Harden catalog writes: bulk import batch + field allowlists.

Bulk import resolves names from items_base and refreshes RCON once. Page/item updates only accept an allowlisted field set.

Co-authored-by: Cursor <[email protected]>

src/actions/catalog-bc.ts

@@ -7,12 +7,55 @@ import { prisma } from "@/lib/prisma";
 import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
+const BC_PAGE_FIELDS = [
+	"caption",
+	"parentId",
+	"pageLayout",
+	"enabled",
+	"visible",
+	"orderNum",
+	"iconImage",
+	"iconColor",
+	"pageHeadline",
+	"pageTeaser",
+	"pageSpecial",
+	"pageText1",
+	"pageText2",
+	"pageTextDetails",
+	"pageTextTeaser",
+] as const;
+
+const BC_ITEM_FIELDS = [
+	"itemIds",
+	"catalogName",
+	"orderNumber",
+	"extradata",
+	"pageId",
+] as const;
+
+function pickAllowed(
+	fields: Record<string, unknown>,
+	allowed: readonly string[],
+) {
+	const out: Record<string, unknown> = {};
+	for (const key of allowed) {
+		if (Object.hasOwn(fields, key) && fields[key] !== undefined) {
+			out[key] = fields[key];
+		}
+	}
+	return out;
+}
+
 export async function updateBcPage({
 	id,
 	...fields
 }: { id: number } & Record<string, unknown>) {
 	const staff = await requirePermission(PERMS.CATALOG_EDIT);
-	await prisma.catalogPagesBc.update({ where: { id }, data: fields as any });
+	const data = pickAllowed(fields, BC_PAGE_FIELDS);
+	if (Object.keys(data).length === 0) {
+		return { ok: false as const, error: "No valid fields to update" };
+	}
+	await prisma.catalogPagesBc.update({ where: { id }, data: data as any });
 	await rcon.updateCatalog();
 	await logStaffActivity({
 		staffId: staff.id,
@@ -51,7 +94,11 @@ export async function updateBcItem({
 	extradata?: string;
 }) {
 	const staff = await requirePermission(PERMS.CATALOG_EDIT);
-	await prisma.catalogItemsBc.update({ where: { id }, data: data as any });
+	const safe = pickAllowed(data as Record<string, unknown>, BC_ITEM_FIELDS);
+	if (Object.keys(safe).length === 0) {
+		return { ok: false as const, error: "No valid fields to update" };
+	}
+	await prisma.catalogItemsBc.update({ where: { id }, data: safe as any });
 	await rcon.updateCatalog();
 	await logStaffActivity({
 		staffId: staff.id,

src/actions/catalog.ts

@@ -9,12 +9,52 @@ import { deletePage, movePage } from "@/lib/services/catalog-tree";
 import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
+const CATALOG_PAGE_FIELDS = [
+	"caption",
+	"parentId",
+	"pageLayout",
+	"enabled",
+	"visible",
+	"minRank",
+	"clubOnly",
+	"vipOnly",
+	"orderNum",
+	"iconImage",
+	"iconColor",
+	"pageHeadline",
+	"pageTeaser",
+	"pageSpecial",
+	"pageText1",
+	"pageText2",
+	"pageTextDetails",
+	"pageTextTeaser",
+	"includes",
+	"captionSave",
+] as const;
+
+function pickPageFields(fields: Record<string, unknown>) {
+	const out: Record<string, unknown> = {};
+	for (const key of CATALOG_PAGE_FIELDS) {
+		if (Object.hasOwn(fields, key) && fields[key] !== undefined) {
+			out[key] = fields[key];
+		}
+	}
+	return out;
+}
+
 export async function updateCatalogPage({
 	id,
 	...fields
 }: { id: number } & Record<string, unknown>): Promise<ActionResult> {
 	const staff = await requirePermission(PERMS.CATALOG_EDIT);
-	await prisma.catalogPages.update({ where: { id }, data: fields as any });
+	const data = pickPageFields(fields);
+	if (Object.keys(data).length === 0) {
+		return { ok: false as const, error: "No valid fields to update" };
+	}
+	if (typeof data.caption === "string" && !data.captionSave) {
+		data.captionSave = data.caption.slice(0, 25);
+	}
+	await prisma.catalogPages.update({ where: { id }, data: data as any });
 	await rcon.updateCatalog();
 	await logStaffActivity({
 		staffId: staff.id,

src/components/admin/catalog/bulk-import-items.tsx

@@ -3,7 +3,7 @@
 import { AlertTriangle, CheckCircle2, Loader2, Upload } from "lucide-react";
 import { useMemo, useState } from "react";
 import { toast } from "sonner";
-import { createCatalogItem } from "@/actions/catalog-items";
+import { bulkCreateCatalogItems } from "@/actions/catalog-items";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import {
@@ -91,43 +91,39 @@ export function BulkImportItems({ pageId, onImported }: BulkImportItemsProps) {
 			return;
 		}
 		setImporting(true);
-		let success = 0;
-		let failed = 0;
-		for (const row of valid) {
 		try {
-				const res = await createCatalogItem({
+			const res = await bulkCreateCatalogItems({
 				pageId,
-					itemIds: String(row.baseId!),
+				rows: valid.map((row) => ({
-					catalogName: "",
+					baseId: row.baseId!,
-					costCredits: row.credits ?? 0,
+					credits: row.credits,
-					costPoints: row.points ?? 0,
+					points: row.points,
-					pointsType: row.pointsType ?? 0,
+					pointsType: row.pointsType,
-					amount: 1,
+				})),
-					limitedSells: 0,
-					limitedStack: 0,
-					orderNumber: 1,
-					offerId: -1,
-					songId: 0,
-					haveOffer: "1",
-					clubOnly: "0",
-					extradata: "",
 			});
-				if (res.ok) success++;
+			if (!res.ok) {
-				else failed++;
+				toast.error(res.error || "Bulk import failed.");
-			} catch {
+				return;
-				failed++;
 			}
-		}
+			const { created, failed } = res.data;
-		setImporting(false);
+			if (created > 0) {
-		if (success > 0) {
 				toast.success(
-				`Imported ${success} item(s)${failed > 0 ? `, ${failed} failed` : ""}.`,
+					`Imported ${created} item(s)${failed > 0 ? `, ${failed} failed` : ""}.`,
 				);
 				setInput("");
 				setOpen(false);
 				onImported?.();
 			} else {
-			toast.error(`All ${failed} imports failed.`);
+				toast.error(
+					failed > 0
+						? `All ${failed} imports failed (unknown base IDs?).`
+						: "Nothing imported.",
+				);
+			}
+		} catch {
+			toast.error("Bulk import failed.");
+		} finally {
+			setImporting(false);
 		}
 	}