+    } catch (error) {
+        console.error('Error testing notification:', error);
+        return NextResponse.json(
+            { error: 'Failed to test notification' },
+            { status: 500 }
+        );
+    }
+}
@@ -3,6 +3,7 @@ import { db } from '@/lib/db';
 import { auth } from '@/lib/auth';
 import { validateOptionalUrl } from '@/lib/validation';
 import { rateLimit } from '@/lib/rate-limit';
+import { notifyProjectOwner } from '@/lib/notifications';

 type RouteParams = { params: Promise<{ versionId: string }> };

@@ -184,6 +185,45 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
            },
        });

+        // Notify project owner (fire-and-forget, skip self-notifications)
+        const commentAuthorName = session?.user?.name || guestName || 'Someone';
+        const isOwnProject = session?.user?.id === project.ownerId;
+        if (!isOwnProject) {
+            const baseUrl = process.env.NEXTAUTH_URL || '';
+            const videoTitle = version.video.title || 'Untitled Video';
+            const mins = Math.floor(parseFloat(timestamp) / 60);
+            const secs = Math.floor(parseFloat(timestamp) % 60);
+            const ts = `${mins}:${secs.toString().padStart(2, '0')}`;
+
+            if (parentId) {
+                // It's a reply — look up parent author
+                const parentComment = await db.comment.findUnique({
+                    where: { id: parentId },
+                    include: { author: { select: { name: true } } },
+                });
+                notifyProjectOwner(project.ownerId, {
+                    type: 'new_reply',
+                    projectName: project.name,
+                    videoTitle,
+                    replyAuthor: commentAuthorName,
+                    replyText: content?.trim() || '(voice note)',
+                    parentAuthor: parentComment?.author?.name || parentComment?.guestName || 'Someone',
+                    timestamp: ts,
+                    url: `${baseUrl}/watch/${version.video.id}`,
+                }).catch((err) => console.error('Notification failed:', err));
+            } else {
+                notifyProjectOwner(project.ownerId, {
+                    type: 'new_comment',
+                    projectName: project.name,
+                    videoTitle,
+                    commentAuthor: commentAuthorName,
+                    commentText: content?.trim() || '(voice note)',
+                    timestamp: ts,
+                    url: `${baseUrl}/watch/${version.video.id}`,
+                }).catch((err) => console.error('Notification failed:', err));
+            }
+        }
+
        return NextResponse.json(comment, { status: 201 });
    } catch (error) {
        console.error('Error creating comment:', error);
@@ -53,7 +53,19 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
            return NextResponse.json({ error: 'Access denied' }, { status: 403 });
        }

-        return NextResponse.json(video);
+        // Include auth context so the client knows if the viewer is a guest
+        const { project, ...videoData } = video;
+        return NextResponse.json({
+            ...videoData,
+            projectId: video.projectId,
+            project: {
+                name: project.name,
+                ownerId: project.ownerId,
+                visibility: project.visibility,
+            },
+            isAuthenticated: !!session?.user?.id,
+            canComment: isOwner || isMember || isPublic,
+        });
    } catch (error) {
        console.error('Error fetching video:', error);
        return NextResponse.json(