dmitry.galkin/chatbot-template
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: verify document ownership before appending version (#929)

Browse source
This commit is contained in:
Jeremy 2025-04-13 23:36:41 -07:00 • committed by GitHub
parent 291c6ab2fe
commit c937db3050
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 19 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

30
app/(chat)/api/document/route.ts
View file

@ -1,5 +1,5 @@
import { auth } from '@/app/(auth)/auth';
import { ArtifactKind } from '@/components/artifact';
import type { ArtifactKind } from '@/components/artifact';
import {
deleteDocumentsByIdAfterTimestamp,
getDocumentsById,
@ -45,7 +45,7 @@ export async function POST(request: Request) {
const session = await auth();
if (!session) {
if (!session?.user?.id) {
return new Response('Unauthorized', { status: 401 });
}
@ -56,19 +56,25 @@ export async function POST(request: Request) {
}: { content: string; title: string; kind: ArtifactKind } =
await request.json();
if (session.user?.id) {
const document = await saveDocument({
id,
content,
title,
kind,
userId: session.user.id,
});
const documents = await getDocumentsById({ id: id });
return Response.json(document, { status: 200 });
if (documents.length > 0) {
const [document] = documents;
if (document.userId !== session.user.id) {
return new Response('Forbidden', { status: 403 });
}
}
return new Response('Unauthorized', { status: 401 });
const document = await saveDocument({
id,
content,
title,
kind,
userId: session.user.id,
});
return Response.json(document, { status: 200 });
}
export async function PATCH(request: Request) {

2
package.json
View file

@ -1,6 +1,6 @@
{
"name": "ai-chatbot",
"version": "3.0.0",
"version": "3.0.1",
"private": true,
"scripts": {
"dev": "next dev --turbo",