Audit fixes: VIP self-grant, draft leak, onboarding flag, hero personalization, gated downloads

web/src/app/api/files/[id]/route.ts

@@ -0,0 +1,49 @@
+import { NextResponse } from 'next/server'
+import { readFile } from 'node:fs/promises'
+import path from 'node:path'
+import { getPayload } from 'payload'
+import configPromise from '@payload-config'
+import { FILES_DIR } from '@/collections/Files'
+import { getViewer } from '@/lib/viewer'
+
+export const dynamic = 'force-dynamic'
+
+type FileDoc = { id: number; access: 'free' | 'vip'; filename: string; mimeType: string }
+
+/* GET /api/files/[id] — per-post work files, gated per file.
+   `free` streams to anyone; `vip` requires a signed-in vip/admin (same style
+   as the comments route). The Files collection read rule is defense in depth;
+   this route is the enforcement point for the bytes. */
+export async function GET(_req: Request, ctx: { params: Promise<{ id: string }> }) {
+  const { id } = await ctx.params
+  const payload = await getPayload({ config: configPromise })
+
+  let doc: FileDoc | null = null
+  try {
+    doc = (await payload.findByID({ collection: 'files', id, depth: 0, overrideAccess: true })) as unknown as FileDoc
+  } catch {
+    doc = null // unknown id / DB error → not found
+  }
+  if (!doc?.filename) return NextResponse.json({ error: 'الملف غير موجود.' }, { status: 404 })
+
+  if (doc.access === 'vip') {
+    const viewer = await getViewer()
+    if (!viewer) return NextResponse.json({ error: 'سجّل الدخول لتنزيل الملفات.' }, { status: 401 })
+    if (viewer.role !== 'vip' && viewer.role !== 'admin') {
+      return NextResponse.json({ error: 'التنزيل متاح لأعضاء العضوية.' }, { status: 403 })
+    }
+  }
+
+  try {
+    const buf = await readFile(path.join(FILES_DIR, doc.filename))
+    return new NextResponse(new Uint8Array(buf), {
+      headers: {
+        'Content-Type': doc.mimeType,
+        'Content-Disposition': `attachment; filename*=UTF-8''${encodeURIComponent(doc.filename)}`,
+      },
+    })
+  } catch {
+    // Row exists but the file is missing on disk — do not leak a fake download.
+    return NextResponse.json({ error: 'الملف غير موجود.' }, { status: 404 })
+  }
+}