twotalesanimation
a834caa511
Deploy Vault CMS / deploy (push) Failing after 38s
Watch progress and unlocking: - Player samples the playhead and reports the ranges actually played, so skipped sections earn no credit and early plays are not lost - Server merges ranges into compact segment rows; progress never regresses - Single 80% unlock rule enforced server-side (lib/watch-progress.ts); the Unlock button and automatic unlock now agree - Lock state and progress bar update live from each progress save - Playlist is derived from the video, so unlocks work for shared playlists and for links from watch history and liked videos - First/previous video decided by playlist position, not index numbers Access control: - Video API and HLS/MP4 routes require a signed-in viewer who is enrolled and has the video unlocked; thumbnails require sign-in - Enrolment sync reads course codes from the allow-list, not the request - /api/admin/meta is admin-only - Account status, role and levels are re-checked from the database during a session, so deactivated students lose access within a minute Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
97 lines
3.0 KiB
TypeScript
97 lines
3.0 KiB
TypeScript
// app/api/user/unlocks/route.ts
|
|
import { NextResponse } from 'next/server';
|
|
import { getServerSession } from 'next-auth';
|
|
import { authOptions } from '@/lib/auth-options';
|
|
import { prisma } from '@/lib/prisma';
|
|
import { checkUnlockEligibility } from '@/lib/watch-progress';
|
|
|
|
export async function GET(req: Request) {
|
|
try {
|
|
const session = await getServerSession(authOptions);
|
|
if (!session?.user?.email)
|
|
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
|
|
|
|
const userEmail = session.user.email;
|
|
|
|
const user = await prisma.user.findUnique({
|
|
where: { email: userEmail },
|
|
select: { id: true },
|
|
});
|
|
|
|
if (!user)
|
|
return NextResponse.json({ error: 'user not found' }, { status: 404 });
|
|
|
|
// Fetch all VideoUnlock records for this user
|
|
const unlocks = await prisma.videoUnlock.findMany({
|
|
where: { userId: user.id },
|
|
select: { id: true, videoId: true, unlockedAt: true, createdAt: true },
|
|
orderBy: { unlockedAt: 'desc' },
|
|
});
|
|
|
|
return NextResponse.json({ unlocks });
|
|
} catch (err: any) {
|
|
console.error('user unlocks GET error', err);
|
|
return NextResponse.json(
|
|
{ error: err?.message ?? 'server error' },
|
|
{ status: 500 }
|
|
);
|
|
}
|
|
}
|
|
|
|
export async function POST(req: Request) {
|
|
try {
|
|
const session = await getServerSession(authOptions);
|
|
if (!session?.user?.email)
|
|
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
|
|
|
|
const userEmail = session.user.email;
|
|
const body = await req.json();
|
|
const { videoId } = body;
|
|
|
|
if (!videoId) {
|
|
return NextResponse.json({ error: 'videoId required' }, { status: 400 });
|
|
}
|
|
|
|
const user = await prisma.user.findUnique({
|
|
where: { email: userEmail },
|
|
select: { id: true },
|
|
});
|
|
|
|
if (!user)
|
|
return NextResponse.json({ error: 'user not found' }, { status: 404 });
|
|
|
|
// Admins can open anything; everyone else must have earned the unlock.
|
|
const role = (session.user as any).role;
|
|
const isAdmin = role === 'admin' || role === 'superadmin';
|
|
if (!isAdmin) {
|
|
const check = await checkUnlockEligibility(user.id, videoId);
|
|
if (!check.ok) {
|
|
return NextResponse.json({ error: check.error }, { status: check.status });
|
|
}
|
|
if (check.free) {
|
|
return NextResponse.json({ message: 'Video does not need unlocking', unlock: null });
|
|
}
|
|
} else {
|
|
const exists = await prisma.video.findUnique({ where: { id: videoId }, select: { id: true } });
|
|
if (!exists) {
|
|
return NextResponse.json({ error: 'video not found' }, { status: 404 });
|
|
}
|
|
}
|
|
|
|
const unlock = await prisma.videoUnlock.upsert({
|
|
where: { userId_videoId: { userId: user.id, videoId } },
|
|
update: {},
|
|
create: { userId: user.id, videoId },
|
|
});
|
|
|
|
return NextResponse.json({ message: 'Video unlocked successfully', unlock });
|
|
|
|
} catch (err: any) {
|
|
console.error('user unlocks POST error', err);
|
|
return NextResponse.json(
|
|
{ error: err?.message ?? 'server error' },
|
|
{ status: 500 }
|
|
);
|
|
}
|
|
}
|