c38f11dbd3
Stop accepting client-supplied birth data on those paths, and cap session writes plus location lookups so a logged-in caller cannot farm compute. Co-authored-by: Cursor <cursoragent@cursor.com>
60 lines
2.9 KiB
TypeScript
60 lines
2.9 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { chatSessionCreateSchema, ChatSessionBodyTooLargeError, readChatSessionJson } from "@/lib/chat-session-write-contract";
|
|
import { consumeUserRequestRateLimit } from "@/lib/request-rate-limit";
|
|
import { isSupabaseConfigurationError } from "@/lib/supabase/config";
|
|
import { createServerSupabaseClient } from "@/lib/supabase/server";
|
|
|
|
export async function GET() {
|
|
try {
|
|
const supabase = await createServerSupabaseClient();
|
|
const { data: { user }, error: authError } = await supabase.auth.getUser();
|
|
if (authError || !user) return NextResponse.json({ error: "请先登录" }, { status: 401 });
|
|
const { data, error } = await supabase
|
|
.from("chat_sessions")
|
|
.select("id,title,theme,model_id,messages,session_type,rectification_case_id,updated_at")
|
|
.eq("user_id", user.id)
|
|
.order("updated_at", { ascending: false });
|
|
if (error) return NextResponse.json({ error: "聊天记录暂时无法读取" }, { status: 500 });
|
|
return NextResponse.json({ sessions: data ?? [] });
|
|
} catch (error) {
|
|
if (isSupabaseConfigurationError(error)) {
|
|
return NextResponse.json({ error: "数据库尚未配置", code: "DATABASE_NOT_CONFIGURED" }, { status: 503 });
|
|
}
|
|
return NextResponse.json({ error: "聊天记录暂时无法读取" }, { status: 500 });
|
|
}
|
|
}
|
|
|
|
export async function POST(request: Request) {
|
|
try {
|
|
const supabase = await createServerSupabaseClient();
|
|
const { data: { user }, error: authError } = await supabase.auth.getUser();
|
|
if (authError || !user) return NextResponse.json({ error: "请先登录" }, { status: 401 });
|
|
const limited = consumeUserRequestRateLimit("sessionWrite", user.id);
|
|
if (!limited.ok) {
|
|
return NextResponse.json({
|
|
error: "请求过于频繁",
|
|
code: "rate_limited",
|
|
retryAfterSeconds: limited.retryAfterSeconds,
|
|
}, { status: 429, headers: { "Retry-After": String(limited.retryAfterSeconds) } });
|
|
}
|
|
const parsed = chatSessionCreateSchema.safeParse(await readChatSessionJson(request));
|
|
if (!parsed.success) return NextResponse.json({ error: "聊天记录格式不正确" }, { status: 400 });
|
|
const { id, ...values } = parsed.data;
|
|
const { error } = await supabase.from("chat_sessions").insert({
|
|
id,
|
|
user_id: user.id,
|
|
...values,
|
|
});
|
|
if (error) return NextResponse.json({ error: "聊天记录暂时无法同步" }, { status: 500 });
|
|
return NextResponse.json({ ok: true }, { status: 201 });
|
|
} catch (error) {
|
|
if (error instanceof ChatSessionBodyTooLargeError) {
|
|
return NextResponse.json({ error: error.message }, { status: 413 });
|
|
}
|
|
if (isSupabaseConfigurationError(error)) {
|
|
return NextResponse.json({ error: "Supabase 尚未配置", code: "SUPABASE_NOT_CONFIGURED" }, { status: 503 });
|
|
}
|
|
return NextResponse.json({ error: "聊天记录暂时无法同步" }, { status: 500 });
|
|
}
|
|
}
|