twotalesanimation
a834caa511
Deploy Vault CMS / deploy (push) Failing after 38s
Watch progress and unlocking: - Player samples the playhead and reports the ranges actually played, so skipped sections earn no credit and early plays are not lost - Server merges ranges into compact segment rows; progress never regresses - Single 80% unlock rule enforced server-side (lib/watch-progress.ts); the Unlock button and automatic unlock now agree - Lock state and progress bar update live from each progress save - Playlist is derived from the video, so unlocks work for shared playlists and for links from watch history and liked videos - First/previous video decided by playlist position, not index numbers Access control: - Video API and HLS/MP4 routes require a signed-in viewer who is enrolled and has the video unlocked; thumbnails require sign-in - Enrolment sync reads course codes from the allow-list, not the request - /api/admin/meta is admin-only - Account status, role and levels are re-checked from the database during a session, so deactivated students lose access within a minute Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
72 lines
2.5 KiB
TypeScript
72 lines
2.5 KiB
TypeScript
// app/api/playlists/[id]/route.ts
|
|
import { NextResponse } from "next/server";
|
|
import { prisma } from "../../../../lib/prisma";
|
|
import { getServerSession } from "next-auth";
|
|
import { authOptions } from "../../../../lib/auth-options";
|
|
import { filterAccessibleVideos } from "../../../../lib/watch-progress";
|
|
|
|
export async function GET(req: Request, context: any) {
|
|
try {
|
|
// Unwrap params (Next may provide a Promise)
|
|
let params = context?.params;
|
|
if (typeof params?.then === "function") params = await params;
|
|
|
|
const id = params?.id;
|
|
if (!id) return NextResponse.json({ error: "Missing playlist id" }, { status: 400 });
|
|
|
|
const session = await getServerSession(authOptions);
|
|
if (!session?.user?.email) {
|
|
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
|
|
const user = await prisma.user.findUnique({
|
|
where: { email: session.user.email },
|
|
include: { enrollments: { select: { courseId: true } } },
|
|
});
|
|
if (!user) {
|
|
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
|
|
const playlist = await prisma.playlist.findUnique({
|
|
where: { id },
|
|
include: {
|
|
videos: {
|
|
include: {
|
|
uploader: {
|
|
select: {
|
|
id: true,
|
|
name: true,
|
|
image: true,
|
|
},
|
|
},
|
|
videoCourses: { select: { courseId: true, exclusive: true } },
|
|
},
|
|
orderBy: { index: "asc" },
|
|
},
|
|
course: true,
|
|
courses: { select: { courseId: true } },
|
|
},
|
|
});
|
|
|
|
if (!playlist) return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
|
|
// Enrolment in the primary course or any course the playlist is shared with.
|
|
const userCourseIds = user.enrollments.map((e) => e.courseId);
|
|
const playlistCourseIds = [playlist.courseId, ...playlist.courses.map((c) => c.courseId)];
|
|
if (!playlistCourseIds.some((courseId) => userCourseIds.includes(courseId))) {
|
|
return NextResponse.json({ error: "Forbidden" }, { status: 403 });
|
|
}
|
|
|
|
// Hide videos reserved for courses this user is not in, as /api/playlists does.
|
|
const visible = {
|
|
...playlist,
|
|
videos: filterAccessibleVideos(playlist.videos, userCourseIds),
|
|
};
|
|
|
|
return NextResponse.json({ playlist: visible });
|
|
} catch (err: any) {
|
|
console.error("GET /api/playlists/[id] error:", err);
|
|
return NextResponse.json({ error: "Server error" }, { status: 500 });
|
|
}
|
|
}
|