localadministrator/avbeat-com
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

forum: require auth for posting + add login/register/edit pages

Browse Source 
- API: require auth on thread+reply POST (401 if !user); lazy-create
  forum_user_profile via service-role; author_name = display_name
- UI: surface API errors (kill silent catch); auto-redirect to login
  on 401; gate new-thread + reply forms with "Sign in to post" CTA
- /forum/login + /forum/register: forum-themed Supabase Auth pages
  with ?next= redirect support
- /forum/profile/edit + /api/forum/profile/me: edit own forum profile
  (username, display_name, bio, role, company, location, avatar)
- Header: logout button + sign-in/join links when not authed
- forum/user/[username]: show Edit Profile button when viewing own

Fixes posting bug: RLS rejected anon inserts with cryptic message
that the UI silently swallowed; now blocked with friendly 401 + redirect.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ryan Salazar
2026-05-21 22:41:28 +00:00
parent 585a9503ab
commit a8b75593c2
11 changed files with 895 additions and 101 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
src/app/api/forum/threads/route.ts
View File

@@ -1,5 +1,6 @@
import { NextRequest, NextResponse } from 'next/server';
import { createClient } from '@/lib/supabase/server';
import { ensureForumProfile } from '@/lib/forum/profile';
export async function GET(req: NextRequest) {
try {
@@ -59,43 +60,50 @@ export async function POST(req: NextRequest) {
try {
const supabase = await createClient();
const { data: { user } } = await supabase.auth.getUser();
if (!user) {
return NextResponse.json(
{ error: 'You must be signed in to start a thread.', auth_required: true },
{ status: 401 }
);
}
const body = await req.json();
const { category_id, title, body: threadBody, author_name } = body;
const { category_id, title, body: threadBody } = body;
if (!category_id || !title || !threadBody) {
return NextResponse.json({ error: 'category_id, title, and body are required' }, { status: 400 });
}
// Check if authenticated user is suspended or banned
if (user) {
const { data: suspension } = await supabase
.from('user_suspensions')
.select('suspension_type, reason, expires_at')
.eq('user_id', user.id)
.eq('is_active', true)
.or('expires_at.is.null,expires_at.gt.' + new Date().toISOString())
.order('created_at', { ascending: false })
.limit(1)
.maybeSingle();
const { data: suspension } = await supabase
.from('user_suspensions')
.select('suspension_type, reason, expires_at')
.eq('user_id', user.id)
.eq('is_active', true)
.or('expires_at.is.null,expires_at.gt.' + new Date().toISOString())
.order('created_at', { ascending: false })
.limit(1)
.maybeSingle();
if (suspension) {
const isBanned = suspension.suspension_type === 'banned';
const expiryText = suspension.expires_at
? ` until ${new Date(suspension.expires_at).toLocaleDateString('en-US', { month: 'short', day: 'numeric', year: 'numeric' })}`
: '';
return NextResponse.json(
{
error: isBanned
? `Your account has been permanently banned. Reason: ${suspension.reason}`
: `Your account is suspended${expiryText}. Reason: ${suspension.reason}`,
suspended: true,
suspension_type: suspension.suspension_type,
},
{ status: 403 }
);
}
if (suspension) {
const isBanned = suspension.suspension_type === 'banned';
const expiryText = suspension.expires_at
? ` until ${new Date(suspension.expires_at).toLocaleDateString('en-US', { month: 'short', day: 'numeric', year: 'numeric' })}`
: '';
return NextResponse.json(
{
error: isBanned
? `Your account has been permanently banned. Reason: ${suspension.reason}`
: `Your account is suspended${expiryText}. Reason: ${suspension.reason}`,
suspended: true,
suspension_type: suspension.suspension_type,
},
{ status: 403 }
);
}
const forumProfile = await ensureForumProfile(user);
// Fetch category name for better moderation context
const { data: categoryData } = await supabase
.from('forum_categories')
@@ -109,8 +117,8 @@ export async function POST(req: NextRequest) {
category_id,
title: title.trim(),
body: threadBody.trim(),
author_id: user?.id || null,
author_name: author_name?.trim() || (user ? 'Community Member' : 'Anonymous'),
author_id: user.id,
author_name: forumProfile.display_name || forumProfile.username,
is_ai_seeded: false,
})
.select()