Inna
239392b876
- lib/forum-sanitize.ts: cleanPostHtml con sanitize-html (misma allowlist que forum/sanitize.py de nh3: formato básico + a/img/tablas, rel nofollow, esquemas http/https/mailto). Verificado XSS-safe (script/onclick/javascript: eliminados). - lib/forum-write.ts: createTopic (tema + primer post), createPost (respuesta + updated_at), forumIsPostable / topicIsReplyable. - Routes /api/forum/topic y /api/forum/reply (guard de sesión; identidad = cuenta de juego: poster=username, poster_id=accountId). Componentes NewTopicForm y ReplyForm (clientes). Se muestran solo si hay sesión; el tema cerrado no admite respuesta. Verificado: escritura 401 sin sesión, saneado correcto. Pendiente: editar/borrar, moderación (fijar/cerrar/mover), búsqueda, editor enriquecido. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
16 lines
876 B
TypeScript
16 lines
876 B
TypeScript
import { getSession } from '@/lib/session'
|
|
import { createPost, topicIsReplyable } from '@/lib/forum-write'
|
|
|
|
export async function POST(request: Request) {
|
|
const session = await getSession()
|
|
if (!session.accountId || !session.username) return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
|
|
let b: Record<string, string> = {}
|
|
try { b = await request.json() } catch { return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 }) }
|
|
const topicId = Number(b.topicId)
|
|
const text = String(b.text ?? '').trim()
|
|
if (!topicId || !text) return Response.json({ success: false, error: 'emptyError' })
|
|
if (!(await topicIsReplyable(topicId))) return Response.json({ success: false, error: 'topicLocked' })
|
|
await createPost(topicId, session.username, session.accountId, text)
|
|
return Response.json({ success: true })
|
|
}
|