TikTok V5 + Security

src/app/(main)/api/user/debug/route.ts

@@ -1,12 +1,17 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
+import { getSessionUserId } from '@/lib/session';
 import { db } from '@/lib/db';
 
 export const dynamic = 'force-dynamic';
 
 export async function GET(request: NextRequest) {
   try {
-    const userId = cookies().get('userId')?.value;
+    // Debug endpoint must never be reachable in production
+    if (process.env.NODE_ENV === 'production') {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+
+    const userId = getSessionUserId();
     if (!userId) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
     }

src/app/(main)/api/user/delete/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { cookies } from 'next/headers';
+import { getSessionUserId } from '@/lib/session';
 import { db } from '@/lib/db';
 import { stripe } from '@/lib/stripe';
 import { csrfProtection } from '@/lib/csrf';
@@ -16,7 +17,7 @@ export async function DELETE(request: NextRequest) {
       );
     }
 
-    const userId = cookies().get('userId')?.value;
+    const userId = getSessionUserId();
 
     // Rate Limiting (user-based)
     const clientId = userId || getClientIdentifier(request);

src/app/(main)/api/user/password/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
+import { getSessionUserId } from '@/lib/session';
 import { db } from '@/lib/db';
 import bcrypt from 'bcryptjs';
 import { csrfProtection } from '@/lib/csrf';
@@ -17,7 +17,7 @@ export async function PATCH(request: NextRequest) {
       );
     }
 
-    const userId = cookies().get('userId')?.value;
+    const userId = getSessionUserId();
 
     // Rate Limiting (user-based)
     const clientId = userId || getClientIdentifier(request);

src/app/(main)/api/user/plan/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
+import { getSessionUserId } from '@/lib/session';
 import { db } from '@/lib/db';
 import { STRIPE_PLANS } from '@/lib/stripe';
 
@@ -8,7 +8,7 @@ export const dynamic = 'force-dynamic';
 export async function GET(request: NextRequest) {
   try {
     // Use cookie-based auth instead of NextAuth
-    const userId = cookies().get('userId')?.value;
+    const userId = getSessionUserId();
 
     if (!userId) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });

src/app/(main)/api/user/profile/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
+import { getSessionUserId } from '@/lib/session';
 import { db } from '@/lib/db';
 import { csrfProtection } from '@/lib/csrf';
 import { updateProfileSchema, validateRequest } from '@/lib/validationSchemas';
@@ -13,7 +13,7 @@ export async function PATCH(request: NextRequest) {
       return NextResponse.json({ error: csrfCheck.error }, { status: 403 });
     }
 
-    const userId = cookies().get('userId')?.value;
+    const userId = getSessionUserId();
 
     // Rate Limiting (user-based)
     const clientId = userId || getClientIdentifier(request);

src/app/(main)/api/user/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
+import { getSessionUserId } from '@/lib/session';
 import { db } from '@/lib/db';
 
 // Force dynamic rendering (required for cookies)
@@ -11,7 +11,7 @@ export const dynamic = 'force-dynamic';
  */
 export async function GET(request: NextRequest) {
   try {
-    const userId = cookies().get('userId')?.value;
+    const userId = getSessionUserId();
 
     if (!userId) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });

src/app/(main)/api/user/stats/route.ts

@@ -1,12 +1,12 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { cookies } from 'next/headers';
+import { getSessionUserId } from '@/lib/session';
 import { db } from '@/lib/db';
 
 export const dynamic = 'force-dynamic';
 
 export async function GET(request: NextRequest) {
   try {
-    const userId = cookies().get('userId')?.value;
+    const userId = getSessionUserId();
     if (!userId) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
     }