admins
444b9c0faf
- Rename proxy.ts → middleware.ts, export proxy() → middleware() so Next.js edge protection actually activates (F001) - Add PUBLIC_ROUTES entries for /forgot-password and /reset-password - Wrap getSettings() in React.cache() to eliminate duplicate DB call in root layout (F003) - Remove 4 console.log calls from saveLesson Server Action, keep console.error (F005) - Add 50 MB file size guard to all 6 upload routes before arrayBuffer() read (F004) - Remove unused deps: @tailwindcss/typography, shadcn, tw-animate-css (F008) - Update CLAUDE.md: Prisma version 6.x → 7.x - Add TECH_DEBT_AUDIT.md with 14 findings across 9 dimensions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
27 lines
1.1 KiB
TypeScript
27 lines
1.1 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { headers } from "next/headers";
|
|
import { auth } from "@/lib/auth";
|
|
import { uploadFile } from "@/lib/s3";
|
|
import { randomUUID } from "crypto";
|
|
|
|
export async function POST(req: NextRequest) {
|
|
const session = await auth.api.getSession({ headers: await headers() });
|
|
if (!session || (session.user.role !== "curator" && session.user.role !== "admin")) {
|
|
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
|
|
const form = await req.formData();
|
|
const file = form.get("file") as File | null;
|
|
if (!file) return NextResponse.json({ error: "Missing file" }, { status: 400 });
|
|
|
|
const MAX_BYTES = 50 * 1024 * 1024;
|
|
if (file.size > MAX_BYTES) return NextResponse.json({ error: "Файл слишком большой" }, { status: 413 });
|
|
|
|
const ext = file.name.split(".").pop() ?? "bin";
|
|
const key = `feedback/${session.user.id}/${randomUUID()}.${ext}`;
|
|
const buffer = Buffer.from(await file.arrayBuffer());
|
|
const url = await uploadFile(key, buffer, file.type);
|
|
|
|
return NextResponse.json({ name: file.name, url, size: file.size });
|
|
}
|