openhands
399c047515
- Split approve/dismiss application workflows with distinct audit logs, rate-limited guards and real error logging - Validate article status/date/id input and stop resetting publishedAt on every update - Validate guild updates (state, forum enums, non-empty name) behind rate-limited guard - Fix scheduled-article publishing (ignore NULL dates, set updatedAt, type-safe predicates) - Harden admin search API (LIKE escaping, query cap, per-user rate limit, round-robin result cap) and fix search dialog abort/res.ok/loading races - Lock down HTML sanitizer to an allowlist profile and add XSS tests - Improve mobile nav accessibility (unique id, dialog role, focus management, scroll lock, outside close) - Log swallowed server errors instead of silent catch blocks - Remove dead eslint config, drop unused dompurify deps, restore knip CI step, add Playwright config with smoke spec
57 lines
1.7 KiB
TypeScript
57 lines
1.7 KiB
TypeScript
"use server";
|
|
|
|
import { eq } from "drizzle-orm";
|
|
import { revalidatePath } from "next/cache";
|
|
import { requirePermissionRateLimited } from "@/lib/admin/guard";
|
|
import { db, WebsiteStaffApplications } from "@/lib/db";
|
|
import { formPositiveBigInt } from "@/lib/form-data";
|
|
import { PERMS } from "@/lib/permissions";
|
|
import { logServerError } from "@/lib/server-log";
|
|
import { logStaffActivity } from "@/lib/services/staff-activity";
|
|
|
|
async function removeApplication(id: bigint): Promise<boolean> {
|
|
try {
|
|
await db
|
|
.delete(WebsiteStaffApplications)
|
|
.where(eq(WebsiteStaffApplications.id, id));
|
|
return true;
|
|
} catch (error) {
|
|
logServerError("applications.delete_failed", error, { id: String(id) });
|
|
return false;
|
|
}
|
|
}
|
|
|
|
export async function dismissApplication(formData: FormData): Promise<void> {
|
|
const staff = await requirePermissionRateLimited(PERMS.USERS_EDIT);
|
|
const id = formPositiveBigInt(formData, "id");
|
|
if (!id) return;
|
|
|
|
await removeApplication(id);
|
|
await logStaffActivity({
|
|
staffId: staff.id,
|
|
action: "application_dismiss",
|
|
description: `Dismissed staff application #${id}`,
|
|
targetType: "staff_application",
|
|
targetId: Number(id),
|
|
});
|
|
|
|
revalidatePath("/admin/applications");
|
|
}
|
|
|
|
export async function approveApplication(formData: FormData): Promise<void> {
|
|
const staff = await requirePermissionRateLimited(PERMS.USERS_EDIT);
|
|
const id = formPositiveBigInt(formData, "id");
|
|
if (!id) return;
|
|
|
|
await removeApplication(id);
|
|
await logStaffActivity({
|
|
staffId: staff.id,
|
|
action: "application_approve",
|
|
description: `Approved staff application #${id}`,
|
|
targetType: "staff_application",
|
|
targetId: Number(id),
|
|
});
|
|
|
|
revalidatePath("/admin/applications");
|
|
}
|