Simo
22d53d0e9c
Security (launch blockers): - src/middleware.ts (edge): forwards x-pathname + real client IP. - access-guard.ts (Node, from root layout): routes non-staff to /maintenance when maintenance mode is on, banned users to /banned. New /banned + /maintenance pages (the consumers the admin toggle was missing). Admin layout enforces force_staff_2fa before /admin. - staff-activity.ts audit log wired into ban/lift/give-currency/set-rank actions. Infra (parallel agents): alert service (alert_logs + Discord embed + email), PayPal top-up (create/capture API routes + /shop/topup), cron worker (scripts/jobs-worker.ts via croner: emulator-ping->alert, maintenance-check, bans-cleanup), social connections page, admin radio settings/banners/ranks. Public radio subsystem: /radio (+schedule, shouts+post, contests, giveaways, apply, leaderboard) and /apply/staff + /apply/team submission forms. Radio nav link added. .env.example documents the new optional vars. (radio song-requests dropped: its table is a stub in AtomCMS — columns added by un-modeled alter-migrations.) Verified: tsc exit 0, vitest 48/48, next build exit 0 (82 page routes).
45 lines
1.2 KiB
TypeScript
45 lines
1.2 KiB
TypeScript
"use server";
|
|
|
|
import { revalidatePath } from "next/cache";
|
|
import { auth } from "@/lib/auth";
|
|
import { prisma } from "@/lib/prisma";
|
|
|
|
// radio_shouts.message is TEXT, but cap the write to keep shouts tweet-sized.
|
|
const MESSAGE_MAX = 255;
|
|
|
|
/**
|
|
* Post a radio shout.
|
|
*
|
|
* The AUTHOR (userId) is re-read from the session via auth() and is never
|
|
* trusted from the submitted FormData, so a crafted form cannot impersonate
|
|
* another account. radio_shouts.user_id is an UNSIGNED BIGINT, so the Int
|
|
* session id is widened to BigInt for the insert.
|
|
*/
|
|
export async function postShout(formData: FormData): Promise<void> {
|
|
const session = await auth();
|
|
const userId = Number(session?.user?.id);
|
|
if (!Number.isInteger(userId) || userId <= 0) return;
|
|
|
|
const message = String(formData.get("message") ?? "")
|
|
.trim()
|
|
.slice(0, MESSAGE_MAX);
|
|
if (!message) return;
|
|
|
|
const now = new Date();
|
|
try {
|
|
await prisma.radioShouts.create({
|
|
data: {
|
|
userId: BigInt(userId),
|
|
message,
|
|
createdAt: now,
|
|
updatedAt: now,
|
|
},
|
|
});
|
|
} catch {
|
|
// DB unavailable — fail soft; nothing to persist.
|
|
return;
|
|
}
|
|
|
|
revalidatePath("/radio/shouts");
|
|
}
|