Check session user id before performing action (#391)

app/(chat)/chat/[id]/page.tsx

@@ -23,10 +23,15 @@ export async function generateMetadata({
   }
 
   const chat = await getChat(params.id, session.user.id)
+
+  if (!chat || 'error' in chat) {
+    redirect('/')
+  } else {
     return {
       title: chat?.title.toString().slice(0, 50) ?? 'Chat'
     }
   }
+}
 
 export default async function ChatPage({ params }: ChatPageProps) {
   const session = (await auth()) as Session
@@ -39,10 +44,9 @@ export default async function ChatPage({ params }: ChatPageProps) {
   const userId = session.user.id as string
   const chat = await getChat(params.id, userId)
 
-  if (!chat) {
+  if (!chat || 'error' in chat) {
     redirect('/')
-  }
-
+  } else {
     if (chat?.userId !== session?.user?.id) {
       notFound()
     }
@@ -58,3 +62,4 @@ export default async function ChatPage({ params }: ChatPageProps) {
       </AI>
     )
   }
+}

app/actions.ts

@@ -8,10 +8,18 @@ import { auth } from '@/auth'
 import { type Chat } from '@/lib/types'
 
 export async function getChats(userId?: string | null) {
+  const session = await auth()
+
   if (!userId) {
     return []
   }
 
+  if (userId !== session?.user?.id) {
+    return {
+      error: 'Unauthorized'
+    }
+  }
+
   try {
     const pipeline = kv.pipeline()
     const chats: string[] = await kv.zrange(`user:chat:${userId}`, 0, -1, {
@@ -31,6 +39,14 @@ export async function getChats(userId?: string | null) {
 }
 
 export async function getChat(id: string, userId: string) {
+  const session = await auth()
+
+  if (userId !== session?.user?.id) {
+    return {
+      error: 'Unauthorized'
+    }
+  }
+
   const chat = await kv.hgetall<Chat>(`chat:${id}`)
 
   if (!chat || (userId && chat.userId !== userId)) {

components/sidebar-list.tsx

@@ -2,6 +2,7 @@ import { clearChats, getChats } from '@/app/actions'
 import { ClearHistory } from '@/components/clear-history'
 import { SidebarItems } from '@/components/sidebar-items'
 import { ThemeToggle } from '@/components/theme-toggle'
+import { redirect } from 'next/navigation'
 import { cache } from 'react'
 
 interface SidebarListProps {
@@ -16,6 +17,9 @@ const loadChats = cache(async (userId?: string) => {
 export async function SidebarList({ userId }: SidebarListProps) {
   const chats = await loadChats(userId)
 
+  if (!chats || 'error' in chats) {
+    redirect('/')
+  } else {
     return (
       <div className="flex flex-1 flex-col overflow-hidden">
         <div className="flex-1 overflow-auto">
@@ -36,3 +40,4 @@ export async function SidebarList({ userId }: SidebarListProps) {
       </div>
     )
   }
+}