@gigamusic/links 0.1.0 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gigamusic/links",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Editable Linktree-style link pages for gigamusic artist sites. Ships a Prisma fragment, public + admin React components, admin API handler factories, and platform-detection helpers.",
   "license": "MIT",
   "repository": {
@@ -38,10 +38,10 @@
     "access": "public"
   },
   "dependencies": {
-    "@gigamusic/config": "0.1.0",
-    "@gigamusic/core": "0.1.0",
-    "@gigamusic/db": "0.1.0",
-    "@gigamusic/ui": "0.1.0"
+    "@gigamusic/core": "0.2.0",
+    "@gigamusic/ui": "0.2.0",
+    "@gigamusic/config": "0.2.0",
+    "@gigamusic/db": "0.2.0"
   },
   "peerDependencies": {
     "@prisma/client": ">=6",

package/src/api/handlers.ts

@@ -1,6 +1,5 @@
 import { revalidateTag } from "next/cache";
 import type { LinkPageQueries } from "../types";
-import { verifyAdminSession } from "./auth";
 import {
   INVALID_SLUG_MESSAGE,
   RESERVED_SLUGS,
@@ -22,9 +21,14 @@ export type RouteHandler<Params = Record<string, string>> = (
   ctx: { params: Promise<Params> },
 ) => Promise<Response> | Response;
 
+/**
+ * Deps for the admin-side link-page handler factories.
+ *
+ * Auth: the package assumes the request has been gated by the consumer's
+ * `proxy.ts` / middleware. These handlers don't verify a session.
+ */
 export interface LinkPagesAdminDeps {
   queries: LinkPageQueries;
-  adminSessionSecret: string;
 }
 
 function json(body: unknown, init?: ResponseInit): Response {
@@ -37,14 +41,6 @@ function json(body: unknown, init?: ResponseInit): Response {
   });
 }
 
-async function requireAdmin(
-  req: Request,
-  secret: string,
-): Promise<Response | null> {
-  if (await verifyAdminSession(req, secret)) return null;
-  return json({ error: "Unauthorized" }, { status: 401 });
-}
-
 interface LinkPageBody {
   title?: string;
   slug?: string;
@@ -73,16 +69,12 @@ export function createAdminLinkPagesHandlers(deps: LinkPagesAdminDeps): {
 } {
   return {
     GET: async (req) => {
-      const unauth = await requireAdmin(req, deps.adminSessionSecret);
-      if (unauth) return unauth;
-      const pages = await deps.queries.listAllLinkPages();
+const pages = await deps.queries.listAllLinkPages();
       return json(pages);
     },
 
     POST: async (req) => {
-      const unauth = await requireAdmin(req, deps.adminSessionSecret);
-      if (unauth) return unauth;
-      const body = (await req.json()) as LinkPageBody;
+const body = (await req.json()) as LinkPageBody;
       const title = body.title?.trim();
       const slug = body.slug?.trim().toLowerCase();
 
@@ -122,9 +114,7 @@ export function createAdminLinkPageByIdHandlers(deps: LinkPagesAdminDeps): {
 } {
   return {
     GET: async (req, { params }) => {
-      const unauth = await requireAdmin(req, deps.adminSessionSecret);
-      if (unauth) return unauth;
-      const { id: idParam } = await params;
+const { id: idParam } = await params;
       const id = Number(idParam);
       if (!Number.isFinite(id)) return json({ error: "Not found" }, { status: 404 });
       const page = await deps.queries.getLinkPageById(id);
@@ -133,9 +123,7 @@ export function createAdminLinkPageByIdHandlers(deps: LinkPagesAdminDeps): {
     },
 
     PUT: async (req, { params }) => {
-      const unauth = await requireAdmin(req, deps.adminSessionSecret);
-      if (unauth) return unauth;
-      const { id: idParam } = await params;
+const { id: idParam } = await params;
       const id = Number(idParam);
       if (!Number.isFinite(id)) return json({ error: "Not found" }, { status: 404 });
       const body = (await req.json()) as LinkPageBody;
@@ -171,9 +159,7 @@ export function createAdminLinkPageByIdHandlers(deps: LinkPagesAdminDeps): {
     },
 
     DELETE: async (req, { params }) => {
-      const unauth = await requireAdmin(req, deps.adminSessionSecret);
-      if (unauth) return unauth;
-      const { id: idParam } = await params;
+const { id: idParam } = await params;
       const id = Number(idParam);
       if (!Number.isFinite(id)) return json({ error: "Not found" }, { status: 404 });
       await deps.queries.deleteLinkPage(id);
@@ -207,9 +193,7 @@ export function createAdminLinkPageItemsHandlers(
 } {
   return {
     POST: async (req, { params }) => {
-      const unauth = await requireAdmin(req, deps.adminSessionSecret);
-      if (unauth) return unauth;
-      const { id: pageIdParam } = await params;
+const { id: pageIdParam } = await params;
       const pageId = Number(pageIdParam);
       if (!Number.isFinite(pageId)) {
         return json({ error: "Not found" }, { status: 404 });
@@ -227,9 +211,7 @@ export function createAdminLinkPageItemsHandlers(
     },
 
     PUT: async (req) => {
-      const unauth = await requireAdmin(req, deps.adminSessionSecret);
-      if (unauth) return unauth;
-      const body = (await req.json()) as LinkPageItemBody;
+const body = (await req.json()) as LinkPageItemBody;
       if (body.itemId == null) {
         return json({ error: "itemId is required" }, { status: 400 });
       }
@@ -248,9 +230,7 @@ export function createAdminLinkPageItemsHandlers(
     },
 
     DELETE: async (req) => {
-      const unauth = await requireAdmin(req, deps.adminSessionSecret);
-      if (unauth) return unauth;
-      const { searchParams } = new URL(req.url);
+const { searchParams } = new URL(req.url);
       const itemIdRaw = searchParams.get("itemId");
       if (!itemIdRaw) {
         return json({ error: "itemId is required" }, { status: 400 });

package/src/api/auth.ts

@@ -1,34 +0,0 @@
-import { verifyAdminSessionToken } from "@gigamusic/core";
-
-const ADMIN_SESSION_COOKIE = "admin_session";
-
-/**
- * Stateless cookie verification for route handlers. Mirrors
- * `@gigamusic/admin`'s `verifyAdminSession` so consumers can wire both
- * packages to the same session secret without coupling them at the package
- * level.
- */
-export async function verifyAdminSession(
-  req: Request,
-  adminSessionSecret: string,
-): Promise<boolean> {
-  const header = req.headers.get("cookie");
-  if (!header) return false;
-  const token = parseCookieHeader(header, ADMIN_SESSION_COOKIE);
-  if (!token) return false;
-  try {
-    await verifyAdminSessionToken(token, adminSessionSecret);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function parseCookieHeader(header: string, name: string): string | null {
-  for (const raw of header.split(";")) {
-    const trimmed = raw.trim();
-    if (!trimmed.startsWith(`${name}=`)) continue;
-    return decodeURIComponent(trimmed.slice(name.length + 1));
-  }
-  return null;
-}