twotalesanimation
08b6e58b8e
Deploy Vault CMS / deploy (push) Successful in 2m23s
- Upgrade next 16.0.3 -> 16.3.5 and react/react-dom 19.2.0 -> 19.3.0 (CVE-2025-55182 / CVE-2025-66478 unauthenticated RCE), next-auth -> 4.24.15 - Require admin role on /api/users, /api/courses and /api/enrollments, which were unauthenticated - Replace ALLOWED_ADMINS checks that allowed any signed-in user when the variable was empty with the role-based requireAdmin - Sanitize upload filenames, restrict thumbnail extensions, store edited thumbnails in UPLOADS_DIR, tighten traversal checks in file routes - Dockerfile: Node 22, pinned pnpm, non-root user, critical audit gate - Compose: read-only rootfs, dropped caps, no-new-privileges, Postgres password from env - Exclude .env from Docker build context; add security headers - Deploy with git reset --hard instead of git pull - Remove stale package-lock.json Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
35 lines
1.0 KiB
TypeScript
35 lines
1.0 KiB
TypeScript
// app/api/admin/create-playlist/route.ts
|
|
import { NextResponse } from 'next/server';
|
|
import { prisma } from '@/lib/prisma';
|
|
import { requireAdmin } from '@/lib/admin-check';
|
|
|
|
export async function POST(req: Request) {
|
|
try {
|
|
await requireAdmin();
|
|
const { title, courseId, additionalCourseIds } = await req.json();
|
|
if (!title || !courseId) return NextResponse.json({ error: 'missing fields' }, { status: 400 });
|
|
|
|
const playlist = await prisma.playlist.create({
|
|
data: {
|
|
title,
|
|
courseId,
|
|
// Create CoursePlaylist mappings for additional courses
|
|
courses: {
|
|
create: (additionalCourseIds || []).map((cid: string) => ({
|
|
courseId: cid,
|
|
})),
|
|
},
|
|
},
|
|
include: {
|
|
courses: {
|
|
include: { course: true },
|
|
},
|
|
},
|
|
});
|
|
return NextResponse.json({ playlist });
|
|
} catch (err: any) {
|
|
console.error(err);
|
|
return NextResponse.json({ error: err?.message ?? 'server' }, { status: err?.status ?? 500 });
|
|
}
|
|
}
|