Files
EpicNext-Cms/src/actions/admin-housekeeping.ts
T
openhands e5ae51bff7
Local Build and Deploy / deploy (push) Successful in 59s
Add NFC normalization to all FormData inputs across 41 server actions
All user-supplied string values from FormData now go through
String.prototype.normalize('NFC') to prevent Unicode homoglyph
attacks and canonicalization bypasses. NFC is idempotent for
already-normalized strings, so this is a pure security improvement
with zero behavioral change for legitimate users.
2026-07-13 12:21:37 +02:00

52 lines
1.5 KiB
TypeScript

"use server";
import { revalidatePath } from "next/cache";
import { requireStaff } from "@/lib/admin/guard";
import { prisma } from "@/lib/prisma";
/**
* Create or update a housekeeping permission (keyed by the unique `permission`
* string). Mirrors AtomCMS' housekeeping permission management.
*/
export async function upsertPermission(formData: FormData): Promise<void> {
await requireStaff();
const permission = String(formData.get("permission") ?? "").normalize("NFC")
.trim()
.slice(0, 255);
const minRank = Number(formData.get("minRank"));
const descriptionRaw = String(formData.get("description") ?? "").normalize("NFC")
.trim()
.slice(0, 255);
const description = descriptionRaw.length > 0 ? descriptionRaw : null;
if (!permission || !Number.isFinite(minRank) || minRank < 0) return;
try {
await prisma.websiteHousekeepingPermissions.upsert({
where: { permission },
update: { minRank, description },
create: { permission, minRank, description },
});
} catch {
// Swallow: duplicate/constraint issues shouldn't crash the action.
}
revalidatePath("/admin/housekeeping");
}
export async function deletePermission(formData: FormData): Promise<void> {
await requireStaff();
const raw = String(formData.get("id") ?? "").normalize("NFC");
if (!raw) return;
try {
await prisma.websiteHousekeepingPermissions.delete({ where: { id: BigInt(raw) } });
} catch {
// Already gone / invalid id.
}
revalidatePath("/admin/housekeeping");
}