Simo
22d53d0e9c
Security (launch blockers): - src/middleware.ts (edge): forwards x-pathname + real client IP. - access-guard.ts (Node, from root layout): routes non-staff to /maintenance when maintenance mode is on, banned users to /banned. New /banned + /maintenance pages (the consumers the admin toggle was missing). Admin layout enforces force_staff_2fa before /admin. - staff-activity.ts audit log wired into ban/lift/give-currency/set-rank actions. Infra (parallel agents): alert service (alert_logs + Discord embed + email), PayPal top-up (create/capture API routes + /shop/topup), cron worker (scripts/jobs-worker.ts via croner: emulator-ping->alert, maintenance-check, bans-cleanup), social connections page, admin radio settings/banners/ranks. Public radio subsystem: /radio (+schedule, shouts+post, contests, giveaways, apply, leaderboard) and /apply/staff + /apply/team submission forms. Radio nav link added. .env.example documents the new optional vars. (radio song-requests dropped: its table is a stub in AtomCMS — columns added by un-modeled alter-migrations.) Verified: tsc exit 0, vitest 48/48, next build exit 0 (82 page routes).
66 lines
2.0 KiB
TypeScript
66 lines
2.0 KiB
TypeScript
"use server";
|
|
|
|
import { revalidatePath } from "next/cache";
|
|
import { auth } from "@/lib/auth";
|
|
import { prisma } from "@/lib/prisma";
|
|
|
|
// Column bounds from prisma/schema.prisma (radio_applications):
|
|
// real_name VARCHAR(255); the rest are TEXT. age is an INT.
|
|
const NAME_MAX = 255;
|
|
const TEXT_MAX = 5000;
|
|
const STYLE_MAX = 5000;
|
|
|
|
function str(form: FormData, key: string, max: number): string {
|
|
return String(form.get(key) ?? "").trim().slice(0, max);
|
|
}
|
|
|
|
/**
|
|
* Submit a radio DJ application.
|
|
*
|
|
* The applicant (userId) is ALWAYS re-read from the session via auth() and is
|
|
* never taken from the submitted FormData, so a crafted form cannot file an
|
|
* application on behalf of another account. radio_applications.user_id is an
|
|
* UnsignedBigInt, hence the BigInt() coercion.
|
|
*/
|
|
export async function applyDj(formData: FormData): Promise<void> {
|
|
const session = await auth();
|
|
const userId = Number(session?.user?.id);
|
|
if (!Number.isInteger(userId) || userId <= 0) return;
|
|
|
|
const realName = str(formData, "realName", NAME_MAX);
|
|
const availability = str(formData, "availability", TEXT_MAX);
|
|
const motivation = str(formData, "motivation", TEXT_MAX);
|
|
const experience = str(formData, "experience", TEXT_MAX);
|
|
const musicStyle = str(formData, "musicStyle", STYLE_MAX);
|
|
|
|
const ageRaw = Number(formData.get("age"));
|
|
const age = Number.isInteger(ageRaw) ? ageRaw : 0;
|
|
|
|
// Required fields per the schema (NOT NULL): real_name, age, availability,
|
|
// motivation. experience + music_style are nullable.
|
|
if (!realName || !availability || !motivation || age <= 0) return;
|
|
|
|
const now = new Date();
|
|
try {
|
|
await prisma.radioApplications.create({
|
|
data: {
|
|
userId: BigInt(userId),
|
|
realName,
|
|
age,
|
|
availability,
|
|
motivation,
|
|
experience: experience || null,
|
|
musicStyle: musicStyle || null,
|
|
status: "pending",
|
|
createdAt: now,
|
|
updatedAt: now,
|
|
},
|
|
});
|
|
} catch {
|
|
// DB unavailable or duplicate — fail soft; nothing to persist.
|
|
return;
|
|
}
|
|
|
|
revalidatePath("/radio/apply");
|
|
}
|