feat: shop buy, forum replies, tickets, messages, sessions, and UX hardening

Complete remaining product gaps: credit-based shop purchases, guild thread replies, help ticket detail/reply/close, offline message compose, sign-out-everywhere via JWT version, ads delete confirm, soft-fail feedback, rate limits, loading states, and single auth() in site layout.

Co-authored-by: Cursor <[email protected]>

src/actions/radio-apply.ts

@@ -1,8 +1,10 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
 import { auth } from "@/lib/auth";
 import { prisma } from "@/lib/prisma";
+import { clientIp, rateLimit } from "@/lib/rate-limit";
 
 // Column bounds from prisma/schema.prisma (radio_applications):
 //   real_name VARCHAR(255); the rest are TEXT. age is an INT.
@@ -10,6 +12,27 @@ const NAME_MAX = 255;
 const TEXT_MAX = 5000;
 const STYLE_MAX = 5000;
 
+type ApplyOutcome =
+	| "submitted"
+	| "invalid"
+	| "ratelimit"
+	| "error";
+
+function applyRedirect(outcome: ApplyOutcome): never {
+	if (outcome === "submitted") redirect("/radio/apply?submitted=1");
+	redirect(`/radio/apply?error=${outcome}`);
+}
+
+function isNextRedirect(e: unknown): boolean {
+	return (
+		!!e &&
+		typeof e === "object" &&
+		"digest" in e &&
+		typeof (e as { digest?: unknown }).digest === "string" &&
+		(e as { digest: string }).digest.startsWith("NEXT_REDIRECT")
+	);
+}
+
 function str(form: FormData, key: string, max: number): string {
 	return String(form.get(key) ?? "")
 		.normalize("NFC")
@@ -19,50 +42,56 @@ function str(form: FormData, key: string, max: number): string {
 
 /**
  * Submit a radio DJ application.
- *
- * The applicant (userId) is ALWAYS re-read from the session via auth() and is
- * never taken from the submitted FormData, so a crafted form cannot file an
- * application on behalf of another account. radio_applications.user_id is an
- * UnsignedBigInt, hence the BigInt() coercion.
  */
 export async function applyDj(formData: FormData): Promise<void> {
-	const session = await auth();
-	const userId = Number(session?.user?.id);
-	if (!Number.isInteger(userId) || userId <= 0) return;
+	let outcome: ApplyOutcome = "error";
 
-	const realName = str(formData, "realName", NAME_MAX);
-	const availability = str(formData, "availability", TEXT_MAX);
-	const motivation = str(formData, "motivation", TEXT_MAX);
-	const experience = str(formData, "experience", TEXT_MAX);
-	const musicStyle = str(formData, "musicStyle", STYLE_MAX);
-
-	const ageRaw = Number(formData.get("age"));
-	const age = Number.isInteger(ageRaw) ? ageRaw : 0;
-
-	// Required fields per the schema (NOT NULL): real_name, age, availability,
-	// motivation. experience + music_style are nullable.
-	if (!realName || !availability || !motivation || age <= 0) return;
-
-	const now = new Date();
 	try {
-		await prisma.radioApplications.create({
-			data: {
-				userId: BigInt(userId),
-				realName,
-				age,
-				availability,
-				motivation,
-				experience: experience || null,
-				musicStyle: musicStyle || null,
-				status: "pending",
-				createdAt: now,
-				updatedAt: now,
-			},
-		});
-	} catch {
-		// DB unavailable or duplicate — fail soft; nothing to persist.
-		return;
+		const session = await auth();
+		const userId = Number(session?.user?.id);
+		if (!Number.isInteger(userId) || userId <= 0) {
+			redirect("/login");
+		}
+
+		await clientIp();
+		if (!(await rateLimit(`radio-apply:${userId}`, 2, 300_000)).ok) {
+			outcome = "ratelimit";
+		} else {
+			const realName = str(formData, "realName", NAME_MAX);
+			const availability = str(formData, "availability", TEXT_MAX);
+			const motivation = str(formData, "motivation", TEXT_MAX);
+			const experience = str(formData, "experience", TEXT_MAX);
+			const musicStyle = str(formData, "musicStyle", STYLE_MAX);
+
+			const ageRaw = Number(formData.get("age"));
+			const age = Number.isInteger(ageRaw) ? ageRaw : 0;
+
+			if (!realName || !availability || !motivation || age <= 0) {
+				outcome = "invalid";
+			} else {
+				const now = new Date();
+				await prisma.radioApplications.create({
+					data: {
+						userId: BigInt(userId),
+						realName,
+						age,
+						availability,
+						motivation,
+						experience: experience || null,
+						musicStyle: musicStyle || null,
+						status: "pending",
+						createdAt: now,
+						updatedAt: now,
+					},
+				});
+				outcome = "submitted";
+			}
+		}
+	} catch (e) {
+		if (isNextRedirect(e)) throw e;
+		outcome = "error";
 	}
 
 	revalidatePath("/radio/apply");
+	applyRedirect(outcome);
 }