b615fac865
Extract shared 401/403 gate into permission-middleware and sweep the four inline admin checks (import MTG/Pokemon, sync-catalog, card-submissions). Co-authored-by: Cursor <cursoragent@cursor.com>
37 lines
1.1 KiB
JavaScript
37 lines
1.1 KiB
JavaScript
import { withAdmin } from '../../../lib/permission-middleware';
|
|
import { checkImportRateLimit } from '../../../lib/rate-limit.js';
|
|
import { importMtgSet } from '../../../lib/card-import/mtg.js';
|
|
|
|
export default withAdmin(async function handler(req, res, user) {
|
|
if (req.method !== 'POST') {
|
|
return res.status(405).json({ error: 'Method not allowed' });
|
|
}
|
|
|
|
const { allowed, reset } = await checkImportRateLimit(req, user.userId);
|
|
if (!allowed) {
|
|
res.setHeader('Retry-After', Math.ceil((reset - Date.now()) / 1000));
|
|
return res.status(429).json({ error: 'Too many attempts. Try again later.' });
|
|
}
|
|
|
|
try {
|
|
const { setCode } = req.body;
|
|
|
|
if (!setCode) {
|
|
return res.status(400).json({ error: 'Set code is required' });
|
|
}
|
|
|
|
const result = await importMtgSet(setCode);
|
|
|
|
return res.status(200).json({
|
|
success: true,
|
|
message: `Import completed for set ${setCode}`,
|
|
...result,
|
|
});
|
|
} catch (error) {
|
|
console.error('Card import error:', error);
|
|
return res.status(500).json({
|
|
error: 'Import failed',
|
|
details: error.message,
|
|
});
|
|
}
|
|
});
|