dmitry.galkin/chatbot-template
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: check chat/vote ownership during actions (#847)

Browse source
This commit is contained in:
Jeremy 2025-03-05 10:03:17 -08:00 • committed by GitHub
parent c58fd528fc
commit a378757d3b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 28 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
app/(chat)/api/chat/route.ts
View file

@ -58,7 +58,12 @@ export async function POST(request: Request) {
const title = await generateTitleFromUserMessage({
message: userMessage,
});
await saveChat({ id, userId: session.user.id, title });
} else {
if (chat.userId !== session.user.id) {
return new Response('Unauthorized', { status: 401 });
}
}
await saveMessages({

1
app/(chat)/api/document/route.ts
View file

@ -67,6 +67,7 @@ export async function POST(request: Request) {
return Response.json(document, { status: 200 });
}
return new Response('Unauthorized', { status: 401 });
}

22
app/(chat)/api/vote/route.ts
View file

@ -1,5 +1,5 @@
import { auth } from '@/app/(auth)/auth';
import { getVotesByChatId, voteMessage } from '@/lib/db/queries';
import { getChatById, getVotesByChatId, voteMessage } from '@/lib/db/queries';
export async function GET(request: Request) {
const { searchParams } = new URL(request.url);
@ -15,6 +15,16 @@ export async function GET(request: Request) {
return new Response('Unauthorized', { status: 401 });
}
const chat = await getChatById({ id: chatId });
if (!chat) {
return new Response('Chat not found', { status: 404 });
}
if (chat.userId !== session.user.id) {
return new Response('Unauthorized', { status: 401 });
}
const votes = await getVotesByChatId({ id: chatId });
return Response.json(votes, { status: 200 });
@ -38,6 +48,16 @@ export async function PATCH(request: Request) {
return new Response('Unauthorized', { status: 401 });
}
const chat = await getChatById({ id: chatId });
if (!chat) {
return new Response('Chat not found', { status: 404 });
}
if (chat.userId !== session.user.id) {
return new Response('Unauthorized', { status: 401 });
}
await voteMessage({
chatId,
messageId,