feat: complete v0.5 operations foundation

2026-07-19 03:58:03 +08:00
parent ca3f706cc1
commit d285f3e275
35 changed files with 248 additions and 39 deletions
@@ -2,10 +2,11 @@ import { NextResponse } from "next/server";
 import { requireUser } from "@/lib/auth";
 import { db } from "@/lib/db";
 import { createWebhookSecret, webhookSecretHash } from "@/lib/webhook";
+import { requireSameOrigin } from "@/lib/security";

 export async function POST(request: Request, { params }: { params: Promise<{ id: string }> }) {
  try {
-    const user = await requireUser(); const { id: rawId } = await params; const id = Number(rawId);
+    requireSameOrigin(request); const user = await requireUser(); const { id: rawId } = await params; const id = Number(rawId);
    const source = db.prepare("SELECT id FROM sources WHERE id=? AND user_id=?").get(id, user.id);
    if (!source) return NextResponse.json({ error: "Not found" }, { status: 404 });
    const secret = createWebhookSecret();