feat : 6 astra improve it

app/api/admin/media/[id]/complete/route.ts

@@ -1,29 +1,37 @@
+import { errorResponse, requireSameOrigin, withUploadSlot } from "@/lib/security/http";
+import { limitRequest } from "@/lib/security/rate-limit";
 import * as z from "zod";
 
 import { requireAdmin } from "@/lib/auth/server";
 import { completePendingMedia } from "@/lib/media/repository";
 
 export async function POST(
-  _request: Request,
+  request: Request,
   context: { params: Promise<{ id: string }> },
 ) {
-  await requireAdmin();
-  const { id } = await context.params;
-  if (!z.string().uuid().safeParse(id).success) {
-    return Response.json({ error: "invalid-id" }, { status: 400 });
+  try {
+    requireSameOrigin(request);
+    const admin = await requireAdmin();
+    await limitRequest("media", admin.user.id, 20);
+    const { id } = await context.params;
+    if (!z.string().uuid().safeParse(id).success) {
+      return Response.json({ error: "invalid-id" }, { status: 400 });
+    }
+    const result = await withUploadSlot(() => completePendingMedia(id));
+    if (result.status === "ready") {
+      return Response.json({
+        media: {
+          id: result.media.id,
+          fileName: result.media.fileName,
+          mimeType: result.media.mimeType,
+          byteSize: result.media.byteSize,
+          url: `/media/${result.media.id}`,
+        },
+      });
+    }
+    const status = result.status === "not-found" ? 404 : result.status === "missing" ? 409 : 422;
+    return Response.json({ error: result.status }, { status });
+  } catch (cause) {
+    return errorResponse(cause);
   }
-  const result = await completePendingMedia(id);
-  if (result.status === "ready") {
-    return Response.json({
-      media: {
-        id: result.media.id,
-        fileName: result.media.fileName,
-        mimeType: result.media.mimeType,
-        byteSize: result.media.byteSize,
-        url: `/media/${result.media.id}`,
-      },
-    });
-  }
-  const status = result.status === "not-found" ? 404 : result.status === "missing" ? 409 : 422;
-  return Response.json({ error: result.status }, { status });
 }

app/api/admin/media/[id]/route.ts

@@ -1,19 +1,27 @@
+import { errorResponse, requireSameOrigin } from "@/lib/security/http";
+import { limitRequest } from "@/lib/security/rate-limit";
 import * as z from "zod";
 
 import { requireAdmin } from "@/lib/auth/server";
 import { discardUnreferencedMedia } from "@/lib/media/repository";
 
 export async function DELETE(
-  _request: Request,
+  request: Request,
   context: { params: Promise<{ id: string }> },
 ) {
-  await requireAdmin();
-  const { id } = await context.params;
-  if (!z.string().uuid().safeParse(id).success) {
-    return Response.json({ error: "invalid-id" }, { status: 400 });
+  try {
+    requireSameOrigin(request);
+    const admin = await requireAdmin();
+    await limitRequest("media", admin.user.id, 20);
+    const { id } = await context.params;
+    if (!z.string().uuid().safeParse(id).success) {
+      return Response.json({ error: "invalid-id" }, { status: 400 });
+    }
+    const deleted = await discardUnreferencedMedia(id);
+    return deleted
+      ? new Response(null, { status: 204 })
+      : Response.json({ error: "media-is-referenced-or-missing" }, { status: 409 });
+  } catch (cause) {
+    return errorResponse(cause);
   }
-  const deleted = await discardUnreferencedMedia(id);
-  return deleted
-    ? new Response(null, { status: 204 })
-    : Response.json({ error: "media-is-referenced-or-missing" }, { status: 409 });
 }