|
| 1 | +import { NextResponse } from "next/server"; |
| 2 | +import { connectToDatabase } from "@/lib/database/mongoose"; |
| 3 | +import TagReport from "@/db/tagReport"; |
| 4 | +import { Ratelimit } from "@upstash/ratelimit"; |
| 5 | +import { redis } from "@/lib/utils/redis"; |
| 6 | +import { exams } from "@/components/select_options"; |
| 7 | + |
| 8 | +interface ReportedFieldInput { |
| 9 | + field: string; |
| 10 | + value?: string; |
| 11 | +} |
| 12 | +const ALLOWED_FIELDS = ["subject", "courseCode", "exam", "slot", "year"]; |
| 13 | + |
| 14 | +const ratelimit = new Ratelimit({ |
| 15 | + redis, |
| 16 | + limiter: Ratelimit.slidingWindow(3, "1 h"),//per id - 3 request - per hour |
| 17 | + analytics: true, |
| 18 | +}); |
| 19 | + |
| 20 | +function getClientIp(req: Request & { ip?: string}): string { |
| 21 | + return req.ip || "127.0.0.1"; |
| 22 | +} |
| 23 | + |
| 24 | +export async function POST(req: Request & { ip?: string }) { |
| 25 | + try { |
| 26 | + await connectToDatabase(); |
| 27 | + |
| 28 | + const body = await req.json(); |
| 29 | + const { paperId } = body; |
| 30 | + |
| 31 | + if (!paperId) { |
| 32 | + return NextResponse.json( |
| 33 | + { error: "paperId is required" }, |
| 34 | + { status: 400 } |
| 35 | + ); |
| 36 | + } |
| 37 | + const ip = getClientIp(req); |
| 38 | + const key = `${ip}::${paperId}`; |
| 39 | + const { success } = await ratelimit.limit(key); |
| 40 | + |
| 41 | + if (!success) { |
| 42 | + return NextResponse.json( |
| 43 | + { error: "Rate limit exceeded for reporting." }, |
| 44 | + { status: 429 } |
| 45 | + ); |
| 46 | + } |
| 47 | + const MAX_REPORTS_PER_PAPER = 5; |
| 48 | + const count = await TagReport.countDocuments({ paperId }); |
| 49 | + |
| 50 | + if (count >= MAX_REPORTS_PER_PAPER) { |
| 51 | + return NextResponse.json( |
| 52 | + { error: "Received many reports; we are currently working on it." }, |
| 53 | + { status: 429 } |
| 54 | + ); |
| 55 | + } |
| 56 | + const reportedFields: ReportedFieldInput[] = Array.isArray(body.reportedFields) |
| 57 | + ? body.reportedFields |
| 58 | + .map((r:Partial<ReportedFieldInput>) => ({ |
| 59 | + field: typeof r.field === "string" ? r.field.trim() : "", |
| 60 | + value: typeof r.value === "string" ? r.value.trim() : undefined, |
| 61 | + })) |
| 62 | + .filter((r:Partial<ReportedFieldInput>) => r.field) |
| 63 | + : []; |
| 64 | + |
| 65 | + for (const rf of reportedFields) { |
| 66 | + if (!ALLOWED_FIELDS.includes(rf.field)) { |
| 67 | + return NextResponse.json( |
| 68 | + { error: `Invalid field: ${rf.field}` }, |
| 69 | + { status: 400 } |
| 70 | + ); |
| 71 | + } |
| 72 | + if (rf.field === "exam" && rf.value) { |
| 73 | + if (!exams.some(e => e.toLowerCase() === rf.value?.toLowerCase())) { |
| 74 | + return NextResponse.json( |
| 75 | + { error: `Invalid exam value: ${rf.value}` }, |
| 76 | + { status: 400 } |
| 77 | + ); |
| 78 | + } |
| 79 | + } |
| 80 | + } |
| 81 | + |
| 82 | + const newReport = await TagReport.create({ |
| 83 | + paperId, |
| 84 | + reportedFields, |
| 85 | + comment: body.comment, |
| 86 | + reporterEmail: body.reporterEmail, |
| 87 | + reporterId: body.reporterId, |
| 88 | + }); |
| 89 | + |
| 90 | + return NextResponse.json( |
| 91 | + { message: "Report submitted.", report: newReport }, |
| 92 | + { status: 201 } |
| 93 | + ); |
| 94 | + } catch (err) { |
| 95 | + console.error(err); |
| 96 | + return NextResponse.json( |
| 97 | + { error: "Failed to submit tag report." }, |
| 98 | + { status: 500 } |
| 99 | + ); |
| 100 | + } |
| 101 | +} |
0 commit comments