AyrisAIandClaude Sonnet 5
1b8cfeda95
Security: - requireAdmin() session check added to every admin-only server action (previously relied only on middleware path matching, which Next.js Server Actions don't reliably respect) - Real Prisma + bcrypt admin auth, replacing hardcoded credentials; split into an Edge-safe auth.config.ts (used by proxy.ts) and the full Prisma-backed auth.ts (route handler, server actions, server components) - Removed hardcoded fallback secret on the Instagram sync cron endpoint - Honeypot field + per-IP rate limiting on contact/business-submission forms and the analytics events endpoint Features: - AI trip planner (/plan-olustur, /plan/[id]) backed by DeepSeek, grounded to only recommend isLocalApproved listings, with a deterministic link-injection fallback for anything the model doesn't format as markdown - Interactive Leaflet/OpenStreetMap view on category listing pages - Telegram notifications for new contact messages and business submissions SEO: - Brand-consistent favicon/apple-icon/PWA icons and default Open Graph/ Twitter share images, generated via next/og (replacing default Next.js placeholders) - BreadcrumbList structured data on category and listing detail pages - Fixed two remaining raw <img> tags to use next/image Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
30 lines
1.2 KiB
TypeScript
30 lines
1.2 KiB
TypeScript
import { NextRequest, NextResponse } from 'next/server'
|
|
import createMiddleware from 'next-intl/middleware'
|
|
import NextAuth from 'next-auth'
|
|
import { authConfig } from '@/lib/auth.config'
|
|
import { routing } from '@/i18n/routing'
|
|
|
|
// Edge-safe session read only — the Prisma-backed provider in lib/auth.ts
|
|
// cannot run in the middleware's Edge runtime, so this uses the bare config.
|
|
const { auth } = NextAuth(authConfig)
|
|
const intlMiddleware = createMiddleware(routing)
|
|
|
|
export async function proxy(request: NextRequest) {
|
|
if (request.nextUrl.pathname.includes('/admin')) {
|
|
const session = await auth()
|
|
if (!session || (session.user as any)?.role !== 'ADMIN') {
|
|
return NextResponse.redirect(new URL('/login', request.url))
|
|
}
|
|
}
|
|
request.headers.set('x-pathname', request.nextUrl.pathname)
|
|
return intlMiddleware(request)
|
|
}
|
|
|
|
export const config = {
|
|
// icon / apple-icon are root-level, locale-independent metadata routes
|
|
// (app/icon.tsx, app/apple-icon.tsx) — without this exclusion the intl
|
|
// middleware treats them as un-prefixed pages and redirects them to
|
|
// /tr/icon, which 404s and breaks the favicon/apple-touch-icon.
|
|
matcher: ['/((?!api|_next|_vercel|icon|apple-icon|.*\\..*).*)']
|
|
}
|