Harden form auth and submission handling

app/api/auth/[...nextauth]/route.ts

@@ -3,6 +3,7 @@ import DiscordProvider from "next-auth/providers/discord";
 import { DrizzleAdapter } from "@auth/drizzle-adapter";
 import { db } from "@/db";
 import { accounts, sessions, users, verificationTokens } from "@/db/schema";
+import type { SessionWithDiscord } from "@/lib/auth";
 
 const discordIdCache = new Map<string, string>();
 
@@ -22,7 +23,7 @@ export const authOptions: NextAuthOptions = {
   callbacks: {
     async session({ session, user }) {
       if (session.user) {
-        (session.user as any).id = user.id;
+        (session as SessionWithDiscord).user!.id = user.id;
 
         let discordId = discordIdCache.get(user.id);
         if (!discordId) {
@@ -37,7 +38,7 @@ export const authOptions: NextAuthOptions = {
           }
         }
         if (discordId) {
-          (session.user as typeof session.user & { discordId: string }).discordId = discordId;
+          (session as SessionWithDiscord).user!.discordId = discordId;
         }
       }
       return session;

app/api/upload/route.ts

@@ -1,18 +1,13 @@
 import { NextResponse } from "next/server";
-import { getServerSession } from "next-auth";
-import { authOptions } from "@/app/api/auth/[...nextauth]/route";
+import { requireAdmin } from "@/lib/auth";
+
+const MAX_UPLOAD_BYTES = 1024 * 1024;
 
 export async function POST(req: Request) {
   try {
-    const session = await getServerSession(authOptions);
-    const adminIds = (process.env.ADMIN_DISCORD_IDS ?? "")
-      .split(",")
-      .map((s) => s.trim())
-      .filter(Boolean);
-    const discordId = (session?.user as { discordId?: string } | undefined)
-      ?.discordId;
-    
-    if (!discordId || !adminIds.includes(discordId)) {
+    try {
+      await requireAdmin();
+    } catch {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }
 
@@ -27,6 +22,10 @@ export async function POST(req: Request) {
       return NextResponse.json({ error: "Only image files are allowed" }, { status: 400 });
     }
 
+    if (file.size > MAX_UPLOAD_BYTES) {
+      return NextResponse.json({ error: "Image must be 1MB or smaller" }, { status: 400 });
+    }
+
     const allowedExtensions = ["png", "jpg", "jpeg", "webp", "gif"];
     const originalExt = (file.name.split(".").pop() || "").toLowerCase();
 
@@ -40,8 +39,9 @@ export async function POST(req: Request) {
     const dataUri = `data:${mimeType};base64,${base64}`;
 
     return NextResponse.json({ url: dataUri });
-  } catch (error: any) {
+  } catch (error) {
     console.error("Upload error:", error);
-    return NextResponse.json({ error: error.message || "Internal server error" }, { status: 500 });
+    const message = error instanceof Error ? error.message : "Internal server error";
+    return NextResponse.json({ error: message }, { status: 500 });
   }
 }