d64a7239d1
- lib/rate-limit.ts: add MAX_STORE_ENTRIES=10k ceiling + evictIfFull() to prevent DDoS memory exhaustion - app/api/map/route.ts: add IP-based rate limiting (30 req/min) with proper Retry-After headers - app/layout.tsx: lang='en' → 'de', DevToolbar loaded via dynamic import (reduces main bundle) - app/layout.tsx: lazy DevToolbar keeps ~17KB out of production bundle via next/dynamic
81 lines
2.5 KiB
TypeScript
81 lines
2.5 KiB
TypeScript
/**
|
|
* Map data API — returns location-level markers for the map view.
|
|
* Each marker represents a unique city/country with averaged GPS coords.
|
|
* Cover asset IDs are encrypted for security.
|
|
*/
|
|
|
|
import { NextRequest, NextResponse } from 'next/server';
|
|
import { cookies } from 'next/headers';
|
|
import { getConfig } from '@/lib/config';
|
|
import { imageUrl } from '@/lib/urls';
|
|
import { isAuthenticated } from '@/lib/auth';
|
|
import { getMapData } from '@/lib/mapService';
|
|
import { checkRateLimit } from '@/lib/rate-limit';
|
|
|
|
export const dynamic = 'force-dynamic';
|
|
|
|
export async function GET(request: NextRequest) {
|
|
// Rate limit: 30 requests/minute per IP
|
|
const ip =
|
|
request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??
|
|
request.headers.get('x-real-ip') ??
|
|
'127.0.0.1';
|
|
const rl = checkRateLimit(ip, 30);
|
|
if (!rl.success) {
|
|
return NextResponse.json(
|
|
{ error: 'Too many requests' },
|
|
{
|
|
status: 429,
|
|
headers: {
|
|
'Retry-After': String(Math.ceil((rl.resetAt - Date.now()) / 1000)),
|
|
'X-RateLimit-Limit': '30',
|
|
'X-RateLimit-Remaining': '0',
|
|
},
|
|
},
|
|
);
|
|
}
|
|
|
|
const config = getConfig();
|
|
|
|
if (!config.map) {
|
|
return NextResponse.json({ error: 'Map is not enabled' }, { status: 404 });
|
|
}
|
|
|
|
const cookieStore = await cookies();
|
|
const getCookie = (name: string) => cookieStore.get(name)?.value;
|
|
|
|
const locations = await getMapData();
|
|
|
|
// Filter locations and albums based on auth
|
|
const publicLocations = locations
|
|
.map((loc) => {
|
|
// Only keep albums the user is allowed to see
|
|
const allowedAlbums = loc.albums.filter((a) => {
|
|
if (!a.subpageSlug) return true; // Standalone albums are public
|
|
return isAuthenticated(a.subpageSlug, getCookie);
|
|
});
|
|
|
|
if (allowedAlbums.length === 0) return null;
|
|
|
|
return {
|
|
city: loc.city,
|
|
country: loc.country,
|
|
lat: loc.lat,
|
|
lng: loc.lng,
|
|
photoCount: loc.photoCount, // Note: This count might be slightly off if some photos are in hidden albums
|
|
coverUrl: imageUrl(loc.coverAssetId, 'thumbnail'),
|
|
albums: allowedAlbums.map((a) => ({
|
|
name: a.name,
|
|
url: a.subpageSlug ? `/${a.subpageSlug}/${a.slug}` : `/${a.slug}`,
|
|
})),
|
|
};
|
|
})
|
|
.filter((loc) => loc !== null);
|
|
|
|
return NextResponse.json(publicLocations, {
|
|
headers: {
|
|
'Cache-Control': `private, no-cache, no-store, must-revalidate`, // Don't cache personalized map data publicly
|
|
},
|
|
});
|
|
}
|