feat : 6 astra improve it

app/api/presence/admin/route.ts

@@ -1,7 +1,9 @@
+import { errorResponse, readJson, requireSameOrigin } from "@/lib/security/http";
+import { limitRequest } from "@/lib/security/rate-limit";
 import { connection } from "next/server";
 import * as z from "zod";
 
-import { AdminAuthorizationError, requireAdmin } from "@/lib/auth/server";
+import { requireAdmin } from "@/lib/auth/server";
 import { updateAdminPresence } from "@/lib/presence";
 
 const inputSchema = z.strictObject({
@@ -14,8 +16,10 @@ const inputSchema = z.strictObject({
 export async function POST(request: Request) {
   await connection();
   try {
+    requireSameOrigin(request);
     const admin = await requireAdmin();
-    const parsed = inputSchema.safeParse(await request.json().catch(() => null));
+    await limitRequest("admin-presence", admin.session.id, 120);
+    const parsed = inputSchema.safeParse(await readJson(request, 2048));
     if (!parsed.success) return Response.json({ error: "invalid-presence" }, { status: 400 });
     return Response.json(await updateAdminPresence({
       ...parsed.data,
@@ -23,12 +27,6 @@ export async function POST(request: Request) {
       user: admin.user,
     }), { headers: { "Cache-Control": "no-store" } });
   } catch (cause) {
-    if (cause instanceof AdminAuthorizationError) {
-      return Response.json({ error: "unauthorized" }, { status: 401 });
-    }
-    return Response.json({ error: "presence-unavailable" }, {
-      status: 503,
-      headers: { "Cache-Control": "no-store" },
-    });
+    return errorResponse(cause);
   }
 }

app/api/presence/visitors/route.ts

@@ -1,3 +1,5 @@
+import { errorResponse, readJson, requireSameOrigin } from "@/lib/security/http";
+import { limitRequest, trustedClientAddress } from "@/lib/security/rate-limit";
 import { connection } from "next/server";
 import * as z from "zod";
 
@@ -11,16 +13,15 @@ const inputSchema = z.strictObject({
 
 export async function POST(request: Request) {
   await connection();
-  const parsed = inputSchema.safeParse(await request.json().catch(() => null));
-  if (!parsed.success) return Response.json({ error: "invalid-presence" }, { status: 400 });
   try {
+    requireSameOrigin(request);
+    await limitRequest("presence", trustedClientAddress(request.headers), 600);
+    const parsed = inputSchema.safeParse(await readJson(request, 1024));
+    if (!parsed.success) return Response.json({ error: "invalid-presence" }, { status: 400 });
     return Response.json(await updateVisitorPresence(parsed.data), {
       headers: { "Cache-Control": "no-store" },
     });
-  } catch {
-    return Response.json({ error: "presence-unavailable" }, {
-      status: 503,
-      headers: { "Cache-Control": "no-store" },
-    });
+  } catch (cause) {
+    return errorResponse(cause);
   }
 }