fix: require registered account to publish modules + leave reviews

- POST /api/modules: verifies user_profiles exists + email_verified
- POST /api/modules/:slug/review: verifies user_profiles exists
- Returns 401 with signup link if not registered
- Returns 403 if email not verified
- Updated mocks, 128 tests passing

Author: ralyodio

src/app/api/modules/[slug]/review/__tests__/route.test.ts

@@ -57,6 +57,15 @@ vi.mock("@/lib/supabase", () => ({
           }),
         };
       }
+      if (table === "user_profiles") {
+        return {
+          select: vi.fn().mockReturnValue({
+            eq: vi.fn().mockReturnValue({
+              single: vi.fn().mockResolvedValue({ data: { id: 'user-1' }, error: null }),
+            }),
+          }),
+        };
+      }
       return {};
     },
   }),

src/app/api/modules/[slug]/review/route.ts

@@ -72,6 +72,20 @@ export async function POST(
 
   const sb = getSupabaseAdmin();
 
+  // Verify user is registered
+  const { data: profile } = await sb
+    .from("user_profiles")
+    .select("id")
+    .eq("email", body.user_email)
+    .single();
+
+  if (!profile) {
+    return NextResponse.json(
+      { error: "You must create an account to leave reviews." },
+      { status: 401 }
+    );
+  }
+
   const { data: mod } = await sb
     .from("modules")
     .select("id, rating_avg, rating_count")

src/app/api/modules/__tests__/route.test.ts

@@ -29,12 +29,21 @@ function resetChain(overrides: {
   mockSelect.mockReturnValue({ eq: mockEq });
 }
 
+const mockProfileSingle = vi.fn().mockResolvedValue({ data: { id: 'user-1', email: 'test@example.com', email_verified: true }, error: null });
+
 vi.mock("@/lib/supabase", () => ({
   getSupabaseAdmin: () => ({
-    from: () => ({
-      select: mockSelect,
-      insert: mockInsert,
-    }),
+    from: (table: string) => {
+      if (table === 'user_profiles') {
+        return {
+          select: () => ({ eq: () => ({ single: mockProfileSingle }) }),
+        };
+      }
+      return {
+        select: mockSelect,
+        insert: mockInsert,
+      };
+    },
   }),
   slugify: (name: string) =>
     name

src/app/api/modules/route.ts

@@ -63,7 +63,8 @@ export async function GET(request: NextRequest) {
 
 /**
  * POST /api/modules
- * Publish a new module. Accepts name + git_url/homepage_url + optional overrides.
+ * Publish a new module. Requires a registered account.
+ * Accepts name + git_url/homepage_url + optional overrides.
  */
 export async function POST(request: NextRequest) {
   let body: Record<string, unknown>;
@@ -83,9 +84,29 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: "author_email is required" }, { status: 400 });
   }
 
-  const slug = slugify(name);
-
+  // Verify user is registered
   const sb = getSupabaseAdmin();
+  const { data: profile } = await sb
+    .from("user_profiles")
+    .select("id, email, email_verified")
+    .eq("email", author_email)
+    .single();
+
+  if (!profile) {
+    return NextResponse.json(
+      { error: "You must create an account at threatcrush.com/auth/signup before publishing modules." },
+      { status: 401 }
+    );
+  }
+
+  if (!profile.email_verified) {
+    return NextResponse.json(
+      { error: "Please verify your email before publishing modules." },
+      { status: 403 }
+    );
+  }
+
+  const slug = slugify(name);
 
   // Check if slug already exists
   const { data: existing } = await sb