@promptbook/cli 0.112.0-99 → 0.113.0-0

package/apps/agents-server/src/app/api/scrape/route.ts

@@ -2,6 +2,8 @@ import { serializeError } from '@promptbook-local/utils';
 import { NextRequest, NextResponse } from 'next/server';
 import { fetchUrlContent } from '../../../../../../src/commitments/USE_BROWSER/fetchUrlContent';
 import { assertsError } from '../../../../../../src/errors/assertsError';
+import { getCurrentUser } from '../../../utils/getCurrentUser';
+import { assertSafeUrl } from '../../../utils/assertSafeUrl';
 
 /**
  * API endpoint for scraping URL content
@@ -9,9 +11,17 @@ import { assertsError } from '../../../../../../src/errors/assertsError';
  * This endpoint proxies the server-side scraping functionality to be accessible from the browser.
  * It uses the fetchUrlContent utility to fetch and convert web content to markdown.
  *
+ * Requires authentication to prevent unauthenticated SSRF abuse.
+ * The destination URL is validated against private/internal IP ranges before fetching.
+ *
  * @route GET /api/scrape?url=<url>
  */
 export async function GET(request: NextRequest) {
+    const currentUser = await getCurrentUser();
+    if (!currentUser) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
     try {
         // Get the URL parameter from the query string
         const searchParams = request.nextUrl.searchParams;
@@ -22,6 +32,14 @@ export async function GET(request: NextRequest) {
             return NextResponse.json({ error: 'URL parameter is required' }, { status: 400 });
         }
 
+        // Guard against SSRF: reject private/internal IPs and non-HTTP(S) schemes
+        try {
+            assertSafeUrl(url);
+        } catch (error) {
+            assertsError(error);
+            return NextResponse.json({ error: error.message, success: false }, { status: 400 });
+        }
+
         // Use the server-side fetchUrlContent utility
         const content = await fetchUrlContent(url);
 

package/apps/agents-server/src/app/api/team-agent-profile/route.ts

@@ -8,7 +8,10 @@ import {
     resolvePlaceholderImageUrl,
     resolveProfileImageUrl,
 } from '../../../../../../src/book-components/Chat/utils/loadAgentProfile';
+import { assertsError } from '../../../../../../src/errors/assertsError';
 import { isValidAgentUrl } from '../../../../../../src/utils/validators/url/isValidAgentUrl';
+import { assertSafeUrl } from '../../../utils/assertSafeUrl';
+import { getCurrentUser } from '../../../utils/getCurrentUser';
 
 /**
  * Response for team agent profile.
@@ -88,8 +91,17 @@ async function fetchAgentProfile(agentUrl: string, localServerUrl: string): Prom
  *
  * The client uses this to render tool call chips without relying on direct cross-origin requests
  * to the teammate agent.
+ *
+ * Requires authentication to prevent unauthenticated SSRF abuse and exfiltration of the
+ * internal team access token. The destination URL is validated against private/internal
+ * IP ranges before any outbound request is made.
  */
 export async function GET(request: Request) {
+    const currentUser = await getCurrentUser();
+    if (!currentUser) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
     const requestUrl = new URL(request.url);
     const agentUrl = requestUrl.searchParams.get('url');
 
@@ -97,6 +109,14 @@ export async function GET(request: Request) {
         return NextResponse.json({ error: 'Invalid agent URL' }, { status: 400 });
     }
 
+    // Guard against SSRF: reject private/internal IPs and non-HTTP(S) schemes
+    try {
+        assertSafeUrl(agentUrl);
+    } catch (error) {
+        assertsError(error);
+        return NextResponse.json({ error: error.message }, { status: 400 });
+    }
+
     const normalizedUrl = agentUrl.replace(/\/$/, '');
     const profile = await fetchAgentProfile(normalizedUrl, requestUrl.origin);
 

package/apps/agents-server/src/app/api/upload/route.ts

@@ -1,305 +1,289 @@
-import { $getTableName } from '@/src/database/$getTableName';
-import { $provideSupabase } from '@/src/database/$provideSupabase';
 import { serializeError } from '@promptbook-local/utils';
-import type { PostgrestSingleResponse, SupabaseClient } from '@supabase/supabase-js';
-import { handleUpload, type HandleUploadBody } from '@vercel/blob/client';
 import { NextRequest, NextResponse } from 'next/server';
+import { spaceTrim } from 'spacetrim';
 import { assertsError } from '../../../../../../src/errors/assertsError';
-import { getUserIdFromRequest } from '../../../../src/utils/getUserIdFromRequest';
+import { LimitReachedError } from '../../../../../../src/errors/LimitReachedError';
+import { NotAllowed } from '../../../../../../src/errors/NotAllowed';
+import { UnexpectedError } from '../../../../../../src/errors/UnexpectedError';
+import { $getTableName } from '../../../database/$getTableName';
+import { $provideSupabase } from '../../../database/$provideSupabase';
 import type { AgentsServerDatabase } from '../../../database/schema';
+import {
+    $provideCdnForServer,
+    isSelfContainedS3StorageSelected,
+    resolveCdnPublicUrlForServer,
+} from '../../../tools/$provideCdnForServer';
+import { $provideServer } from '../../../tools/$provideServer';
+import { getSafeCdnPath } from '../../../utils/cdn/utils/getSafeCdnPath';
+import { getUserFileCdnKey } from '../../../utils/cdn/utils/getUserFileCdnKey';
 import { FILE_SECURITY_CHECKERS } from '../../../file-security-checkers';
+import { getUserIdFromRequest } from '../../../utils/getUserIdFromRequest';
 import { getMaxFileUploadSizeBytes } from '../../../utils/serverLimits';
+import { resolveFileUploadAvailability } from '../../../utils/upload/fileUploadAvailability';
+import { validateMimeType } from '../../../utils/validators/validateMimeType';
 
 /**
- * Additional metadata accepted from the client-side upload helper.
+ * Default purpose used for uploads when the client does not provide one.
  *
  * @private
  */
-type UploadClientPayload = {
-    purpose?: unknown;
-    contentType?: unknown;
-};
+const DEFAULT_UPLOAD_PURPOSE = 'GENERIC_UPLOAD';
 
 /**
- * Generic object used for safe JSON parsing in upload payloads.
+ * Default MIME type used for unknown uploads.
  *
  * @private
  */
-type JsonRecord = Record<string, unknown>;
+const DEFAULT_UPLOAD_CONTENT_TYPE = 'application/octet-stream';
 
 /**
- * Default purpose used for uploads when the client does not provide one.
+ * Regular expression for path segments that are safe to keep as public object keys.
  *
  * @private
  */
-const DEFAULT_UPLOAD_PURPOSE = 'GENERIC_UPLOAD';
+const SAFE_UPLOAD_PATH_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._~!$&'()*+,;=:@/-]*$/;
 
 /**
- * Default MIME type used for unknown uploads.
+ * Parsed upload request.
  *
  * @private
  */
-const DEFAULT_UPLOAD_CONTENT_TYPE = 'application/octet-stream';
+type ParsedUploadRequest = {
+    file: File;
+    pathname: string;
+    purpose: string;
+    contentType: string;
+};
 
 /**
- * Minimal MIME type validation for values provided by client payload.
+ * Server context returned by `$provideServer`.
  *
  * @private
  */
-const MIME_TYPE_PATTERN = /^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/i;
+type ProvidedServer = Awaited<ReturnType<typeof $provideServer>>;
 
 /**
- * Safely parses a JSON string into an object; returns empty object on invalid payload.
+ * Normalizes upload purpose to a non-empty string.
  *
  * @private
  */
-function parseJsonRecord(rawJson: string | null | undefined): JsonRecord {
-    if (!rawJson) {
-        return {};
+function normalizeUploadPurpose(value: FormDataEntryValue | null): string {
+    if (typeof value !== 'string') {
+        return DEFAULT_UPLOAD_PURPOSE;
     }
 
-    try {
-        const parsed = JSON.parse(rawJson);
-        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-            return {};
-        }
+    const normalizedPurpose = value.trim();
+    return normalizedPurpose === '' ? DEFAULT_UPLOAD_PURPOSE : normalizedPurpose;
+}
 
-        return parsed as JsonRecord;
+/**
+ * Normalizes a MIME type string while keeping a safe fallback for unknown values.
+ *
+ * @private
+ */
+function normalizeUploadContentType(value: FormDataEntryValue | null, fallbackContentType: string): string {
+    const candidate = typeof value === 'string' && value.trim() ? value.trim() : fallbackContentType;
+
+    try {
+        return validateMimeType(candidate || DEFAULT_UPLOAD_CONTENT_TYPE);
     } catch {
-        return {};
+        return DEFAULT_UPLOAD_CONTENT_TYPE;
     }
 }
 
 /**
- * Normalizes upload purpose to a non-empty string.
+ * Resolves and validates the storage key requested by the browser.
  *
  * @private
  */
-function normalizeUploadPurpose(value: unknown): string {
+function resolveUploadPathname(value: FormDataEntryValue | null): string {
     if (typeof value !== 'string') {
-        return DEFAULT_UPLOAD_PURPOSE;
+        throw new UnexpectedError('Upload request is missing `pathname`.');
     }
 
-    const normalizedPurpose = value.trim();
-    return normalizedPurpose === '' ? DEFAULT_UPLOAD_PURPOSE : normalizedPurpose;
+    const pathname = value.trim().replace(/\\/g, '/').replace(/^\/+/, '');
+
+    if (
+        pathname === '' ||
+        pathname.includes('/../') ||
+        pathname.startsWith('../') ||
+        pathname.endsWith('/..') ||
+        !SAFE_UPLOAD_PATH_PATTERN.test(pathname)
+    ) {
+        throw new UnexpectedError(
+            spaceTrim(`
+                Upload request contains an invalid \`pathname\`.
+
+                The upload key must be a relative CDN path without parent-directory segments.
+            `),
+        );
+    }
+
+    return getSafeCdnPath({
+        pathname,
+        pathPrefix: process.env.NEXT_PUBLIC_CDN_PATH_PREFIX,
+    });
 }
 
 /**
- * Normalizes a MIME type string while keeping a safe fallback for unknown values.
+ * Parses the multipart request accepted by `/api/upload`.
  *
  * @private
  */
-function normalizeUploadContentType(value: unknown): string {
-    if (typeof value !== 'string') {
-        return DEFAULT_UPLOAD_CONTENT_TYPE;
+async function parseUploadRequest(request: NextRequest): Promise<ParsedUploadRequest> {
+    const formData = await request.formData();
+    const file = formData.get('file');
+
+    if (!(file instanceof File)) {
+        throw new UnexpectedError('Upload request is missing `file`.');
     }
 
-    const normalizedContentType = value.trim().toLowerCase();
-    if (!MIME_TYPE_PATTERN.test(normalizedContentType)) {
-        return DEFAULT_UPLOAD_CONTENT_TYPE;
+    return {
+        file,
+        pathname: resolveUploadPathname(formData.get('pathname')),
+        purpose: normalizeUploadPurpose(formData.get('purpose')),
+        contentType: normalizeUploadContentType(formData.get('contentType'), file.type),
+    };
+}
+
+/**
+ * Runs all configured file-security checkers against the uploaded public URL.
+ *
+ * @private
+ */
+async function checkUploadedFileSecurity(storageUrl: string): Promise<Record<string, unknown>> {
+    const securityResults: Record<string, unknown> = {};
+
+    for (const checkerId of Object.keys(FILE_SECURITY_CHECKERS)) {
+        try {
+            const checker = FILE_SECURITY_CHECKERS[checkerId]!;
+            securityResults[checkerId] = await checker.checkFile(storageUrl);
+        } catch (error) {
+            securityResults[checkerId] = {
+                isSafe: false,
+                status: 'ERROR',
+                confidence: 0,
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
     }
 
-    return normalizedContentType;
+    return securityResults;
 }
 
 /**
- * Extracts normalized upload metadata from client payload.
+ * Stores security results for the file row created by `TrackedFilesStorage`.
  *
  * @private
  */
-function resolveUploadClientPayload(clientPayload: string | null | undefined): {
-    purpose: string;
-    contentType: string;
-} {
-    const payload = parseJsonRecord(clientPayload) as UploadClientPayload;
+async function updateUploadedFileSecurityResult(
+    storageUrl: string,
+    securityResult: Record<string, unknown>,
+): Promise<void> {
+    if (Object.keys(securityResult).length === 0) {
+        return;
+    }
 
-    return {
-        purpose: normalizeUploadPurpose(payload.purpose),
-        contentType: normalizeUploadContentType(payload.contentType),
-    };
+    const supabase = $provideSupabase();
+    const securityResultForDatabase =
+        securityResult as AgentsServerDatabase['public']['Tables']['File']['Update']['securityResult'];
+    const { error } = await supabase
+        .from(await $getTableName('File'))
+        .update({ securityResult: securityResultForDatabase })
+        .eq('storageUrl', storageUrl);
+
+    if (error) {
+        console.error('Failed to update uploaded file security result:', error);
+    }
+}
+
+/**
+ * Ensures the current server/domain can accept file uploads.
+ *
+ * @param providedServer - Current server routing context.
+ * @throws `NotAllowed` when uploads would be published without a server domain.
+ * @private
+ */
+function assertFileUploadAvailable(providedServer: ProvidedServer): void {
+    const fileUploadAvailability = resolveFileUploadAvailability({
+        serverId: providedServer.id,
+        serverPublicUrl: providedServer.publicUrl,
+        isSelfContainedS3StorageSelected: isSelfContainedS3StorageSelected(),
+    });
+
+    if (!fileUploadAvailability.isUploadAvailable) {
+        throw new NotAllowed(fileUploadAvailability.message || 'File uploads are not available for this server.');
+    }
 }
 
 /**
- * Handles post.
+ * Handles file upload requests.
  */
 export async function POST(request: NextRequest) {
     try {
-        const body = (await request.json()) as HandleUploadBody;
+        const providedServer = await $provideServer();
+        assertFileUploadAvailable(providedServer);
+
+        const { file, purpose, contentType } = await parseUploadRequest(request);
+        const fileBuffer = Buffer.from(await file.arrayBuffer());
+        const maxFileSize = await getMaxFileUploadSizeBytes();
+
+        if (fileBuffer.byteLength > maxFileSize) {
+            throw new LimitReachedError(
+                spaceTrim(`
+                    Uploaded file \`${file.name}\` exceeds the configured upload limit.
+
+                    Maximum supported size: **${maxFileSize} bytes**
+                `),
+            );
+        }
+
+        // [✨🏣] Compute a content-addressed CDN key so the public URL contains
+        // the file hash and does not expose the internal S3 bucket or path prefix.
+        const rawKey = getUserFileCdnKey(fileBuffer, file.name);
+        const pathname = getSafeCdnPath({
+            pathname: rawKey,
+            pathPrefix: process.env.NEXT_PUBLIC_CDN_PATH_PREFIX,
+        });
+
+        const cdn = $provideCdnForServer({
+            cdnPublicUrl: resolveCdnPublicUrlForServer(providedServer.publicUrl),
+        });
+        const storageUrl = cdn.getItemUrl(pathname).href;
         const userId = await getUserIdFromRequest(request);
-        const supabase: SupabaseClient<AgentsServerDatabase> = $provideSupabase();
-
-        // Handle Vercel Blob client upload protocol
-        const jsonResponse = await handleUpload({
-            body,
-            request,
-            token: process.env.VERCEL_BLOB_READ_WRITE_TOKEN!,
-            onBeforeGenerateToken: async (pathname, clientPayload) => {
-                // Authenticate user and validate upload
-
-                // Parse client payload for additional metadata
-                const { purpose, contentType } = resolveUploadClientPayload(clientPayload);
-
-                const maxFileSize = await getMaxFileUploadSizeBytes();
-
-                // Generate the proper path with prefix
-                // Note: With client uploads, we use the original filename provided by the client
-                // The file will be stored at: {pathPrefix}/user/files/{filename}
-                const pathPrefix = process.env.NEXT_PUBLIC_CDN_PATH_PREFIX || '';
-
-                // Create a DB record at the start of the upload to track it
-                const uploadPurpose = purpose;
-                const {
-                    data: insertedFile,
-                    error: insertError,
-                }: PostgrestSingleResponse<Pick<AgentsServerDatabase['public']['Tables']['File']['Row'], 'id'>> =
-                    await supabase
-                        .from(await $getTableName('File'))
-                        .insert({
-                            userId: userId || null,
-                            fileName: pathname,
-                            fileSize: 0, // <- Will be updated when upload completes
-                            fileType: contentType,
-                            storageUrl: null, // <- To be updated on completion
-                            shortUrl: null, // <- To be updated on completion
-                            purpose: uploadPurpose,
-                            status: 'UPLOADING',
-                        })
-                        .select('id')
-                        .single();
-
-                if (insertError) {
-                    console.error('🔼 Failed to create file record:', insertError);
-                }
-
-                console.info('🔼 Upload started, tracking file:', {
-                    pathname,
-                    fileId: insertedFile?.id,
-                    purpose: uploadPurpose,
-                });
-
-                return {
-                    maximumSizeInBytes: maxFileSize,
-                    addRandomSuffix: true, // Add random suffix to avoid filename collisions since we can't hash content
-                    tokenPayload: JSON.stringify({
-                        userId: userId || null,
-                        purpose: uploadPurpose,
-                        fileId: insertedFile?.id || null,
-                        uploadPath: pathname,
-                        pathPrefix,
-                    }),
-                };
-            },
-            onUploadCompleted: async ({ blob, tokenPayload }) => {
-                // !!!!
-                // ⚠️ IMPORTANT: This callback is a WEBHOOK called by Vercel's servers AFTER the upload completes
-                // - It runs in a DIFFERENT request context (not the original user request)
-                // - It WON'T work in local development (Vercel can't reach localhost)
-                // - All data must come from tokenPayload (userId, fileId, etc.)
-                // - Need to create a fresh supabase client here
-                console.info('🔼 Upload completed (webhook callback):', { blob, tokenPayload });
-
-                try {
-                    const payload = parseJsonRecord(tokenPayload);
-                    const fileId = typeof payload.fileId === 'number' ? payload.fileId : null;
-                    const tokenUserId = typeof payload.userId === 'number' ? payload.userId : null;
-                    const tokenPurpose = normalizeUploadPurpose(payload.purpose);
-                    const uploadPath = typeof payload.uploadPath === 'string' ? payload.uploadPath : null;
-
-                    // Create fresh supabase client for this webhook context
-                    const supabase = $provideSupabase();
-
-                    // Security checks
-                    const securityResults: Record<string, unknown> = {};
-                    const securityResultForDatabase =
-                        securityResults as AgentsServerDatabase['public']['Tables']['File']['Update']['securityResult'];
-                    for (const checkerId in FILE_SECURITY_CHECKERS) {
-                        try {
-                            const checker = FILE_SECURITY_CHECKERS[checkerId]!;
-                            console.info(`🛡️ Checking file security with ${checker.title} (${blob.url})...`);
-                            const result = await checker.checkFile(blob.url);
-                            securityResults[checkerId] = result;
-                            console.info(`🛡️ Security check result from ${checker.title}:`, result.status);
-                        } catch (error) {
-                            console.error(`🛡️ Security check failed for ${checkerId}:`, error);
-                            securityResults[checkerId] = {
-                                isSafe: false,
-                                status: 'ERROR',
-                                confidence: 0,
-                                message: error instanceof Error ? error.message : String(error),
-                            };
-                        }
-                    }
-
-                    if (fileId) {
-                        // Update the existing record by ID
-                        const { error: updateError } = await supabase
-                            .from(await $getTableName('File'))
-                            .update({
-                                userId: tokenUserId || null,
-                                fileSize: 0, // <- !!!!
-                                fileType: blob.contentType,
-                                storageUrl: blob.url,
-                                // <- TODO: !!!! Split between storageUrl and shortUrl
-                                purpose: tokenPurpose,
-                                status: 'COMPLETED',
-                                securityResult: securityResultForDatabase,
-                            })
-                            .eq('id', fileId);
-
-                        if (updateError) {
-                            console.error('🔼 Failed to update file record:', updateError);
-                        } else {
-                            console.info('🔼 File record updated successfully:', { fileId, shortUrl: blob.url });
-                        }
-                    } else if (uploadPath) {
-                        // Fallback: Update by uploadPath if fileId is not available
-                        const { error: updateError } = await supabase
-                            .from(await $getTableName('File'))
-                            .update({
-                                fileSize: 0, // <- !!!!
-                                fileType: blob.contentType,
-                                storageUrl: blob.url,
-                                status: 'COMPLETED',
-                                securityResult: securityResultForDatabase,
-                            })
-                            .eq('fileName', uploadPath)
-                            .eq('status', 'UPLOADING');
-
-                        if (updateError) {
-                            console.error('🔼 Failed to update file record by uploadPath:', updateError);
-                        }
-                    }
-                } catch (error) {
-                    console.error('🔼 Error in onUploadCompleted:', error);
-                }
-            },
+
+        await cdn.setItem(pathname, {
+            type: contentType,
+            data: fileBuffer,
+            purpose,
+            userId: userId || undefined,
+            fileSize: fileBuffer.byteLength,
         });
 
-        return NextResponse.json(jsonResponse);
+        const securityResult = await checkUploadedFileSecurity(storageUrl);
+        await updateUploadedFileSecurityResult(storageUrl, securityResult);
+
+        return NextResponse.json({
+            url: storageUrl,
+            pathname,
+            contentType,
+            size: fileBuffer.byteLength,
+        });
     } catch (error) {
         assertsError(error);
 
-        console.error('🔼', error);
+        console.error('Upload failed:', error);
+
+        const serializedError = serializeError(error);
 
-        return new Response(
-            JSON.stringify(
-                serializeError(error),
-                // <- TODO: [🐱‍🚀] Rename `serializeError` to `errorToJson`
-                null,
-                4,
-                // <- TODO: [🐱‍🚀] Allow to configure pretty print for agent server
-            ),
+        return NextResponse.json(
             {
-                status: 400, // <- TODO: [🐱‍🚀] Make `errorToHttpStatusCode`
-                headers: { 'Content-Type': 'application/json' },
+                ...serializedError,
+                error: serializedError.message,
+            },
+            {
+                status: error instanceof NotAllowed ? 403 : 400, // <- TODO: [🐱‍🚀] Make `errorToHttpStatusCode`
             },
         );
     }
 }
-
-// TODO: !!!! Change uploaded URLs from `storageUrl` to `shortUrl`
-// TODO: !!!! Record both `storageUrl` (actual storage location) and `shortUrl` in `File` table
-// TODO: !!!! Record `purpose` in `File` table
-// TODO: !!!! Record `userId` in `File` table
-// TODO: !!!! Record all things into `File` table
-// TODO: !!!! File type (mime type) of `.book` files should be `application/book` <- [🧠] !!!! Best mime type?!

package/apps/agents-server/src/app/api/users/[username]/route.ts

@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server';
 import { $provideSupabaseForServer } from '../../../../database/$provideSupabaseForServer';
 import { getPasswordValidationMessage, hashPassword } from '../../../../utils/auth';
 import { isUserAdmin } from '../../../../utils/isUserAdmin';
+import { PUBLIC_USER_SELECT_COLUMNS, toPublicUser, type PublicUser } from '../../../../utils/publicUser';
 
 /**
  * Handles patch.
@@ -34,7 +35,7 @@ export async function PATCH(request: Request, { params }: { params: Promise<{ us
             .from(await $getTableName('User'))
             .update(updates)
             .eq('username', usernameParam)
-            .select('id, username, createdAt, updatedAt, isAdmin')
+            .select(PUBLIC_USER_SELECT_COLUMNS)
             .single();
 
         if (error) {
@@ -45,7 +46,7 @@ export async function PATCH(request: Request, { params }: { params: Promise<{ us
             return NextResponse.json({ error: 'User not found' }, { status: 404 });
         }
 
-        return NextResponse.json(updatedUser);
+        return NextResponse.json(toPublicUser(updatedUser as unknown as PublicUser));
     } catch (error) {
         console.error('Update user error:', error);
         const passwordValidationMessage = getPasswordValidationMessage(error);

package/apps/agents-server/src/app/api/users/route.ts

@@ -2,6 +2,7 @@ import { $getTableName } from '@/src/database/$getTableName';
 import { $provideSupabaseForServer } from '../../../database/$provideSupabaseForServer';
 import { getPasswordValidationMessage, hashPassword } from '../../../utils/auth';
 import { isUserAdmin } from '../../../utils/isUserAdmin';
+import { PUBLIC_USER_SELECT_COLUMNS, toPublicUser, type PublicUser } from '../../../utils/publicUser';
 import { NextResponse } from 'next/server';
 
 /**
@@ -16,14 +17,14 @@ export async function GET() {
         const supabase = $provideSupabaseForServer();
         const { data: users, error } = await supabase
             .from(await $getTableName('User'))
-            .select('id, username, createdAt, updatedAt, isAdmin')
+            .select(PUBLIC_USER_SELECT_COLUMNS)
             .order('username');
 
         if (error) {
             throw error;
         }
 
-        return NextResponse.json(users);
+        return NextResponse.json(((users || []) as unknown as PublicUser[]).map(toPublicUser));
     } catch (error) {
         console.error('List users error:', error);
         return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
@@ -58,18 +59,18 @@ export async function POST(request: Request) {
                 createdAt: new Date().toISOString(),
                 updatedAt: new Date().toISOString(),
             })
-            .select('id, username, createdAt, updatedAt, isAdmin')
+            .select(PUBLIC_USER_SELECT_COLUMNS)
             .single();
 
         if (error) {
-            if (error.code === '23505') { // unique_violation
-                 return NextResponse.json({ error: 'Username already exists' }, { status: 409 });
+            if (error.code === '23505') {
+                // unique_violation
+                return NextResponse.json({ error: 'Username already exists' }, { status: 409 });
             }
             throw error;
         }
 
-        return NextResponse.json(newUser);
-
+        return NextResponse.json(toPublicUser(newUser as unknown as PublicUser));
     } catch (error) {
         console.error('Create user error:', error);
         const passwordValidationMessage = getPasswordValidationMessage(error);