使用openai进行了代码review

src/app/api/pages/route.ts

@@ -1,14 +1,45 @@
-import { NextResponse } from 'next/server';
+import { NextResponse } from 'next/server';
 import { prisma } from '@/lib/prisma';
+import { requireApiAuth } from '@/lib/api-auth';
+
+const MAX_TITLE_LENGTH = 200;
+const MAX_TAGS = 20;
+const MAX_TAG_LENGTH = 50;
+
+function safeParseTags(tags: string | null): string[] {
+    if (!tags) return [];
+    try {
+        const parsed = JSON.parse(tags);
+        return Array.isArray(parsed) ? parsed.filter((t): t is string => typeof t === 'string') : [];
+    } catch {
+        return [];
+    }
+}
+
+function normalizeTags(input: unknown): string[] {
+    if (!Array.isArray(input)) return [];
+    const unique = new Set<string>();
+    for (const raw of input) {
+        if (typeof raw !== 'string') continue;
+        const normalized = raw.trim();
+        if (!normalized || normalized.length > MAX_TAG_LENGTH) continue;
+        unique.add(normalized);
+        if (unique.size >= MAX_TAGS) break;
+    }
+    return Array.from(unique);
+}
 
 export async function GET() {
+    const authError = await requireApiAuth();
+    if (authError) return authError;
+
     try {
         const pages = await prisma.page.findMany({
             orderBy: [{ order: 'asc' }, { createdAt: 'desc' }],
         });
-        const parsedPages = pages.map(p => ({
+        const parsedPages = pages.map((p) => ({
             ...p,
-            tags: JSON.parse(p.tags || "[]")
+            tags: safeParseTags(p.tags),
         }));
         return NextResponse.json(parsedPages);
     } catch {
@@ -17,30 +48,59 @@ export async function GET() {
 }
 
 export async function POST(request: Request) {
+    const authError = await requireApiAuth();
+    if (authError) return authError;
+
     try {
-        const body = await request.json();
-        const { title, content, parentId, type } = body;
+        const body = await request.json().catch(() => null);
+        if (!body || typeof body !== 'object') {
+            return NextResponse.json({ error: 'Invalid request body' }, { status: 400 });
+        }
+
+        const rawTitle = typeof body.title === 'string' ? body.title.trim() : '';
+        const title = rawTitle || '无标题';
+        if (title.length > MAX_TITLE_LENGTH) {
+            return NextResponse.json({ error: 'Title too long' }, { status: 400 });
+        }
+
+        const type = body.type === 'folder' ? 'folder' : 'file';
+        const content = typeof body.content === 'string' ? body.content : '';
+        const parentId = typeof body.parentId === 'string' ? body.parentId : null;
+        const tags = normalizeTags(body.tags);
+        const icon = typeof body.icon === 'string' ? body.icon : null;
+        const isLocked = typeof body.isLocked === 'boolean' ? body.isLocked : false;
+        const requestedOrder = Number.isInteger(body.order) ? body.order : undefined;
+
+        if (parentId) {
+            const parent = await prisma.page.findUnique({
+                where: { id: parentId },
+                select: { id: true, type: true },
+            });
+            if (!parent || parent.type !== 'folder') {
+                return NextResponse.json({ error: 'Parent folder not found' }, { status: 400 });
+            }
+        }
 
         const page = await prisma.page.create({
             data: {
-                title: title || '无标题',
-                content: content || '',
-                tags: JSON.stringify(body.tags || []),
-                parentId: parentId || null,
-                type: type || 'file',
+                title,
+                content,
+                tags: JSON.stringify(tags),
+                parentId,
+                type,
                 order: await (async () => {
-                    if (body.order !== undefined) return body.order;
+                    if (requestedOrder !== undefined) return requestedOrder;
                     const lastPage = await prisma.page.findFirst({
-                        where: { parentId: parentId || null },
+                        where: { parentId },
                         orderBy: { order: 'desc' },
                     });
                     return (lastPage?.order ?? -1) + 1;
                 })(),
-                icon: body.icon || null,
-                isLocked: body.isLocked || false,
+                icon,
+                isLocked,
             },
         });
-        return NextResponse.json({ ...page, tags: JSON.parse(page.tags || "[]") });
+        return NextResponse.json({ ...page, tags: safeParseTags(page.tags) });
     } catch {
         return NextResponse.json({ error: 'Error creating page' }, { status: 500 });
     }