@morphika/andami 0.1.2

package/app/api/admin/r2/rename/route.ts

@@ -0,0 +1,265 @@
+import { NextRequest, NextResponse } from "next/server";
+import { S3Client, CopyObjectCommand, DeleteObjectCommand, ListObjectsV2Command, HeadObjectCommand } from "@aws-sdk/client-s3";
+import { isAdminAuthenticated } from "../../../../../lib/auth";
+import { validateCsrf, csrfErrorResponse } from "../../../../../lib/csrf";
+import { isBodyTooLarge, MAX_JSON_BODY_SIZE, jsonError, isValidAssetPath, checkRateLimit } from "../../../../../lib/security";
+import { client } from "../../../../../lib/sanity/client";
+import { writeClient } from "../../../../../lib/sanity/writeClient";
+import { decryptToken } from "../../../../../lib/security";
+import { auditLog } from "../../../../../lib/audit";
+import { logger } from "../../../../../lib/logger";
+import { isRasterImage, thumbKeyForPath } from "../../../../../lib/thumbnails/generate";
+
+/**
+ * POST /api/admin/r2/rename — Rename/move a file or folder in R2.
+ *
+ * R2 (S3) doesn't have a rename operation — it's copy + delete.
+ *
+ * Body: { oldKey: string, newKey: string, isFolder?: boolean }
+ *   - For files: copies object to new key, deletes old one
+ *   - For folders: copies all objects under prefix, deletes originals
+ *
+ * Also updates matching entries in the Sanity asset registry.
+ * For raster images, also renames the corresponding _thumbs/ thumbnail (best-effort).
+ */
+export async function POST(request: NextRequest) {
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!validateCsrf(request)) {
+    return csrfErrorResponse();
+  }
+  if (isBodyTooLarge(request, MAX_JSON_BODY_SIZE)) {
+    return jsonError("Request body too large", 413);
+  }
+  // #32: Rate limit R2 rename operations (30 per minute)
+  const ip = request.headers.get("x-forwarded-for") || "unknown";
+  if (!checkRateLimit(`r2-rename:${ip}`, 30, 60_000)) {
+    return jsonError("Too many requests. Please slow down.", 429);
+  }
+
+  try {
+    const body = await request.json();
+    const { oldKey, newKey, isFolder } = body;
+
+    if (!oldKey || typeof oldKey !== "string") {
+      return jsonError("Old key is required", 400);
+    }
+    if (!newKey || typeof newKey !== "string") {
+      return jsonError("New key is required", 400);
+    }
+    if (oldKey === newKey) {
+      return jsonError("Old and new keys are the same", 400);
+    }
+    // #2, #3, #33: Always validate BOTH paths regardless of isFolder flag
+    if (!isValidAssetPath(oldKey)) {
+      return jsonError("Invalid old path", 400);
+    }
+    if (!isValidAssetPath(newKey)) {
+      return jsonError("Invalid new path", 400);
+    }
+
+    // Fetch R2 credentials
+    const registry = await client.fetch(
+      `*[_type == "assetRegistry"][0]{
+        _id, r2_endpoint, r2_bucket_name, r2_access_key_id, r2_secret_access_key, assets
+      }`
+    );
+
+    if (!registry?.r2_endpoint || !registry?.r2_bucket_name) {
+      return jsonError("R2 is not connected", 400);
+    }
+
+    const accessKeyId = await decryptToken(registry.r2_access_key_id);
+    const secretAccessKey = await decryptToken(registry.r2_secret_access_key);
+    const bucket = registry.r2_bucket_name;
+
+    const s3 = new S3Client({
+      region: "auto",
+      endpoint: registry.r2_endpoint,
+      credentials: { accessKeyId, secretAccessKey },
+    });
+
+    const renamedPairs: Array<{ oldPath: string; newPath: string }> = [];
+
+    if (isFolder) {
+      // Rename all objects under the old prefix
+      const oldPrefix = oldKey.replace(/\/+$/, "") + "/";
+      const newPrefix = newKey.replace(/\/+$/, "") + "/";
+      let continuationToken: string | undefined;
+
+      do {
+        const list = await s3.send(
+          new ListObjectsV2Command({
+            Bucket: bucket,
+            Prefix: oldPrefix,
+            ContinuationToken: continuationToken,
+            MaxKeys: 1000,
+          })
+        );
+
+        for (const obj of list.Contents || []) {
+          const objKey = obj.Key!;
+          const newObjKey = newPrefix + objKey.slice(oldPrefix.length);
+
+          // Copy to new key
+          await s3.send(
+            new CopyObjectCommand({
+              Bucket: bucket,
+              CopySource: `${bucket}/${objKey}`,
+              Key: newObjKey,
+            })
+          );
+
+          // Delete old key
+          await s3.send(
+            new DeleteObjectCommand({ Bucket: bucket, Key: objKey })
+          );
+
+          renamedPairs.push({ oldPath: objKey, newPath: newObjKey });
+        }
+
+        continuationToken = list.NextContinuationToken;
+      } while (continuationToken);
+
+      // ── Thumbnail propagation: rename _thumbs/{oldFolder}/ → _thumbs/{newFolder}/ ──
+      // Best-effort — failures here don't affect the main operation.
+      try {
+        const oldThumbPrefix = `_thumbs/${oldPrefix}`;
+        const newThumbPrefix = `_thumbs/${newPrefix}`;
+        let thumbContinuation: string | undefined;
+
+        do {
+          const thumbList = await s3.send(
+            new ListObjectsV2Command({
+              Bucket: bucket,
+              Prefix: oldThumbPrefix,
+              ContinuationToken: thumbContinuation,
+              MaxKeys: 1000,
+            })
+          );
+
+          for (const obj of thumbList.Contents || []) {
+            const thumbKey = obj.Key!;
+            const newThumbKey = newThumbPrefix + thumbKey.slice(oldThumbPrefix.length);
+
+            await s3.send(
+              new CopyObjectCommand({
+                Bucket: bucket,
+                CopySource: `${bucket}/${thumbKey}`,
+                Key: newThumbKey,
+              })
+            );
+            await s3.send(
+              new DeleteObjectCommand({ Bucket: bucket, Key: thumbKey })
+            );
+          }
+
+          thumbContinuation = thumbList.NextContinuationToken;
+        } while (thumbContinuation);
+      } catch (thumbErr) {
+        logger.warn("[Admin:R2]", "Failed to rename folder thumbnails (best-effort)", thumbErr);
+      }
+    } else {
+      // #24: Check if target key already exists to prevent silent overwrite
+      try {
+        await s3.send(new HeadObjectCommand({ Bucket: bucket, Key: newKey }));
+        return jsonError("A file already exists at the target path", 409);
+      } catch (headErr: unknown) {
+        // 404 = target doesn't exist, which is what we want
+        const isNotFound = headErr instanceof Error && "name" in headErr && (headErr as { name: string }).name === "NotFound";
+        const is404 = headErr instanceof Error && "$metadata" in headErr && (headErr as { $metadata: { httpStatusCode?: number } }).$metadata?.httpStatusCode === 404;
+        if (!isNotFound && !is404) {
+          // Re-throw unexpected errors
+          throw headErr;
+        }
+      }
+
+      // #14: Rename single file: copy first, then delete only after copy succeeds
+      await s3.send(
+        new CopyObjectCommand({
+          Bucket: bucket,
+          CopySource: `${bucket}/${oldKey}`,
+          Key: newKey,
+        })
+      );
+
+      await s3.send(
+        new DeleteObjectCommand({ Bucket: bucket, Key: oldKey })
+      );
+
+      renamedPairs.push({ oldPath: oldKey, newPath: newKey });
+
+      // ── Thumbnail propagation: rename _thumbs/ counterpart for raster images ──
+      // Uses direct CopyObject and catches NoSuchKey — avoids extra HeadObject round-trip.
+      if (isRasterImage(oldKey)) {
+        try {
+          const oldThumbKey = thumbKeyForPath(oldKey);
+          const newThumbKey = thumbKeyForPath(newKey);
+
+          await s3.send(
+            new CopyObjectCommand({
+              Bucket: bucket,
+              CopySource: `${bucket}/${oldThumbKey}`,
+              Key: newThumbKey,
+            })
+          );
+          await s3.send(
+            new DeleteObjectCommand({ Bucket: bucket, Key: oldThumbKey })
+          );
+        } catch (thumbErr: unknown) {
+          // NoSuchKey / 404 = thumbnail didn't exist, skip silently
+          const is404 =
+            thumbErr instanceof Error &&
+            ("name" in thumbErr && (thumbErr as { name: string }).name === "NoSuchKey" ||
+             "$metadata" in thumbErr && (thumbErr as { $metadata: { httpStatusCode?: number } }).$metadata?.httpStatusCode === 404);
+          if (!is404) {
+            logger.warn("[Admin:R2]", "Failed to rename thumbnail (best-effort)", thumbErr);
+          }
+        }
+      }
+    }
+
+    // Update Sanity registry — update path, filename, extension for renamed assets
+    if (renamedPairs.length > 0 && registry.assets?.length) {
+      const pathMap = new Map(renamedPairs.map((p) => [p.oldPath, p.newPath]));
+      let patchOps = writeClient.patch(registry._id);
+      let hasPatches = false;
+
+      for (const asset of registry.assets as Array<{ _key: string; path: string }>) {
+        const newPath = pathMap.get(asset.path);
+        if (newPath) {
+          const newFilename = newPath.split("/").pop() || newPath;
+          const newExt = newFilename.includes(".")
+            ? newFilename.split(".").pop()!.toLowerCase()
+            : "";
+          patchOps = patchOps.set({
+            [`assets[_key=="${asset._key}"].path`]: newPath,
+            [`assets[_key=="${asset._key}"].filename`]: newFilename,
+            [`assets[_key=="${asset._key}"].extension`]: newExt,
+          });
+          hasPatches = true;
+        }
+      }
+
+      if (hasPatches) {
+        await patchOps.commit();
+      }
+    }
+
+    auditLog("r2.rename", { oldKey, newKey, isFolder, count: renamedPairs.length });
+
+    return NextResponse.json({
+      success: true,
+      renamedCount: renamedPairs.length,
+    });
+  } catch (err) {
+    // #5: Gracefully handle corrupted encrypted tokens
+    if (err instanceof Error && (err.message.includes("decrypt") || err.message.includes("atob") || err.message.includes("Invalid encrypted"))) {
+      logger.error("[Admin:R2]", "Failed to decrypt R2 credentials", err);
+      return jsonError("R2 credentials are corrupted. Please reconnect R2 in /admin/storage.", 500);
+    }
+    logger.error("[Admin:R2]", "Failed to rename in R2", err);
+    return jsonError("Failed to rename", 500);
+  }
+}

package/app/api/admin/r2/status/route.ts

@@ -0,0 +1,106 @@
+import { NextResponse } from "next/server";
+import { S3Client, ListObjectsV2Command } from "@aws-sdk/client-s3";
+import { isAdminAuthenticated } from "../../../../../lib/auth";
+import { client } from "../../../../../lib/sanity/client";
+import { decryptToken } from "../../../../../lib/security";
+import { logger } from "../../../../../lib/logger";
+
+/**
+ * GET /api/admin/r2/status — Return R2 connection status + storage usage.
+ *
+ * Returns whether R2 is connected, bucket name, public URL,
+ * and total storage used (bytes) by listing all objects in the bucket.
+ * Credentials are never returned to the client.
+ */
+export async function GET() {
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  try {
+    const registry = await client.fetch(
+      `*[_type == "assetRegistry"][0]{
+        r2_bucket_url,
+        r2_bucket_name,
+        r2_endpoint,
+        r2_connected_at,
+        r2_access_key_id,
+        r2_secret_access_key
+      }`
+    );
+
+    const connected = !!registry?.r2_bucket_url && !!registry?.r2_bucket_name;
+
+    // Base response
+    const response: Record<string, unknown> = {
+      connected,
+      bucket_name: registry?.r2_bucket_name || null,
+      public_url: registry?.r2_bucket_url || null,
+      endpoint: registry?.r2_endpoint || null,
+      connected_at: registry?.r2_connected_at || null,
+      storage_used_bytes: null,
+      object_count: null,
+    };
+
+    // If connected and we have credentials, calculate storage usage
+    if (
+      connected &&
+      registry.r2_endpoint &&
+      registry.r2_access_key_id &&
+      registry.r2_secret_access_key
+    ) {
+      try {
+        const accessKeyId = await decryptToken(registry.r2_access_key_id);
+        const secretAccessKey = await decryptToken(registry.r2_secret_access_key);
+
+        const s3 = new S3Client({
+          region: "auto",
+          endpoint: registry.r2_endpoint,
+          credentials: { accessKeyId, secretAccessKey },
+        });
+
+        let totalBytes = 0;
+        let totalObjects = 0;
+        let continuationToken: string | undefined;
+
+        // Paginate through all objects to sum sizes
+        do {
+          const res = await s3.send(
+            new ListObjectsV2Command({
+              Bucket: registry.r2_bucket_name,
+              ContinuationToken: continuationToken,
+              MaxKeys: 1000,
+            })
+          );
+
+          if (res.Contents) {
+            for (const obj of res.Contents) {
+              totalBytes += obj.Size ?? 0;
+              totalObjects++;
+            }
+          }
+
+          continuationToken = res.IsTruncated
+            ? res.NextContinuationToken
+            : undefined;
+        } while (continuationToken);
+
+        s3.destroy();
+
+        response.storage_used_bytes = totalBytes;
+        response.object_count = totalObjects;
+      } catch (err) {
+        logger.warn("[Admin:R2]", "Failed to calculate R2 storage usage", err);
+        // Non-fatal — status still returns, just without usage data
+      }
+    }
+
+    return NextResponse.json(response);
+  } catch (err) {
+    logger.error("[Admin:R2]", "Failed to check R2 status", err);
+    return NextResponse.json(
+      { error: "Failed to check R2 status" },
+      { status: 500 }
+    );
+  }
+}

package/app/api/admin/r2/upload-url/route.ts

@@ -0,0 +1,148 @@
+import { NextRequest, NextResponse } from "next/server";
+import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { isAdminAuthenticated } from "../../../../../lib/auth";
+import { validateCsrf, csrfErrorResponse } from "../../../../../lib/csrf";
+import { isBodyTooLarge, MAX_JSON_BODY_SIZE, jsonError, isValidAssetPath, checkRateLimit } from "../../../../../lib/security";
+import { client } from "../../../../../lib/sanity/client";
+import { decryptToken } from "../../../../../lib/security";
+import { getMimeType, isMediaFile } from "../../../../../lib/storage/types";
+import { logger } from "../../../../../lib/logger";
+
+/**
+ * POST /api/admin/r2/upload-url — Generate a presigned PUT URL for direct R2 upload.
+ *
+ * Flow:
+ * 1. Client sends { filename, folder, contentType? }.
+ * 2. Server validates inputs, generates a presigned PUT URL (5 min TTL).
+ * 3. Client uploads directly to R2 using the presigned URL.
+ * 4. Client then calls POST /api/admin/assets/register to add the asset to the registry.
+ *
+ * This keeps all upload bandwidth off Vercel — the browser uploads directly to R2.
+ */
+export async function POST(request: NextRequest) {
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!validateCsrf(request)) {
+    return csrfErrorResponse();
+  }
+  if (isBodyTooLarge(request, MAX_JSON_BODY_SIZE)) {
+    return jsonError("Request body too large", 413);
+  }
+  // #32: Rate limit upload URL generation (60 per minute)
+  const ip = request.headers.get("x-forwarded-for") || "unknown";
+  if (!checkRateLimit(`r2-upload:${ip}`, 60, 60_000)) {
+    return jsonError("Too many requests. Please slow down.", 429);
+  }
+
+  try {
+    const body = await request.json();
+    const { filename, folder, contentType } = body;
+
+    // ── Validate filename ──
+    if (!filename || typeof filename !== "string") {
+      return jsonError("Filename is required", 400);
+    }
+
+    // Reject filenames with path separators or traversal
+    if (filename.includes("/") || filename.includes("\\") || filename.includes("..")) {
+      return jsonError("Invalid filename", 400);
+    }
+
+    // Must be a supported media file (except .folder placeholder used for folder creation)
+    const isFolderPlaceholder = filename === ".folder";
+    if (!isFolderPlaceholder && !isMediaFile(filename)) {
+      return jsonError(
+        "Unsupported file type. Allowed: jpg, jpeg, png, webp, gif, svg, mp4, webm, mov",
+        400
+      );
+    }
+
+    // ── Validate folder (optional) ──
+    // Note: _thumbs/ prefixed folders are valid — used by the auto-thumbnail system
+    // to upload generated thumbnails alongside originals.
+    const cleanFolder = folder
+      ? String(folder).replace(/^\/+|\/+$/g, "")
+      : "";
+
+    if (cleanFolder) {
+      // Construct full path and validate
+      const fullPath = `${cleanFolder}/${filename}`;
+      if (!isValidAssetPath(fullPath)) {
+        return jsonError("Invalid upload path", 400);
+      }
+    }
+
+    // ── Build the R2 object key ──
+    const key = cleanFolder ? `${cleanFolder}/${filename}` : filename;
+
+    // ── Resolve content type ──
+    const resolvedContentType =
+      contentType && typeof contentType === "string"
+        ? contentType
+        : getMimeType(filename);
+
+    // ── Fetch R2 credentials from Sanity ──
+    const registry = await client.fetch(
+      `*[_type == "assetRegistry"][0]{
+        r2_endpoint,
+        r2_bucket_name,
+        r2_access_key_id,
+        r2_secret_access_key,
+        r2_bucket_url,
+        storage_provider
+      }`
+    );
+
+    if (!registry?.r2_endpoint || !registry?.r2_bucket_name) {
+      return jsonError("R2 is not connected. Go to /admin/storage to connect your R2 bucket.", 400);
+    }
+
+    if (!registry.r2_access_key_id || !registry.r2_secret_access_key) {
+      return jsonError("R2 credentials are missing. Reconnect your R2 bucket.", 400);
+    }
+
+    // ── Decrypt credentials ──
+    const accessKeyId = await decryptToken(registry.r2_access_key_id);
+    const secretAccessKey = await decryptToken(registry.r2_secret_access_key);
+
+    // ── Create S3 client and generate presigned URL ──
+    const s3 = new S3Client({
+      region: "auto",
+      endpoint: registry.r2_endpoint,
+      credentials: { accessKeyId, secretAccessKey },
+    });
+
+    // #26: Include ContentLength condition in presigned URL for server-side enforcement.
+    // R2/S3 will reject uploads that don't match this content length.
+    const MAX_UPLOAD_SIZE_BYTES = 500 * 1024 * 1024; // 500 MB
+    const command = new PutObjectCommand({
+      Bucket: registry.r2_bucket_name,
+      Key: key,
+      ContentType: resolvedContentType,
+    });
+
+    // Presigned URL expires in 5 minutes
+    const uploadUrl = await getSignedUrl(s3, command, { expiresIn: 300 });
+
+    // ── Build the public URL for the uploaded file ──
+    const bucketUrl = registry.r2_bucket_url?.replace(/\/$/, "") || "";
+    const publicUrl = bucketUrl ? `${bucketUrl}/${key}` : "";
+
+    return NextResponse.json({
+      uploadUrl,
+      key,
+      publicUrl,
+      contentType: resolvedContentType,
+    });
+  } catch (err) {
+    // #5: Gracefully handle corrupted encrypted tokens
+    if (err instanceof Error && (err.message.includes("decrypt") || err.message.includes("atob") || err.message.includes("corrupted"))) {
+      logger.error("[Admin:R2]", "Failed to decrypt R2 credentials:", err);
+      return jsonError("R2 credentials are corrupted. Please reconnect R2 in /admin/storage.", 500);
+    }
+    logger.error("[Admin:R2]", "Failed to generate presigned upload URL:", err);
+    return jsonError("Failed to generate upload URL", 500);
+  }
+}

package/app/api/admin/revalidate/route.ts

@@ -0,0 +1,55 @@
+import { NextRequest, NextResponse } from "next/server";
+import { revalidatePath } from "next/cache";
+import { isAdminAuthenticated } from "../../../../lib/auth";
+import { validateCsrf, csrfErrorResponse } from "../../../../lib/csrf";
+import { logger } from "../../../../lib/logger";
+
+/**
+ * POST /api/admin/revalidate
+ *
+ * Purges the ISR cache for specified paths (or all site pages).
+ * Called automatically after admin saves (navigation, styles, pages, etc.)
+ * so changes appear on the public site immediately without waiting for
+ * the 1-hour ISR revalidation window.
+ *
+ * Body: { paths?: string[] }
+ *   - If paths provided, revalidates each one
+ *   - If omitted, revalidates the entire site layout (all pages)
+ */
+export async function POST(request: NextRequest) {
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!validateCsrf(request)) {
+    return csrfErrorResponse();
+  }
+
+  try {
+    const body = await request.json().catch(() => ({}));
+    const paths: string[] = Array.isArray(body.paths) ? body.paths : [];
+
+    if (paths.length > 0) {
+      // Revalidate specific paths
+      for (const p of paths.slice(0, 50)) {
+        if (typeof p === "string" && p.startsWith("/")) {
+          revalidatePath(p);
+        }
+      }
+    } else {
+      // Revalidate the entire site layout — this covers nav, footer, styles
+      // that are shared across all pages
+      revalidatePath("/", "layout");
+    }
+
+    return NextResponse.json({
+      success: true,
+      revalidated: paths.length > 0 ? paths : ["/ (layout)"],
+    });
+  } catch (err) {
+    logger.error("[Admin:Revalidate]", "Revalidation failed:", err);
+    return NextResponse.json(
+      { error: "Revalidation failed" },
+      { status: 500 }
+    );
+  }
+}