Harden CMS security and theme contrast

src/actions/admin-shop.ts

@@ -5,6 +5,8 @@ import { redirect } from "next/navigation";
 import { requireStaff } from "@/lib/admin/guard";
 import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";
+import { formPositiveBigInt } from "@/lib/form-data";
+import { logServerError } from "@/lib/server-log";
 
 // Website store packages (website_shop_articles). This CMS-owned table backs
 // the public store; rows here are the buyable packages, not orders. The closest
@@ -68,7 +70,8 @@ export async function createShopArticle(formData: FormData): Promise<void> {
       targetType: "shop_article",
       targetId: Number(created.id),
     });
-  } catch {
+  } catch (error) {
+    logServerError("admin.shop_create_failed", error, { staffId: staff.id, name });
     // Unique constraint on `name` (or DB unavailable) — swallow and re-render.
     return;
   }
@@ -79,14 +82,8 @@ export async function createShopArticle(formData: FormData): Promise<void> {
 export async function updateShopArticle(formData: FormData): Promise<void> {
   const staff = await requireStaff();
 
-  const raw = String(formData.get("id") ?? "").trim();
-  if (!raw) return;
-  let id: bigint;
-  try {
-    id = BigInt(raw);
-  } catch {
-    return;
-  }
+  const id = formPositiveBigInt(formData, "id");
+  if (!id) return;
 
   const name = String(formData.get("name") ?? "")
     .trim()
@@ -127,7 +124,11 @@ export async function updateShopArticle(formData: FormData): Promise<void> {
       targetType: "shop_article",
       targetId: Number(id),
     });
-  } catch {
+  } catch (error) {
+    logServerError("admin.shop_update_failed", error, {
+      staffId: staff.id,
+      articleId: String(id),
+    });
     return;
   }
 
@@ -138,14 +139,8 @@ export async function updateShopArticle(formData: FormData): Promise<void> {
 export async function deleteShopArticle(formData: FormData): Promise<void> {
   const staff = await requireStaff();
 
-  const raw = String(formData.get("id") ?? "").trim();
-  if (!raw) return;
-  let id: bigint;
-  try {
-    id = BigInt(raw);
-  } catch {
-    return;
-  }
+  const id = formPositiveBigInt(formData, "id");
+  if (!id) return;
 
   try {
     await prisma.websiteShopArticles.delete({ where: { id } });
@@ -156,7 +151,11 @@ export async function deleteShopArticle(formData: FormData): Promise<void> {
       targetType: "shop_article",
       targetId: Number(id),
     });
-  } catch {
+  } catch (error) {
+    logServerError("admin.shop_delete_failed", error, {
+      staffId: staff.id,
+      articleId: String(id),
+    });
     return;
   }