TikTok V5 + Security

src/app/(main)/api/qrs/[id]/feedback/route.ts

@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getServerSession } from 'next-auth';
 import { authOptions } from '@/lib/auth';
 import { db } from '@/lib/db';
-import { cookies } from 'next/headers';
+import { getSessionUserId } from '@/lib/session';
 
 export async function GET(
     request: NextRequest,
@@ -16,9 +16,8 @@ export async function GET(
         if (session?.user?.id) {
             userId = session.user.id;
         } else {
-            // Fallback: Check raw userId cookie (like /api/user does)
-            const cookieStore = await cookies();
-            userId = cookieStore.get('userId')?.value;
+            // Fallback: verified signed userId cookie (like /api/user does)
+            userId = getSessionUserId() ?? undefined;
         }
 
         if (!userId) {

src/app/(main)/api/qrs/[id]/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
+import { getSessionUserId } from '@/lib/session';
 import { db } from '@/lib/db';
 import { z } from 'zod';
 import { csrfProtection } from '@/lib/csrf';
@@ -18,7 +18,7 @@ export async function GET(
   { params }: { params: { id: string } }
 ) {
   try {
-    const userId = cookies().get('userId')?.value;
+    const userId = getSessionUserId();
     if (!userId) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
     }
@@ -62,7 +62,7 @@ export async function PATCH(
       return NextResponse.json({ error: csrfCheck.error }, { status: 403 });
     }
 
-    const userId = cookies().get('userId')?.value;
+    const userId = getSessionUserId();
 
     // Rate Limiting (user-based)
     const clientId = userId || getClientIdentifier(request);
@@ -151,7 +151,7 @@ export async function DELETE(
       return NextResponse.json({ error: csrfCheck.error }, { status: 403 });
     }
 
-    const userId = cookies().get('userId')?.value;
+    const userId = getSessionUserId();
 
     // Rate Limiting (user-based)
     const clientId = userId || getClientIdentifier(request);

src/app/(main)/api/qrs/delete-all/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
+import { getSessionUserId } from '@/lib/session';
 import { db } from '@/lib/db';
 import { csrfProtection } from '@/lib/csrf';
 import { rateLimit, getClientIdentifier, RateLimits } from '@/lib/rateLimit';
@@ -15,7 +15,7 @@ export async function DELETE(request: NextRequest) {
       );
     }
 
-    const userId = cookies().get('userId')?.value;
+    const userId = getSessionUserId();
 
     // Rate Limiting (user-based)
     const clientId = userId || getClientIdentifier(request);

src/app/(main)/api/qrs/route.ts

@@ -1,17 +1,17 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
+import { getSessionUserId } from '@/lib/session';
 import { db } from '@/lib/db';
-import { generateSlug } from '@/lib/hash';
-import { createQRSchema, validateRequest } from '@/lib/validationSchemas';
-import { csrfProtection } from '@/lib/csrf';
-import { rateLimit, getClientIdentifier, RateLimits } from '@/lib/rateLimit';
-import { DYNAMIC_QR_LIMITS } from '@/lib/plans';
-import { triggerLifecycleScoring } from '@/lib/revops-server';
+import { generateSlug } from '@/lib/hash';
+import { createQRSchema, validateRequest } from '@/lib/validationSchemas';
+import { csrfProtection } from '@/lib/csrf';
+import { rateLimit, getClientIdentifier, RateLimits } from '@/lib/rateLimit';
+import { DYNAMIC_QR_LIMITS } from '@/lib/plans';
+import { triggerLifecycleScoring } from '@/lib/revops-server';
 
 // GET /api/qrs - List user's QR codes
 export async function GET(request: NextRequest) {
   try {
-    const userId = cookies().get('userId')?.value;
+    const userId = getSessionUserId();
     if (!userId) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
     }
@@ -49,7 +49,7 @@ export async function GET(request: NextRequest) {
 }
 
 // Plan limits
-const PLAN_LIMITS = DYNAMIC_QR_LIMITS;
+const PLAN_LIMITS = DYNAMIC_QR_LIMITS;
 
 // POST /api/qrs - Create a new QR code
 export async function POST(request: NextRequest) {
@@ -60,7 +60,7 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: csrfCheck.error }, { status: 403 });
     }
 
-    const userId = cookies().get('userId')?.value;
+    const userId = getSessionUserId();
 
     // Rate Limiting (user-based)
     const clientId = userId || getClientIdentifier(request);
@@ -205,9 +205,9 @@ END:VCARD`;
     const slug = generateSlug(body.title);
 
     // Create QR code
-    const qrCode = await db.qRCode.create({
-      data: {
-        userId,
+    const qrCode = await db.qRCode.create({
+      data: {
+        userId,
         title: body.title,
         type: isStatic ? 'STATIC' : 'DYNAMIC',
         contentType: body.contentType,
@@ -221,12 +221,12 @@ END:VCARD`;
         },
         slug,
         status: 'ACTIVE',
-      },
-    });
-
-    triggerLifecycleScoring(userId, 'qr_created');
-
-    return NextResponse.json(qrCode);
+      },
+    });
+
+    triggerLifecycleScoring(userId, 'qr_created');
+
+    return NextResponse.json(qrCode);
   } catch (error) {
     console.error('Error creating QR code:', error);
     return NextResponse.json(
@@ -234,4 +234,4 @@ END:VCARD`;
       { status: 500 }
     );
   }
-}
+}

src/app/(main)/api/qrs/static/route.ts

@@ -1,12 +1,12 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
+import { getSessionUserId } from '@/lib/session';
 import { db } from '@/lib/db';
 import { generateSlug } from '@/lib/hash';
 
 // POST /api/qrs/static - Create a STATIC QR code that contains the direct URL
 export async function POST(request: NextRequest) {
   try {
-    const userId = cookies().get('userId')?.value;
+    const userId = getSessionUserId();
     if (!userId) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
     }