chore: add build artifacts and git objects to version control

Author: PTOM76

app/[locale]/admin/config/page.tsx

@@ -1,7 +1,7 @@
 import Typography from "@mui/material/Typography";
 import Box from "@mui/material/Box";
 import { getTranslations, setRequestLocale } from "next-intl/server";
-import { getD1, getDb } from "@/lib/db";
+import { getAdminDb } from "@/lib/auth-helpers";
 import { tags, platforms } from "@/db/schema";
 import ConfigClient from "./ConfigClient";
 
@@ -10,8 +10,7 @@ export default async function AdminConfigPage({ params }: { params: Promise<{ lo
   setRequestLocale(locale);
   const tAdmin = await getTranslations("Admin.config");
 
-  const d1 = await getD1();
-  const db = getDb(d1);
+  const { db } = await getAdminDb();
 
   const [allTags, allPlatforms] = await Promise.all([
     db.select().from(tags).all(),

app/[locale]/admin/ideas/page.tsx

@@ -1,4 +1,4 @@
-import { getDatabase } from "@/lib/db";
+import { getAdminDb } from "@/lib/auth-helpers";
 import { ideas, users, userProfiles } from "@/db/schema";
 import { desc, eq } from "drizzle-orm";
 import Typography from "@mui/material/Typography";
@@ -10,7 +10,7 @@ export default async function AdminIdeasPage({ params }: { params: Promise<{ loc
   setRequestLocale(locale);
   const tAdmin = await getTranslations("Admin.ideas");
 
-  const db = await getDatabase();
+  const { db } = await getAdminDb();
   const allIdeas = await db
     .select({
       id: ideas.id,

app/[locale]/admin/page.tsx

@@ -6,7 +6,7 @@ import CardContent from "@mui/material/CardContent";
 import Stack from "@mui/material/Stack";
 import Box from "@mui/material/Box";
 import Button from "@mui/material/Button";
-import { auth } from "@/lib/auth";
+import { getAdminDb } from "@/lib/auth-helpers";
 import { redirect } from "next/navigation";
 import { setRequestLocale, getTranslations } from "next-intl/server";
 import { Link } from "@/i18n/routing";
@@ -22,8 +22,11 @@ export default async function AdminDashboardPage({ params }: AdminDashboardProps
   const { locale } = await params;
   setRequestLocale(locale);
 
-  const session = await auth();
-  if (session?.user?.role !== "admin") redirect("/");
+  try {
+    await getAdminDb();
+  } catch (e) {
+    redirect("/");
+  }
 
   const tAdmin = await getTranslations("Admin");
 

app/[locale]/admin/projects/page.tsx

@@ -1,4 +1,4 @@
-import { getDatabase } from "@/lib/db";
+import { getAdminDb } from "@/lib/auth-helpers";
 import { projects, users, userProfiles } from "@/db/schema";
 import { desc, eq } from "drizzle-orm";
 import Typography from "@mui/material/Typography";
@@ -10,7 +10,7 @@ export default async function AdminProjectsPage({ params }: { params: Promise<{
   setRequestLocale(locale);
   const tAdmin = await getTranslations("Admin.projects");
 
-  const db = await getDatabase();
+  const { db } = await getAdminDb();
   const allProjects = await db
     .select({
       id: projects.id,

app/[locale]/admin/reports/page.tsx

@@ -7,7 +7,7 @@ import Chip from "@mui/material/Chip";
 import Button from "@mui/material/Button";
 import Stack from "@mui/material/Stack";
 import Divider from "@mui/material/Divider";
-import { auth } from "@/lib/auth";
+import { getAdminDb } from "@/lib/auth-helpers";
 import { redirect } from "next/navigation";
 import { setRequestLocale, getTranslations } from "next-intl/server";
 import { Link } from "@/i18n/routing";
@@ -21,8 +21,11 @@ export default async function AdminReportsPage({ params }: AdminReportsPageProps
   const { locale } = await params;
   setRequestLocale(locale);
 
-  const session = await auth();
-  if (session?.user?.role !== "admin") redirect("/");
+  try {
+    await getAdminDb();
+  } catch (e) {
+    redirect("/");
+  }
 
   const tAdmin = await getTranslations("Admin");
   const reports = await getReports();

app/[locale]/admin/users/page.tsx

@@ -1,4 +1,4 @@
-import { getDatabase } from "@/lib/db";
+import { getAdminDb } from "@/lib/auth-helpers";
 import { users, userProfiles } from "@/db/schema";
 import { desc, eq } from "drizzle-orm";
 import Typography from "@mui/material/Typography";
@@ -10,7 +10,7 @@ export default async function AdminUsersPage({ params }: { params: Promise<{ loc
   setRequestLocale(locale);
   const tAdmin = await getTranslations("Admin.users");
 
-  const db = await getDatabase();
+  const { db } = await getAdminDb();
   const { isNull } = await import("drizzle-orm");
   const allUsers = await db.select({
       id: users.id,

lib/actions/auth.ts

@@ -215,6 +215,8 @@ export async function resetPasswordWithToken(formData: FormData) {
   const newPassword = formData.get("password") as string;
 
   if (!token || !newPassword) return { error: "invalidData" };
+  
+  if (newPassword.length < 8) return { error: "passwordLength" };
 
   const { checkRateLimit } = await import("@/lib/rate-limit");
   const rlRes = await checkRateLimit("reset_password_confirm", 5, 15 * 60 * 1000);

lib/actions/favorite.ts

@@ -100,6 +100,10 @@ export async function toggleCookieFavorite(projectId: string) {
   if (favorites.includes(projectId)) {
     favorites = favorites.filter(id => id !== projectId);
   } else {
+    // M-4: Limit max cookie favorites to 50 to prevent DoS via huge cookie size
+    if (favorites.length >= 50) {
+      favorites.shift(); // Remove the oldest favorite
+    }
     favorites.push(projectId);
     favorited = true;
   }

lib/auth-helpers.ts

@@ -30,11 +30,18 @@ export async function getAdminDb() {
  * 権限がない場合は "Forbidden" エラーをスローします。
  */
 export async function assertProjectAccess(db: any, project: { id: string; authorId: string }, session: any) {
-  if (project.authorId === session.user.id || session.user.role === "admin") {
-    return true; // Author or Admin
+  if (project.authorId === session.user.id) {
+    return true; // Author
   }
-  const { projectMembers } = await import("@/db/schema");
+  
+  const { users, projectMembers } = await import("@/db/schema");
   const { eq, and } = await import("drizzle-orm");
+  
+  const dbUser = await db.select({ role: users.role }).from(users).where(eq(users.id, session.user.id)).get();
+  if (dbUser?.role === "admin") {
+    return true; // Admin
+  }
+
   const member = await db.select()
     .from(projectMembers)
     .where(and(eq(projectMembers.projectId, project.id), eq(projectMembers.userId, session.user.id)))