feat: public events/polls, friends graph, captcha, SSE hardening, and admin UX

Ship product gaps: register/vote pages, friend add/accept/decline/remove, email verify TTL, captcha on login/forgot, soft-fail user actions, SSE abort/shared client, Commando Centrum error toasts, admin delete for events/polls, and IT/NL i18n fills.

Co-authored-by: Cursor <[email protected]>

src/actions/help-tickets.ts

@@ -1,6 +1,7 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
 import { z } from "zod";
 import { auth } from "@/lib/auth";
 import { prisma } from "@/lib/prisma";
@@ -12,49 +13,89 @@ const ticketSchema = z.object({
 	content: z.string().min(1, "Content is required").max(5000),
 });
 
+type TicketOutcome =
+	| "created"
+	| "invalid"
+	| "moderated"
+	| "ratelimit"
+	| "error";
+
+function ticketsRedirect(outcome: TicketOutcome): never {
+	if (outcome === "created") redirect("/help/tickets?created=1");
+	redirect(`/help/tickets?error=${outcome}`);
+}
+
+function isNextRedirect(e: unknown): boolean {
+	return (
+		!!e &&
+		typeof e === "object" &&
+		"digest" in e &&
+		typeof (e as { digest?: unknown }).digest === "string" &&
+		(e as { digest: string }).digest.startsWith("NEXT_REDIRECT")
+	);
+}
+
 export async function createTicket(formData: FormData): Promise<void> {
-	// Re-read the session user id server-side; never trust a form-supplied id.
-	const session = await auth();
-	const userId = Number(session?.user?.id);
-	if (!Number.isInteger(userId) || userId <= 0) return;
+	let outcome: TicketOutcome = "error";
 
-	await clientIp();
-	if (!(await rateLimit(`ticket:${userId}`, 3, 60_000)).ok) return;
-
-	const raw = {
-		title: String(formData.get("title") ?? "")
-			.normalize("NFC")
-			.trim()
-			.slice(0, 255),
-		content: String(formData.get("content") ?? "")
-			.normalize("NFC")
-			.trim()
-			.slice(0, 5000),
-	};
-
-	const parsed = ticketSchema.safeParse(raw);
-	if (!parsed.success) return;
-
-	const { title, content } = parsed.data;
-
-	// Moderation check
 	try {
-		await moderateOrThrow(`${title} ${content}`);
-	} catch {
-		return;
+		// Re-read the session user id server-side; never trust a form-supplied id.
+		const session = await auth();
+		const userId = Number(session?.user?.id);
+		if (!Number.isInteger(userId) || userId <= 0) {
+			redirect("/login");
+		}
+
+		await clientIp();
+		if (!(await rateLimit(`ticket:${userId}`, 3, 60_000)).ok) {
+			outcome = "ratelimit";
+		} else {
+			const raw = {
+				title: String(formData.get("title") ?? "")
+					.normalize("NFC")
+					.trim()
+					.slice(0, 255),
+				content: String(formData.get("content") ?? "")
+					.normalize("NFC")
+					.trim()
+					.slice(0, 5000),
+			};
+
+			const parsed = ticketSchema.safeParse(raw);
+			if (!parsed.success) {
+				outcome = "invalid";
+			} else {
+				const { title, content } = parsed.data;
+
+				let moderated = false;
+				try {
+					await moderateOrThrow(`${title} ${content}`);
+				} catch {
+					moderated = true;
+					outcome = "moderated";
+				}
+
+				if (!moderated) {
+					const now = new Date();
+					await prisma.websiteHelpCenterTickets.create({
+						data: {
+							userId,
+							title,
+							content,
+							open: true,
+							createdAt: now,
+							updatedAt: now,
+						},
+					});
+					outcome = "created";
+				}
+			}
+		}
+	} catch (e) {
+		if (isNextRedirect(e)) throw e;
+		outcome = "error";
 	}
 
-	const now = new Date();
-	await prisma.websiteHelpCenterTickets.create({
-		data: {
-			userId,
-			title,
-			content,
-			open: true,
-			createdAt: now,
-			updatedAt: now,
-		},
-	});
-
 	revalidatePath("/help/tickets");
+	ticketsRedirect(outcome);
 }