22 lines
1.7 KiB
TypeScript
22 lines
1.7 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { requireUser } from "@/lib/auth";
|
|
import { db } from "@/lib/db";
|
|
import { externalUrl } from "@/lib/http";
|
|
import { requireSameOrigin } from "@/lib/security";
|
|
import bcrypt from "bcryptjs";
|
|
|
|
export async function POST(request: Request) {
|
|
try {
|
|
requireSameOrigin(request); const admin = await requireUser(); if (admin.role !== "admin") throw new Error("Forbidden");
|
|
const form = await request.formData(); const action = String(form.get("action")); const id = Number(form.get("id"));
|
|
if (action === "hide-post") { db.prepare("UPDATE posts SET hidden=1,updated_at=CURRENT_TIMESTAMP WHERE id=?").run(id); db.prepare("UPDATE reports SET resolved=1 WHERE post_id=?").run(id); }
|
|
else if (action === "restore-post") db.prepare("UPDATE posts SET hidden=0,updated_at=CURRENT_TIMESTAMP WHERE id=?").run(id);
|
|
else if (action === "disable-user") { if (id === admin.id) throw new Error("Cannot disable yourself"); db.prepare("UPDATE users SET disabled=1 WHERE id=?").run(id); }
|
|
else if (action === "enable-user") db.prepare("UPDATE users SET disabled=0 WHERE id=?").run(id);
|
|
else if (action === "reset-password") { const password = String(form.get("password") || ""); if (password.length < 10) throw new Error("Invalid password"); db.prepare("UPDATE users SET password_hash=? WHERE id=?").run(await bcrypt.hash(password, 12), id); }
|
|
else if (action === "resolve-report") db.prepare("UPDATE reports SET resolved=1 WHERE id=?").run(id);
|
|
else throw new Error("Invalid action");
|
|
return NextResponse.redirect(externalUrl(request, "/admin?updated=1"));
|
|
} catch { return NextResponse.redirect(externalUrl(request, "/admin?error=moderation")); }
|
|
}
|