Add deadline checks in APIs (#33)

jayantkageri · web-flow · commit 67f5e4ab7a45 · 2026-06-20T00:27:42.000+05:30
diff --git a/app/api/config/deadline/route.ts b/app/api/config/deadline/route.ts
@@ -1,10 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
+import { REGISTRATION_DEADLINE, RSVP_DEADLINE } from "@/lib/constants";
 
-export const dynamic = 'force-dynamic';
-
-// Submission deadline: Extended
-const SUBMISSION_DEADLINE = new Date('2026-07-19T10:00:00+05:30');
-const RSVP_DEADLINE = new Date('2026-07-21T23:59:00+05:30');
+export const dynamic = "force-dynamic";
 
 /**
  * GET /api/config/deadline
@@ -14,26 +11,21 @@ const RSVP_DEADLINE = new Date('2026-07-21T23:59:00+05:30');
 export async function GET(request: NextRequest) {
   try {
     const serverTime = new Date();
-    const isSubmissionExpired = serverTime > SUBMISSION_DEADLINE;
+    const isSubmissionExpired = serverTime > REGISTRATION_DEADLINE;
     const isRsvpExpired = serverTime > RSVP_DEADLINE;
 
     return NextResponse.json({
       success: true,
       data: {
-        deadline: SUBMISSION_DEADLINE.toISOString(),
+        deadline: REGISTRATION_DEADLINE.toISOString(),
         serverTime: serverTime.toISOString(),
         isExpired: isSubmissionExpired,
-        deadlineIST: "July 19, 2026, 10:00:00 AM IST",
         rsvpDeadline: RSVP_DEADLINE.toISOString(),
         isRsvpExpired,
-        rsvpDeadlineIST: "July 21, 2026, 11:59:00 PM IST",
       },
     });
   } catch (error: any) {
     console.error("Deadline config error:", error);
-    return NextResponse.json(
-      { message: "Server error" },
-      { status: 500 }
-    );
+    return NextResponse.json({ message: "Server error" }, { status: 500 });
   }
 }
diff --git a/app/api/registration/route.ts b/app/api/registration/route.ts
@@ -12,6 +12,7 @@ import dbConnect from "@/lib/db";
 import User, { IUser } from "@/models/User";
 import { checkRateLimit, getClientIp } from "@/lib/rate-limit";
 import { verifyRecaptcha } from "@/lib/recaptcha";
+import { isRegistrationClosed } from "@/lib/constants";
 
 // Utility functions for format validation
 const validateEmail = (email: string) =>
@@ -219,8 +220,7 @@ export async function POST(request: Request) {
       );
     }
 
-    const REGISTRATION_DEADLINE = new Date("2026-07-19T10:00:00+05:30");
-    if (new Date() > REGISTRATION_DEADLINE) {
+    if (isRegistrationClosed()) {
       return NextResponse.json(
         {
           message:
diff --git a/app/api/team/create/route.ts b/app/api/team/create/route.ts
@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { authenticateUser, createAuthErrorResponse, requireEmailVerified } from "@/lib/middleware/auth";
+import { authenticateUser, createAuthErrorResponse, requireEmailVerified, requireRegistrationOpen } from "@/lib/middleware/auth";
 import dbConnect from "@/lib/db";
 import User from "@/models/User";
 import Team from "@/models/Team";
@@ -78,6 +78,11 @@ export async function POST(request: NextRequest) {
       return createAuthErrorResponse(emailError);
     }
 
+    const deadlineError = requireRegistrationOpen();
+    if (deadlineError) {
+      return createAuthErrorResponse(deadlineError);
+    }
+
     const body = await request.json();
     const { teamName, isLooking = false } = body;
 
diff --git a/app/api/team/join-request/[requestId]/route.ts b/app/api/team/join-request/[requestId]/route.ts
@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { authenticateUser } from "@/lib/middleware/auth";
+import { authenticateUser, createAuthErrorResponse, requireRegistrationOpen } from "@/lib/middleware/auth";
 import dbConnect from "@/lib/db";
 import User from "@/models/User";
 import Team from "@/models/Team";
@@ -20,6 +20,11 @@ export async function PUT(
       );
     }
 
+    const deadlineError = requireRegistrationOpen();
+    if (deadlineError) {
+      return createAuthErrorResponse(deadlineError);
+    }
+
     const body = await request.json();
     const { action } = body;
 
@@ -185,6 +190,11 @@ export async function DELETE(
       );
     }
 
+    const deadlineError = requireRegistrationOpen();
+    if (deadlineError) {
+      return createAuthErrorResponse(deadlineError);
+    }
+
     await dbConnect();
 
     const joinRequest = await TeamJoinRequest.findById(params.requestId);
diff --git a/app/api/team/join-request/route.ts b/app/api/team/join-request/route.ts
@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { authenticateUser, createAuthErrorResponse, requireEmailVerified } from "@/lib/middleware/auth";
+import { authenticateUser, createAuthErrorResponse, requireEmailVerified, requireRegistrationOpen } from "@/lib/middleware/auth";
 import dbConnect from "@/lib/db";
 import User from "@/models/User";
 import Team from "@/models/Team";
@@ -22,6 +22,11 @@ export async function POST(request: NextRequest) {
       return createAuthErrorResponse(emailError);
     }
 
+    const deadlineError = requireRegistrationOpen();
+    if (deadlineError) {
+      return createAuthErrorResponse(deadlineError);
+    }
+
     const body = await request.json();
     const { teamCode, type = 'request', email } = body;
 
diff --git a/app/api/team/join/route.ts b/app/api/team/join/route.ts
@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { authenticateUser, createAuthErrorResponse, requireEmailVerified } from "@/lib/middleware/auth";
+import { authenticateUser, createAuthErrorResponse, requireEmailVerified, requireRegistrationOpen } from "@/lib/middleware/auth";
 import dbConnect from "@/lib/db";
 import User from "@/models/User";
 import Team from "@/models/Team";
@@ -51,6 +51,11 @@ export async function PUT(request: NextRequest) {
       return createAuthErrorResponse(emailError);
     }
 
+    const deadlineError = requireRegistrationOpen();
+    if (deadlineError) {
+      return createAuthErrorResponse(deadlineError);
+    }
+
     const body = await request.json();
     const { teamCode } = body;
 
diff --git a/app/api/team/leave/route.ts b/app/api/team/leave/route.ts
@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { authenticateUser, createAuthErrorResponse, requireEmailVerified } from "@/lib/middleware/auth";
+import { authenticateUser, createAuthErrorResponse, requireEmailVerified, requireRegistrationOpen } from "@/lib/middleware/auth";
 import dbConnect from "@/lib/db";
 import User from "@/models/User";
 import Team from "@/models/Team";
@@ -41,6 +41,11 @@ export async function PUT(request: NextRequest) {
       return createAuthErrorResponse(emailError);
     }
 
+    const deadlineError = requireRegistrationOpen();
+    if (deadlineError) {
+      return createAuthErrorResponse(deadlineError);
+    }
+
     const body = await request.json();
     const { setLookingStatus = false } = body;
 
diff --git a/app/api/team/remove-member/route.ts b/app/api/team/remove-member/route.ts
@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { authenticateUser, createAuthErrorResponse, requireAdmin, requireEmailVerified } from "@/lib/middleware/auth";
+import { authenticateUser, createAuthErrorResponse, requireAdmin, requireEmailVerified, requireRegistrationOpen } from "@/lib/middleware/auth";
 import dbConnect from "@/lib/db";
 import User from "@/models/User";
 import Team from "@/models/Team";
@@ -44,6 +44,14 @@ export async function PUT(request: NextRequest) {
       return createAuthErrorResponse(emailError);
     }
 
+    // Admins keep their override after the deadline; participants do not.
+    if (authResult.user.role !== 'admin') {
+      const deadlineError = requireRegistrationOpen();
+      if (deadlineError) {
+        return createAuthErrorResponse(deadlineError);
+      }
+    }
+
     const body = await request.json();
     const { teamCode, memberId, setTheirLookingStatus = false } = body;
 
diff --git a/app/api/team/transfer-ownership/route.ts b/app/api/team/transfer-ownership/route.ts
@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
-import { authenticateUser, createAuthErrorResponse, requireEmailVerified } from "@/lib/middleware/auth";
+import { authenticateUser, createAuthErrorResponse, requireEmailVerified, requireRegistrationOpen } from "@/lib/middleware/auth";
 import dbConnect from "@/lib/db";
 import User from "@/models/User";
 import Team from "@/models/Team";
@@ -22,6 +22,11 @@ export async function PUT(request: NextRequest) {
             return createAuthErrorResponse(emailError);
         }
 
+        const deadlineError = requireRegistrationOpen();
+        if (deadlineError) {
+            return createAuthErrorResponse(deadlineError);
+        }
+
         const { newLeadId, teamCode } = await request.json();
 
         if (!newLeadId || !teamCode) {
diff --git a/app/api/user/register/route.ts b/app/api/user/register/route.ts
@@ -10,6 +10,7 @@ import User, { IUser } from "@/models/User";
 import { verifyRecaptcha } from "@/lib/recaptcha";
 import { checkRateLimit, getClientIp } from "@/lib/rate-limit";
 import { getAuth as getAdminAuth } from "@/lib/firebase-admin";
+import { isRegistrationClosed } from "@/lib/constants";
 
 // Configure route
 export const dynamic = "force-dynamic";
@@ -85,8 +86,7 @@ export async function POST(request: Request) {
       );
     }
 
-    const REGISTRATION_DEADLINE = new Date("2026-07-19T10:00:00+05:30");
-    if (new Date() > REGISTRATION_DEADLINE) {
+    if (isRegistrationClosed()) {
       return NextResponse.json(
         {
           success: false,
diff --git a/app/api/user/rsvp/route.ts b/app/api/user/rsvp/route.ts
@@ -3,6 +3,7 @@ import { authenticateUser, createAuthErrorResponse, requireEmailVerified } from
 import dbConnect from "@/lib/db";
 import User from "@/models/User";
 import Team from "@/models/Team";
+import { isRsvpClosed } from "@/lib/constants";
 
 export const dynamic = 'force-dynamic';
 
@@ -41,10 +42,7 @@ export async function PUT(request: NextRequest) {
         { status: 400 }
       );
     }
-    // Keep this in sync with app/api/config/deadline/route.ts (RSVP_DEADLINE).
-    const RSVP_DEADLINE = new Date('2026-07-21T23:59:00+05:30');
-    const now = new Date();
-    if (now > RSVP_DEADLINE) {
+    if (isRsvpClosed()) {
       return NextResponse.json(
         {
           message: "RSVP deadline has passed",
diff --git a/lib/constants.ts b/lib/constants.ts
@@ -14,3 +14,19 @@ export const FILE_SIZE = {
   resume: 5,
   profilePhoto: 2,
 } as const;
+
+/**
+ * Registration / team-formation deadline
+ */
+export const REGISTRATION_DEADLINE = new Date("2026-07-19T10:00:00+05:30");
+
+/** RSVP deadline for shortlisted teams. */
+export const RSVP_DEADLINE = new Date("2026-07-21T23:59:00+05:30");
+
+/** True once the registration / team-formation window has closed. */
+export const isRegistrationClosed = (now: Date = new Date()): boolean =>
+  now > REGISTRATION_DEADLINE;
+
+/** True once the RSVP window has closed. */
+export const isRsvpClosed = (now: Date = new Date()): boolean =>
+  now > RSVP_DEADLINE;
diff --git a/lib/middleware/auth.ts b/lib/middleware/auth.ts
@@ -3,6 +3,7 @@ import { getAuth } from '@/lib/firebase-admin';
 import dbConnect from '@/lib/db';
 import User, { IUser } from '@/models/User';
 import Team from '@/models/Team';
+import { isRegistrationClosed } from '@/lib/constants';
 
 // Types for authenticated requests
 export interface AuthenticatedUser {
@@ -152,6 +153,24 @@ export function requireEvaluator(authResult: AuthResult): AuthError | null {
   return null;
 }
 
+/**
+ * Reject the request if the registration / team-formation deadline has passed.
+ */
+export function requireRegistrationOpen(): AuthError | null {
+  if (isRegistrationClosed()) {
+    return {
+      success: false,
+      error: {
+        code: 'REGISTRATION_CLOSED',
+        message:
+          'The registration deadline has passed. Team changes are no longer allowed.',
+      },
+      status: 403,
+    };
+  }
+  return null;
+}
+
 /**
  * Check if authenticated user has verified email
  */
