mirror of
https://github.com/yusufipk/OpenFrame.git
synced 2026-09-11 17:46:06 +00:00
yusufipek
d981d98cf5
Subtitle tracks hang off a version rather than off a video, because re-editing a cut shifts every cue. The file always lands in our own S3-compatible storage whatever hosts the video, so a Bunny-hosted cut and an R2 one take the same path: both already play through our own video element, so a track element is all it takes. Uploads are normalised before they are stored. Whatever arrives, SRT or WebVTT, is parsed into cues and re-serialised as a canonical WebVTT file, and anything we did not understand is dropped rather than passed through. That is what makes it safe to serve a user-supplied text file from our own origin. Files saved out of Windows editors are decoded as windows-1254 or windows-1252 when they are not valid UTF-8, rather than refused. A YouTube version cannot carry an uploaded track, so the same CC menu drives YouTube's own captions through the iframe module API. The embed hides YouTube's controls, so until now those captions were unreachable even when the video had them. Uploading and deleting take the editor permission rather than the commenter one: a subtitle is part of the delivered cut, not a comment attachment.
49 lines
2.1 KiB
TypeScript
49 lines
2.1 KiB
TypeScript
import { NextRequest } from 'next/server';
|
|
import { DeleteObjectCommand } from '@aws-sdk/client-s3';
|
|
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
|
|
import { db } from '@/lib/db';
|
|
import { logError } from '@/lib/logger';
|
|
import { r2Client, R2_BUCKET_NAME } from '@/lib/r2';
|
|
import { rateLimit } from '@/lib/rate-limit';
|
|
import { subtitleProxyPathToObjectKey } from '@/lib/subtitle-validation';
|
|
import { getVideoAssetAccessContext } from '@/lib/video-assets';
|
|
|
|
type RouteParams = { params: Promise<{ videoId: string; subtitleId: string }> };
|
|
|
|
// DELETE /api/videos/[videoId]/subtitles/[subtitleId]
|
|
export async function DELETE(request: NextRequest, { params }: RouteParams) {
|
|
try {
|
|
const limited = await rateLimit(request, 'subtitle-delete');
|
|
if (limited) return limited;
|
|
|
|
const { videoId, subtitleId } = await params;
|
|
const context = await getVideoAssetAccessContext(request, videoId, 'VIEW');
|
|
if (!context) return apiErrors.notFound('Video');
|
|
if (!context.viewerUserId || !context.canManageAssets) {
|
|
return apiErrors.forbidden('Access denied');
|
|
}
|
|
|
|
const subtitle = await db.videoSubtitle.findFirst({
|
|
where: { id: subtitleId, version: { videoParentId: videoId } },
|
|
select: { id: true, sourceUrl: true },
|
|
});
|
|
if (!subtitle) return apiErrors.notFound('Subtitle');
|
|
|
|
// Storage first, row second, for the same reason video deletion does it in that
|
|
// order: a refused delete leaves the row in place so the operation can be retried,
|
|
// rather than orphaning an object nothing points at any more.
|
|
const objectKey = subtitleProxyPathToObjectKey(subtitle.sourceUrl);
|
|
if (objectKey) {
|
|
await r2Client.send(new DeleteObjectCommand({ Bucket: R2_BUCKET_NAME, Key: objectKey }));
|
|
}
|
|
|
|
await db.videoSubtitle.delete({ where: { id: subtitle.id } });
|
|
|
|
const response = successResponse({ id: subtitle.id, deleted: true });
|
|
return withCacheControl(response, 'private, no-store');
|
|
} catch (error) {
|
|
logError('Error deleting subtitle:', error);
|
|
return apiErrors.internalError('Failed to delete subtitle');
|
|
}
|
|
}
|