Social asset hosting API for TikTok PULL_FROM_URL

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-10 11:01:56 +02:00
parent 0e7da4e4b1
commit 863e03f802
4 changed files with 202 additions and 0 deletions
--- a/src/app/(main)/api/social-assets/route.ts
+++ b/src/app/(main)/api/social-assets/route.ts
@@ -0,0 +1,128 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { db } from '@/lib/db';
+
+// Social asset hosting for TikTok PULL_FROM_URL (and other social APIs that
+// only accept public URLs on a verified domain). Assets are stored in
+// PostgreSQL so they survive container redeploys without extra volumes and
+// are served from qrmaster.net via GET /api/social-assets/[id].
+
+const isAdminRequest = (request: NextRequest) => {
+  const adminKey = process.env.TIKTOK_ADMIN_KEY;
+  if (!adminKey) return false;
+  const provided =
+    request.headers.get('x-admin-key') || request.nextUrl.searchParams.get('key');
+  return provided === adminKey;
+};
+
+const MAX_FILE_BYTES = 10 * 1024 * 1024;
+const ALLOWED_MIME_TYPES = new Set([
+  'image/jpeg',
+  'image/png',
+  'image/webp',
+  'video/mp4',
+]);
+
+// Schema changes in this repo are applied as raw SQL against the running
+// database (no Prisma migrations); this keeps the route self-bootstrapping.
+async function ensureTable() {
+  await db.$executeRawUnsafe(`
+    CREATE TABLE IF NOT EXISTS "SocialAsset" (
+      "id" TEXT PRIMARY KEY,
+      "filename" TEXT NOT NULL,
+      "mimeType" TEXT NOT NULL,
+      "data" BYTEA NOT NULL,
+      "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP
+    )
+  `);
+}
+
+export async function POST(request: NextRequest) {
+  if (!isAdminRequest(request)) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const json = await request.json().catch(() => null);
+  const rawFiles = Array.isArray(json?.files) ? json.files : json ? [json] : [];
+
+  if (!rawFiles.length) {
+    return NextResponse.json(
+      { error: 'Provide { files: [{ filename, mimeType, dataBase64 }] }.' },
+      { status: 400 }
+    );
+  }
+
+  const files: Array<{ filename: string; mimeType: string; data: Buffer }> = [];
+  for (const file of rawFiles) {
+    const filename = String(file?.filename || '').trim();
+    const mimeType = String(file?.mimeType || '').trim().toLowerCase();
+    const dataBase64 = String(file?.dataBase64 || '');
+
+    if (!filename || !mimeType || !dataBase64) {
+      return NextResponse.json(
+        { error: 'Each file needs filename, mimeType and dataBase64.' },
+        { status: 400 }
+      );
+    }
+    if (!ALLOWED_MIME_TYPES.has(mimeType)) {
+      return NextResponse.json(
+        { error: `Unsupported mimeType: ${mimeType}` },
+        { status: 400 }
+      );
+    }
+
+    const data = Buffer.from(dataBase64, 'base64');
+    if (!data.length || data.length > MAX_FILE_BYTES) {
+      return NextResponse.json(
+        { error: `File ${filename} is empty or exceeds ${MAX_FILE_BYTES} bytes.` },
+        { status: 400 }
+      );
+    }
+
+    files.push({ filename, mimeType, data });
+  }
+
+  try {
+    await ensureTable();
+
+    const baseUrl = process.env.NEXTAUTH_URL || 'https://qrmaster.net';
+    const assets = [];
+    for (const file of files) {
+      const asset = await db.socialAsset.create({
+        data: {
+          filename: file.filename,
+          mimeType: file.mimeType,
+          data: file.data,
+        },
+        select: { id: true, filename: true, mimeType: true, createdAt: true },
+      });
+      assets.push({
+        ...asset,
+        url: `${baseUrl.replace(/\/$/, '')}/api/social-assets/${asset.id}`,
+      });
+    }
+
+    return NextResponse.json({ assets });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : 'Unknown error';
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}
+
+export async function GET(request: NextRequest) {
+  if (!isAdminRequest(request)) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  try {
+    await ensureTable();
+    const assets = await db.socialAsset.findMany({
+      select: { id: true, filename: true, mimeType: true, createdAt: true },
+      orderBy: { createdAt: 'desc' },
+      take: 100,
+    });
+    return NextResponse.json({ assets });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : 'Unknown error';
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}