Harden CMS security and theme contrast

src/app/api/paypal/create/route.ts

@@ -1,8 +1,11 @@
 import { NextResponse } from "next/server";
 import { auth } from "@/lib/auth";
+import { sessionUserId } from "@/lib/auth/session-user";
+import { prisma } from "@/lib/prisma";
 import { createOrder, creditsPerUnit, isPayPalConfigured, PAYPAL_CURRENCY } from "@/lib/services/paypal";
 import { env } from "@/env";
 import { logger } from "@/lib/logger";
+import { recordCreatedTopup } from "@/lib/services/paypal-topup";
 
 export const dynamic = "force-dynamic";
 
@@ -21,6 +24,10 @@ export async function POST(req: Request): Promise<Response> {
   if (!session?.user?.id) {
     return NextResponse.json({ error: "You must be signed in to top up." }, { status: 401 });
   }
+  const userId = sessionUserId(session.user.id);
+  if (!userId) {
+    return NextResponse.json({ error: "Invalid session." }, { status: 401 });
+  }
 
   // Fail fast (and clearly) when the sandbox/live keys aren't set.
   if (!isPayPalConfigured()) {
@@ -63,6 +70,11 @@ export async function POST(req: Request): Promise<Response> {
       );
     }
 
+    await recordCreatedTopup(
+      { userId, orderId: order.id, amount, currency: PAYPAL_CURRENCY, credits },
+      (data) => prisma.websitePaypalTransactions.create({ data }),
+    );
+
     return NextResponse.json({
       id: order.id,
       approveUrl: order.approveUrl,