239392b876
- lib/forum-sanitize.ts: cleanPostHtml con sanitize-html (misma allowlist que forum/sanitize.py de nh3: formato básico + a/img/tablas, rel nofollow, esquemas http/https/mailto). Verificado XSS-safe (script/onclick/javascript: eliminados). - lib/forum-write.ts: createTopic (tema + primer post), createPost (respuesta + updated_at), forumIsPostable / topicIsReplyable. - Routes /api/forum/topic y /api/forum/reply (guard de sesión; identidad = cuenta de juego: poster=username, poster_id=accountId). Componentes NewTopicForm y ReplyForm (clientes). Se muestran solo si hay sesión; el tema cerrado no admite respuesta. Verificado: escritura 401 sin sesión, saneado correcto. Pendiente: editar/borrar, moderación (fijar/cerrar/mover), búsqueda, editor enriquecido. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
17 lines
960 B
TypeScript
17 lines
960 B
TypeScript
import { getSession } from '@/lib/session'
|
|
import { createTopic, forumIsPostable } from '@/lib/forum-write'
|
|
|
|
export async function POST(request: Request) {
|
|
const session = await getSession()
|
|
if (!session.accountId || !session.username) return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
|
|
let b: Record<string, string> = {}
|
|
try { b = await request.json() } catch { return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 }) }
|
|
const forumId = Number(b.forumId)
|
|
const name = String(b.name ?? '').trim()
|
|
const text = String(b.text ?? '').trim()
|
|
if (!forumId || !name || !text) return Response.json({ success: false, error: 'emptyError' })
|
|
if (!(await forumIsPostable(forumId))) return Response.json({ success: false, error: 'invalidForum' })
|
|
const topicId = await createTopic(forumId, name, session.username, session.accountId, text)
|
|
return Response.json({ success: true, topicId })
|
|
}
|