Harden catalog writes: bulk import batch + field allowlists.

Bulk import resolves names from items_base and refreshes RCON once. Page/item updates only accept an allowlisted field set.

Co-authored-by: Cursor <[email protected]>

src/actions/catalog.ts

@@ -9,12 +9,52 @@ import { deletePage, movePage } from "@/lib/services/catalog-tree";
 import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
+const CATALOG_PAGE_FIELDS = [
+	"caption",
+	"parentId",
+	"pageLayout",
+	"enabled",
+	"visible",
+	"minRank",
+	"clubOnly",
+	"vipOnly",
+	"orderNum",
+	"iconImage",
+	"iconColor",
+	"pageHeadline",
+	"pageTeaser",
+	"pageSpecial",
+	"pageText1",
+	"pageText2",
+	"pageTextDetails",
+	"pageTextTeaser",
+	"includes",
+	"captionSave",
+] as const;
+
+function pickPageFields(fields: Record<string, unknown>) {
+	const out: Record<string, unknown> = {};
+	for (const key of CATALOG_PAGE_FIELDS) {
+		if (Object.hasOwn(fields, key) && fields[key] !== undefined) {
+			out[key] = fields[key];
+		}
+	}
+	return out;
+}
+
 export async function updateCatalogPage({
 	id,
 	...fields
 }: { id: number } & Record<string, unknown>): Promise<ActionResult> {
 	const staff = await requirePermission(PERMS.CATALOG_EDIT);
-	await prisma.catalogPages.update({ where: { id }, data: fields as any });
+	const data = pickPageFields(fields);
+	if (Object.keys(data).length === 0) {
+		return { ok: false as const, error: "No valid fields to update" };
+	}
+	if (typeof data.caption === "string" && !data.captionSave) {
+		data.captionSave = data.caption.slice(0, 25);
+	}
+	await prisma.catalogPages.update({ where: { id }, data: data as any });
 	await rcon.updateCatalog();
 	await logStaffActivity({
 		staffId: staff.id,