feat: shop buy, forum replies, tickets, messages, sessions, and UX hardening

Complete remaining product gaps: credit-based shop purchases, guild thread replies, help ticket detail/reply/close, offline message compose, sign-out-everywhere via JWT version, ads delete confirm, soft-fail feedback, rate limits, loading states, and single auth() in site layout.

Co-authored-by: Cursor <[email protected]>

src/actions/radio-requests.ts

@@ -1,42 +1,80 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
 import { auth } from "@/lib/auth";
 import { prisma } from "@/lib/prisma";
+import { clientIp, rateLimit } from "@/lib/rate-limit";
 
 const SONG_MAX = 255;
 const ARTIST_MAX = 255;
 
+type RequestOutcome =
+	| "posted"
+	| "empty"
+	| "invalid"
+	| "ratelimit"
+	| "error";
+
+function requestsRedirect(outcome: RequestOutcome): never {
+	if (outcome === "posted") redirect("/radio/requests?posted=1");
+	redirect(`/radio/requests?error=${outcome}`);
+}
+
+function isNextRedirect(e: unknown): boolean {
+	return (
+		!!e &&
+		typeof e === "object" &&
+		"digest" in e &&
+		typeof (e as { digest?: unknown }).digest === "string" &&
+		(e as { digest: string }).digest.startsWith("NEXT_REDIRECT")
+	);
+}
+
 export async function submitRequest(formData: FormData): Promise<void> {
-	const session = await auth();
-	const userId = Number(session?.user?.id);
-	if (!Number.isInteger(userId) || userId <= 0) return;
+	let outcome: RequestOutcome = "error";
 
-	const songTitle = String(formData.get("songTitle") ?? "")
-		.normalize("NFC")
-		.trim()
-		.slice(0, SONG_MAX);
-	const artist = String(formData.get("artist") ?? "")
-		.normalize("NFC")
-		.trim()
-		.slice(0, ARTIST_MAX);
-	if (!songTitle && !artist) return;
-
-	const now = new Date();
 	try {
-		await prisma.radioSongRequests.create({
-			data: {
-				userId: BigInt(userId),
-				songTitle: songTitle || null,
-				artist: artist || null,
-				submittedAt: now,
-				createdAt: now,
-				updatedAt: now,
-			},
-		});
-	} catch {
-		return;
+		const session = await auth();
+		const userId = Number(session?.user?.id);
+		if (!Number.isInteger(userId) || userId <= 0) {
+			redirect("/login");
+		}
+
+		await clientIp();
+		if (!(await rateLimit(`radio-req:${userId}`, 5, 30_000)).ok) {
+			outcome = "ratelimit";
+		} else {
+			const songTitle = String(formData.get("songTitle") ?? "")
+				.normalize("NFC")
+				.trim()
+				.slice(0, SONG_MAX);
+			const artist = String(formData.get("artist") ?? "")
+				.normalize("NFC")
+				.trim()
+				.slice(0, ARTIST_MAX);
+			if (!songTitle && !artist) {
+				outcome = "empty";
+			} else {
+				const now = new Date();
+				await prisma.radioSongRequests.create({
+					data: {
+						userId: BigInt(userId),
+						songTitle: songTitle || null,
+						artist: artist || null,
+						submittedAt: now,
+						createdAt: now,
+						updatedAt: now,
+					},
+				});
+				outcome = "posted";
+			}
+		}
+	} catch (e) {
+		if (isNextRedirect(e)) throw e;
+		outcome = "error";
 	}
 
 	revalidatePath("/radio/requests");
+	requestsRedirect(outcome);
 }