x

apps/backend/src/routes/pages.ts

@@ -7,6 +7,14 @@ import {
   QuoteCalloutPayloadSchema,
   ProductCarouselPayloadSchema
 } from "@homaroma/types";
+import { adminOnly } from "../middleware/auth";
+
+const RESERVED_SLUGS = [
+  "shop", "category", "products", "cart", "checkout", "account", "search", 
+  "contact", "login", "admin", "wishlist", "track", "coupons", "scent-guide", 
+  "faq", "about", "profile", "article", "pages", "orders", "customers", 
+  "settings", "menus", "auth", "api"
+];
 
 export const pagesRoute = new Elysia({ prefix: "/pages" })
   .get("/", async () => {
@@ -118,10 +126,52 @@ export const pagesRoute = new Elysia({ prefix: "/pages" })
       sections: populatedSections
     };
   })
+  .get("/:slug/sections", async ({ params: { slug }, set }) => {
+    try {
+      return await prisma.pageSection.findMany({
+        where: { pageId: Number(slug) },
+        orderBy: { order: "asc" }
+      });
+    } catch (err) {
+      set.status = 500;
+      return { error: "Failed to fetch page sections" };
+    }
+  })
+  .post("/newsletter", async ({ body, set }) => {
+    try {
+      const { email } = body as { email: string };
+      if (!email || !email.includes("@")) {
+        set.status = 400;
+        return { error: "Invalid email address" };
+      }
+
+      const sub = await prisma.newsletterSubscription.upsert({
+        where: { email },
+        update: {},
+        create: { email }
+      });
+      return { success: true, data: sub };
+    } catch (err) {
+      console.error("[Newsletter] Error:", err);
+      set.status = 500;
+      return { error: "Failed to subscribe" };
+    }
+  }, {
+    body: t.Object({
+      email: t.String()
+    })
+  })
+  .use(adminOnly)
   .post("/", async ({ body, set }) => {
     try {
       const data = body as any;
       const { id, slug, title, isPublished, status, metadata } = data;
+      
+      if (typeof slug === 'string' && RESERVED_SLUGS.includes(slug.toLowerCase())) {
+        set.status = 400;
+        return { error: "Reserved slug cannot be used" };
+      }
+
       let finalIsPublished = true;
       if (status !== undefined) {
         finalIsPublished = status === "published";
@@ -165,17 +215,6 @@ export const pagesRoute = new Elysia({ prefix: "/pages" })
       return { error: "Failed to delete page" };
     }
   })
-  .get("/:slug/sections", async ({ params: { slug }, set }) => {
-    try {
-      return await prisma.pageSection.findMany({
-        where: { pageId: Number(slug) },
-        orderBy: { order: "asc" }
-      });
-    } catch (err) {
-      set.status = 500;
-      return { error: "Failed to fetch page sections" };
-    }
-  })
   .post("/:slug/sections", async ({ params: { slug }, body, set }) => {
     try {
       const pageId = Number(slug);
@@ -280,30 +319,6 @@ export const pagesRoute = new Elysia({ prefix: "/pages" })
       }))
     })
   })
-  .post("/newsletter", async ({ body, set }) => {
-    try {
-      const { email } = body as { email: string };
-      if (!email || !email.includes("@")) {
-        set.status = 400;
-        return { error: "Invalid email address" };
-      }
-
-      const sub = await prisma.newsletterSubscription.upsert({
-        where: { email },
-        update: {},
-        create: { email }
-      });
-      return { success: true, data: sub };
-    } catch (err) {
-      console.error("[Newsletter] Error:", err);
-      set.status = 500;
-      return { error: "Failed to subscribe" };
-    }
-  }, {
-    body: t.Object({
-      email: t.String()
-    })
-  })
   .delete("/sections/:sectionId", async ({ params: { sectionId }, set }) => {
     try {
       await prisma.pageSection.delete({