AyrisAIandClaude Sonnet 5
1b8cfeda95
Security: - requireAdmin() session check added to every admin-only server action (previously relied only on middleware path matching, which Next.js Server Actions don't reliably respect) - Real Prisma + bcrypt admin auth, replacing hardcoded credentials; split into an Edge-safe auth.config.ts (used by proxy.ts) and the full Prisma-backed auth.ts (route handler, server actions, server components) - Removed hardcoded fallback secret on the Instagram sync cron endpoint - Honeypot field + per-IP rate limiting on contact/business-submission forms and the analytics events endpoint Features: - AI trip planner (/plan-olustur, /plan/[id]) backed by DeepSeek, grounded to only recommend isLocalApproved listings, with a deterministic link-injection fallback for anything the model doesn't format as markdown - Interactive Leaflet/OpenStreetMap view on category listing pages - Telegram notifications for new contact messages and business submissions SEO: - Brand-consistent favicon/apple-icon/PWA icons and default Open Graph/ Twitter share images, generated via next/og (replacing default Next.js placeholders) - BreadcrumbList structured data on category and listing detail pages - Fixed two remaining raw <img> tags to use next/image Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
33 lines
1.2 KiB
TypeScript
33 lines
1.2 KiB
TypeScript
import { NextRequest, NextResponse } from 'next/server'
|
|
import { mockDb } from '@/lib/mockDb'
|
|
import { checkRateLimit } from '@/lib/rateLimit'
|
|
|
|
export async function POST(req: NextRequest) {
|
|
try {
|
|
const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() || 'unknown'
|
|
if (!checkRateLimit(`events:${ip}`, 30, 60_000)) {
|
|
return NextResponse.json({ error: 'Too many requests' }, { status: 429 })
|
|
}
|
|
|
|
const body = await req.json()
|
|
const { listingId, actionType } = body
|
|
|
|
if (!listingId || !actionType) {
|
|
return NextResponse.json({ error: 'listingId and actionType are required' }, { status: 400 })
|
|
}
|
|
|
|
const validActions = ['views', 'whatsapp', 'phone', 'menu']
|
|
if (!validActions.includes(actionType)) {
|
|
return NextResponse.json({ error: 'Invalid actionType' }, { status: 400 })
|
|
}
|
|
|
|
// Call stateful DB increment
|
|
const record = await mockDb.incrementAnalytics(listingId, actionType)
|
|
|
|
return NextResponse.json({ success: true, record })
|
|
} catch (err: any) {
|
|
console.error('Error logging event analytics:', err)
|
|
return NextResponse.json({ error: err.message || 'Internal Server Error' }, { status: 500 })
|
|
}
|
|
}
|