diff --git a/src/app/api/comments/route.ts b/src/app/api/comments/route.ts index cd36d19c..ebafa15a 100644 --- a/src/app/api/comments/route.ts +++ b/src/app/api/comments/route.ts @@ -113,6 +113,19 @@ export async function POST(req: NextRequest) { const serverClient = createServerClient(); if (!serverClient) return error("Supabase not configured", 500); + // Validate that the (storyline_id, plot_index) pair exists + const { data: plot, error: plotError } = await serverClient.from("plots") + .select("id") + .eq("storyline_id", storylineId) + .eq("plot_index", plotIndex) + .eq("contract_address", STORY_FACTORY.toLowerCase()) + .limit(1); + + if (plotError) return error(`Database error: ${plotError.message}`, 500); + if (!plot || plot.length === 0) { + return error("Plot does not exist"); + } + // Rate limit: max 1 comment per address per plot per minute const oneMinuteAgo = new Date(Date.now() - 60 * 1000).toISOString(); const { data: recent } = await serverClient.from("comments")