Social asset hosting API for TikTok PULL_FROM_URL

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/app/(main)/api/social-assets/[id]/route.ts

@@ -0,0 +1,59 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+
+// Public delivery route: TikTok (and other social platforms) pull media from
+// these URLs, so GET must stay unauthenticated. IDs are unguessable cuids.
+
+export async function GET(
+  _request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  const id = String(params?.id || '').trim();
+  if (!id) {
+    return NextResponse.json({ error: 'Asset id is required.' }, { status: 400 });
+  }
+
+  try {
+    const asset = await db.socialAsset.findUnique({ where: { id } });
+    if (!asset) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+
+    return new NextResponse(new Uint8Array(asset.data), {
+      status: 200,
+      headers: {
+        'Content-Type': asset.mimeType,
+        'Content-Length': String(asset.data.length),
+        'Cache-Control': 'public, max-age=31536000, immutable',
+        'Content-Disposition': `inline; filename="${asset.filename.replace(/[^\w.\-]/g, '_')}"`,
+      },
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : 'Unknown error';
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}
+
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  const adminKey = process.env.TIKTOK_ADMIN_KEY;
+  const provided =
+    request.headers.get('x-admin-key') || request.nextUrl.searchParams.get('key');
+  if (!adminKey || provided !== adminKey) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const id = String(params?.id || '').trim();
+  if (!id) {
+    return NextResponse.json({ error: 'Asset id is required.' }, { status: 400 });
+  }
+
+  try {
+    await db.socialAsset.delete({ where: { id } });
+    return NextResponse.json({ deleted: id });
+  } catch {
+    return NextResponse.json({ error: 'Not found' }, { status: 404 });
+  }
+}