Security audit improvements: authentication, path traversal protection, file validation, rate limiting, security headers

app/api/genres/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server';
 import { PrismaClient } from '@prisma/client';
+import { requireAdminAuth } from '@/lib/auth';
 
 const prisma = new PrismaClient();
 
@@ -21,6 +22,10 @@ export async function GET() {
 }
 
 export async function POST(request: Request) {
+    // Check authentication
+    const authError = await requireAdminAuth(request as any);
+    if (authError) return authError;
+
     try {
         const { name, subtitle } = await request.json();
 
@@ -43,6 +48,10 @@ export async function POST(request: Request) {
 }
 
 export async function DELETE(request: Request) {
+    // Check authentication
+    const authError = await requireAdminAuth(request as any);
+    if (authError) return authError;
+
     try {
         const { id } = await request.json();
 
@@ -62,6 +71,10 @@ export async function DELETE(request: Request) {
 }
 
 export async function PUT(request: Request) {
+    // Check authentication
+    const authError = await requireAdminAuth(request as any);
+    if (authError) return authError;
+
     try {
         const { id, name, subtitle } = await request.json();