feat: Docker部署与CI/CD集成, 搜索栏修复, 上传目录改为data

pages/api/v1/admin/config.ts

@@ -0,0 +1,61 @@
+import { NextApiResponse } from 'next';
+import { AuthenticatedRequest } from '../../../../lib/middleware/authMiddleware';
+import { requireAdmin } from '../../../../lib/middleware/adminMiddleware';
+import { getServerConfig, setServerConfig } from '../../../../lib/serverConfig';
+import { resetPrisma } from '../../../../lib/prisma';
+
+const SYSTEM_CONFIG = {
+    maintenanceMode: false,
+    apiVersion: '1.0.0',
+    maxUploadMB: getServerConfig().uploadMaxMB,
+    dbHost: getServerConfig().dbHost,
+    dbPort: getServerConfig().dbPort,
+    dbUser: getServerConfig().dbUser,
+    dbPass: getServerConfig().dbPass,
+    dbName: getServerConfig().dbName,
+    uploadDir: getServerConfig().uploadDir,
+};
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+    // Require admin authentication
+    const isAdmin = await requireAdmin(req, res);
+    if (!isAdmin) {
+        return;
+    }
+
+    if (req.method === 'GET') {
+        // Return non-sensitive system configuration
+        return res.status(200).json({
+            success: true,
+            data: SYSTEM_CONFIG
+        });
+    }
+
+    if (req.method === 'PUT') {
+        const body = req.body || {};
+        const before = getServerConfig();
+        const nextCfg = setServerConfig({
+            uploadMaxMB: body.maxUploadMB,
+            uploadDir: body.uploadDir,
+            dbHost: body.dbHost,
+            dbPort: body.dbPort,
+            dbUser: body.dbUser,
+            dbPass: body.dbPass,
+            dbName: body.dbName,
+        });
+        SYSTEM_CONFIG.maxUploadMB = nextCfg.uploadMaxMB;
+        SYSTEM_CONFIG.uploadDir = nextCfg.uploadDir;
+        SYSTEM_CONFIG.dbHost = nextCfg.dbHost;
+        SYSTEM_CONFIG.dbPort = nextCfg.dbPort;
+        SYSTEM_CONFIG.dbUser = nextCfg.dbUser;
+        SYSTEM_CONFIG.dbPass = nextCfg.dbPass;
+        SYSTEM_CONFIG.dbName = nextCfg.dbName;
+        const dbChanged = before.dbHost !== nextCfg.dbHost || before.dbPort !== nextCfg.dbPort || before.dbUser !== nextCfg.dbUser || before.dbPass !== nextCfg.dbPass || before.dbName !== nextCfg.dbName;
+        if (dbChanged) {
+            resetPrisma();
+        }
+        return res.status(200).json({ success: true, message: 'Configuration updated successfully', data: SYSTEM_CONFIG });
+    }
+
+    return res.status(405).json({ success: false, error: 'Method not allowed' });
+}

pages/api/v1/admin/users.ts

@@ -0,0 +1,24 @@
+import { NextApiResponse } from 'next';
+import { AuthenticatedRequest } from '../../../../lib/middleware/authMiddleware';
+import { requireAdmin } from '../../../../lib/middleware/adminMiddleware';
+import { UserService } from '../../../../backend/services/userService';
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+    if (req.method !== 'GET') {
+        return res.status(405).json({ success: false, error: 'Method not allowed' });
+    }
+
+    // Require admin authentication
+    const isAdmin = await requireAdmin(req, res);
+    if (!isAdmin) {
+        return;
+    }
+
+    try {
+        const users = await UserService.getAllUsers();
+        return res.status(200).json({ success: true, data: users });
+    } catch (error) {
+        console.error('Error fetching users:', error);
+        return res.status(500).json({ success: false, error: 'Failed to fetch users' });
+    }
+}

pages/api/v1/admin/users/[id]/role.ts

@@ -0,0 +1,28 @@
+import { NextApiResponse } from 'next';
+import { AuthenticatedRequest } from '@/lib/middleware/authMiddleware';
+import { requireAdmin } from '@/lib/middleware/adminMiddleware';
+import { UserService } from '@/backend/services/userService';
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+  if (req.method !== 'POST') {
+    return res.status(405).json({ success: false, error: 'Method not allowed' });
+  }
+
+  const isAdmin = await requireAdmin(req, res);
+  if (!isAdmin) return;
+
+  const { id } = req.query;
+  const { role } = req.body || {};
+
+  if (typeof id !== 'string' || typeof role !== 'string') {
+    return res.status(400).json({ success: false, error: 'Invalid input' });
+  }
+
+  try {
+    const updated = await UserService.updateUserRole(id, role as any);
+    return res.status(200).json({ success: true, data: updated });
+  } catch (error) {
+    console.error('Error updating role:', error);
+    return res.status(500).json({ success: false, error: 'Failed to update role' });
+  }
+}

pages/api/v1/admin/users/[id]/toggle-status.ts

@@ -0,0 +1,30 @@
+import { NextApiResponse } from 'next';
+import { AuthenticatedRequest } from '../../../../../../lib/middleware/authMiddleware';
+import { requireAdmin } from '../../../../../../lib/middleware/adminMiddleware';
+import { UserService } from '../../../../../../backend/services/userService';
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+    if (req.method !== 'POST') {
+        return res.status(405).json({ success: false, error: 'Method not allowed' });
+    }
+
+    // Require admin authentication
+    const isAdmin = await requireAdmin(req, res);
+    if (!isAdmin) {
+        return;
+    }
+
+    const { id } = req.query;
+
+    if (typeof id !== 'string') {
+        return res.status(400).json({ success: false, error: 'Invalid user ID' });
+    }
+
+    try {
+        const updatedUser = await UserService.toggleUserStatus(id);
+        return res.status(200).json({ success: true, data: updatedUser });
+    } catch (error) {
+        console.error('Error toggling user status:', error);
+        return res.status(500).json({ success: false, error: 'Failed to toggle user status' });
+    }
+}

pages/api/v1/auth/login.ts

@@ -0,0 +1,48 @@
+import { NextApiRequest, NextApiResponse } from 'next';
+import { UserService } from '../../../../backend/services/userService';
+import { generateToken } from '../../../../lib/auth';
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+    if (req.method !== 'POST') {
+        return res.status(405).json({ success: false, error: 'Method not allowed' });
+    }
+
+    try {
+        const { username, password } = req.body;
+
+        // Validate input
+        if (!username || !password) {
+            return res.status(400).json({ success: false, error: 'Username and password are required' });
+        }
+
+        // Authenticate user
+        const user = await UserService.authenticateUser(username, password);
+
+        if (!user) {
+            return res.status(401).json({ success: false, error: 'Invalid username or password' });
+        }
+
+        // Check if user is banned
+        if (user.status === 'BANNED') {
+            return res.status(403).json({ success: false, error: 'Account has been banned' });
+        }
+
+        // Generate JWT token
+        const token = generateToken(user.id);
+
+        // Set HTTP-only cookie
+        res.setHeader('Set-Cookie', `token=${token}; HttpOnly; Path=/; Max-Age=${7 * 24 * 60 * 60}; SameSite=Strict`);
+
+        // Return user data
+        return res.status(200).json({
+            success: true,
+            data: {
+                user,
+                token // Also return token in body for non-cookie clients
+            }
+        });
+    } catch (error) {
+        console.error('Login error:', error);
+        return res.status(500).json({ success: false, error: 'Login failed' });
+    }
+}

pages/api/v1/auth/logout.ts

@@ -0,0 +1,15 @@
+import { NextApiRequest, NextApiResponse } from 'next';
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+    if (req.method !== 'POST') {
+        return res.status(405).json({ success: false, error: 'Method not allowed' });
+    }
+
+    // Clear the authentication cookie
+    res.setHeader('Set-Cookie', 'token=; HttpOnly; Path=/; Max-Age=0; SameSite=Strict');
+
+    return res.status(200).json({
+        success: true,
+        message: 'Logged out successfully'
+    });
+}

pages/api/v1/auth/me.ts

@@ -0,0 +1,20 @@
+import { NextApiResponse } from 'next';
+import { AuthenticatedRequest, requireAuth } from '../../../../lib/middleware/authMiddleware';
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+    if (req.method !== 'GET') {
+        return res.status(405).json({ success: false, error: 'Method not allowed' });
+    }
+
+    // Require authentication
+    const isAuthenticated = await requireAuth(req, res);
+    if (!isAuthenticated) {
+        return; // requireAuth already sent the response
+    }
+
+    // Return current user data
+    return res.status(200).json({
+        success: true,
+        data: req.user
+    });
+}

pages/api/v1/auth/register.ts

@@ -0,0 +1,59 @@
+import { NextApiRequest, NextApiResponse } from 'next';
+import { UserService } from '../../../../backend/services/userService';
+import { generateToken } from '../../../../lib/auth';
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+    if (req.method !== 'POST') {
+        return res.status(405).json({ success: false, error: 'Method not allowed' });
+    }
+
+    try {
+        const { username, password, email } = req.body;
+
+        // Validate input
+        if (!username || !password) {
+            return res.status(400).json({ success: false, error: 'Username and password are required' });
+        }
+
+        if (username.length < 3) {
+            return res.status(400).json({ success: false, error: 'Username must be at least 3 characters' });
+        }
+
+        if (password.length < 6) {
+            return res.status(400).json({ success: false, error: 'Password must be at least 6 characters' });
+        }
+
+        // Check if username already exists
+        const existingUser = await UserService.getUserByUsername(username);
+        if (existingUser) {
+            return res.status(409).json({ success: false, error: 'Username already taken' });
+        }
+
+        // Create new user
+        const user = await UserService.createUser(username, password, email);
+
+        // Generate JWT token
+        const token = generateToken(user.id);
+
+        // Set HTTP-only cookie
+        res.setHeader('Set-Cookie', `token=${token}; HttpOnly; Path=/; Max-Age=${7 * 24 * 60 * 60}; SameSite=Strict`);
+
+        // Return user data (without password)
+        return res.status(201).json({
+            success: true,
+            data: {
+                user: {
+                    id: user.id,
+                    username: user.username,
+                    avatarUrl: user.avatarUrl,
+                    role: user.role,
+                    status: user.status
+                },
+                token // Also return token in body for non-cookie clients
+            }
+        });
+    } catch (error) {
+        console.error('Registration error:', error);
+        return res.status(500).json({ success: false, error: 'Registration failed' });
+    }
+}

pages/api/v1/files/[name].ts

@@ -0,0 +1,31 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import fs from 'fs';
+import path from 'path';
+import { getServerConfig } from '../../../../lib/serverConfig';
+
+export default async function handler(req: NextApiRequest, res: NextApiResponse) {
+  const { name } = req.query;
+  if (typeof name !== 'string') {
+    return res.status(400).send('Invalid file name');
+  }
+
+  try {
+    const baseDir = path.join(process.cwd(), getServerConfig().uploadDir);
+    const filePath = path.join(baseDir, name);
+    if (!fs.existsSync(filePath)) {
+      return res.status(404).send('File not found');
+    }
+    const ext = path.extname(filePath).toLowerCase();
+    const type = ext === '.zip' ? 'application/zip'
+      : ext === '.mp4' ? 'video/mp4'
+      : ext === '.webm' ? 'video/webm'
+      : ext === '.mov' ? 'video/quicktime'
+      : 'application/octet-stream';
+    res.setHeader('Content-Type', type);
+    const stream = fs.createReadStream(filePath);
+    stream.pipe(res);
+  } catch (e) {
+    res.status(500).send('Internal error');
+  }
+}
+

pages/api/v1/materials/[id].ts

@@ -0,0 +1,62 @@
+import { NextApiResponse } from 'next';
+import { AuthenticatedRequest, requireAuth, optionalAuth } from '../../../../lib/middleware/authMiddleware';
+import { MaterialService } from '../../../../backend/services/materialService';
+import { UserRole } from '../../../../types';
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+    const { id } = req.query;
+
+    if (typeof id !== 'string') {
+        return res.status(400).json({ success: false, error: 'Invalid material ID' });
+    }
+
+    // GET: Get material by ID
+    if (req.method === 'GET') {
+        // Optional auth
+        await optionalAuth(req);
+
+        try {
+            const material = await MaterialService.getMaterialById(id);
+
+            if (!material) {
+                return res.status(404).json({ success: false, error: 'Material not found' });
+            }
+
+            return res.status(200).json({ success: true, data: material });
+        } catch (error) {
+            console.error('Error fetching material:', error);
+            return res.status(500).json({ success: false, error: 'Failed to fetch material' });
+        }
+    }
+
+    // DELETE: Delete material
+    if (req.method === 'DELETE') {
+        // Require authentication
+        const isAuthenticated = await requireAuth(req, res);
+        if (!isAuthenticated) {
+            return;
+        }
+
+        try {
+            // Get material to check authorization
+            const material = await MaterialService.getMaterialById(id);
+
+            if (!material) {
+                return res.status(404).json({ success: false, error: 'Material not found' });
+            }
+
+            // Check if user is author or admin
+            if (material.author.id !== req.user!.id && req.user!.role !== UserRole.ADMIN) {
+                return res.status(403).json({ success: false, error: 'Not authorized to delete this material' });
+            }
+
+            await MaterialService.deleteMaterial(id);
+            return res.status(200).json({ success: true, message: 'Material deleted successfully' });
+        } catch (error) {
+            console.error('Error deleting material:', error);
+            return res.status(500).json({ success: false, error: 'Failed to delete material' });
+        }
+    }
+
+    return res.status(405).json({ success: false, error: 'Method not allowed' });
+}

pages/api/v1/materials/[id]/comments.ts

@@ -0,0 +1,34 @@
+import { NextApiResponse } from 'next';
+import { AuthenticatedRequest, requireAuth } from '../../../../../lib/middleware/authMiddleware';
+import { MaterialService } from '../../../../../backend/services/materialService';
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+    if (req.method !== 'POST') {
+        return res.status(405).json({ success: false, error: 'Method not allowed' });
+    }
+
+    // Require authentication
+    const isAuthenticated = await requireAuth(req, res);
+    if (!isAuthenticated) {
+        return;
+    }
+
+    const { id } = req.query;
+    const { content } = req.body;
+
+    if (typeof id !== 'string') {
+        return res.status(400).json({ success: false, error: 'Invalid material ID' });
+    }
+
+    if (!content || !content.trim()) {
+        return res.status(400).json({ success: false, error: 'Comment content is required' });
+    }
+
+    try {
+        const comment = await MaterialService.addComment(id, req.user!.id, content);
+        return res.status(201).json({ success: true, data: comment });
+    } catch (error) {
+        console.error('Error adding comment:', error);
+        return res.status(500).json({ success: false, error: 'Failed to add comment' });
+    }
+}

pages/api/v1/materials/[id]/favorite.ts

@@ -0,0 +1,29 @@
+import { NextApiResponse } from 'next';
+import { AuthenticatedRequest, requireAuth } from '../../../../../lib/middleware/authMiddleware';
+import { MaterialService } from '../../../../../backend/services/materialService';
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+    if (req.method !== 'POST') {
+        return res.status(405).json({ success: false, error: 'Method not allowed' });
+    }
+
+    // Require authentication
+    const isAuthenticated = await requireAuth(req, res);
+    if (!isAuthenticated) {
+        return;
+    }
+
+    const { id } = req.query;
+
+    if (typeof id !== 'string') {
+        return res.status(400).json({ success: false, error: 'Invalid material ID' });
+    }
+
+    try {
+        const newFavoriteCount = await MaterialService.toggleFavorite(id, req.user!.id);
+        return res.status(200).json({ success: true, data: { favorites: newFavoriteCount } });
+    } catch (error) {
+        console.error('Error toggling favorite:', error);
+        return res.status(500).json({ success: false, error: 'Failed to toggle favorite' });
+    }
+}

pages/api/v1/materials/index.ts

@@ -0,0 +1,43 @@
+import { NextApiResponse } from 'next';
+import { AuthenticatedRequest, requireAuth, optionalAuth } from '../../../../lib/middleware/authMiddleware';
+import { MaterialService } from '../../../../backend/services/materialService';
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+    // GET: List materials
+    if (req.method === 'GET') {
+        // Optional auth - attach user if logged in
+        await optionalAuth(req);
+
+        try {
+            const type = req.query.type as any;
+            const page = parseInt((req.query.page as string) || '1', 10) || 1;
+            const limit = parseInt((req.query.limit as string) || '20', 10) || 20;
+            const q = (req.query.q as string) || '';
+            const { items, total } = await MaterialService.getAllMaterials(type, page, limit, q);
+            const hasNext = page * limit < total;
+            return res.status(200).json({ success: true, data: { items, total, page, limit, hasNext } });
+        } catch (error) {
+            console.error('Error fetching materials:', error);
+            return res.status(500).json({ success: false, error: 'Failed to fetch materials' });
+        }
+    }
+
+    // POST: Create material
+    if (req.method === 'POST') {
+        // Require authentication
+        const isAuthenticated = await requireAuth(req, res);
+        if (!isAuthenticated) {
+            return; // requireAuth already sent the response
+        }
+
+        try {
+            const newMaterial = await MaterialService.createMaterial(req.user!.id, req.body);
+            return res.status(201).json({ success: true, data: newMaterial });
+        } catch (error) {
+            console.error('Error creating material:', error);
+            return res.status(500).json({ success: false, error: 'Failed to create material' });
+        }
+    }
+
+    return res.status(405).json({ success: false, error: 'Method not allowed' });
+}

pages/api/v1/materials/upload-video.ts

@@ -0,0 +1,87 @@
+import type { NextApiResponse } from 'next';
+import type { AuthenticatedRequest } from '../../../../lib/middleware/authMiddleware';
+import { requireAuth } from '../../../../lib/middleware/authMiddleware';
+import { getServerConfig } from '../../../../lib/serverConfig';
+import { UserRole } from '../../../../types';
+import { MaterialService } from '../../../../backend/services/materialService';
+import formidable, { Files, File } from 'formidable';
+import fs from 'fs';
+import path from 'path';
+
+export const config = {
+  api: {
+    bodyParser: false,
+  },
+};
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+  if (req.method !== 'POST') {
+    return res.status(405).json({ success: false, error: 'Method not allowed' });
+  }
+
+  const isAuthenticated = await requireAuth(req, res);
+  if (!isAuthenticated) return;
+
+  if (req.user!.role !== UserRole.MANAGER && req.user!.role !== UserRole.ADMIN) {
+    return res.status(403).json({ success: false, error: 'Manager role required' });
+  }
+
+  const { uploadMaxMB } = getServerConfig();
+  const maxBytes = uploadMaxMB * 1024 * 1024;
+
+  const form = formidable({
+    maxFileSize: maxBytes,
+    multiples: false,
+    filter: ({ mimetype, originalFilename }) => {
+      // Allow common video types
+      const name = (originalFilename || '').toLowerCase();
+      return mimetype?.startsWith('video/') || name.endsWith('.mp4') || name.endsWith('.webm') || name.endsWith('.mov');
+    },
+  });
+
+  const getFirstFile = (files: Files | undefined): File | null => {
+    if (!files) return null;
+    const entries = Object.values(files || {});
+    if (!entries.length) return null;
+    const candidate = entries[0] as any;
+    if (Array.isArray(candidate)) return candidate[0] || null;
+    return candidate || null;
+  };
+
+  try {
+    const parsed: { fields: any; files: Files } = await new Promise((resolve, reject) => {
+      form.parse(req as any, (err, fields, files) => {
+        if (err) reject(err);
+        else resolve({ fields, files });
+      });
+    });
+    const { fields, files } = parsed;
+    const file = getFirstFile(files);
+    if (!file) return res.status(400).json({ success: false, error: 'No file provided' });
+    if ((file.size || 0) > maxBytes) return res.status(413).json({ success: false, error: `File too large. Max ${uploadMaxMB}MB` });
+
+    const uploadsDir = path.join(process.cwd(), getServerConfig().uploadDir);
+    if (!fs.existsSync(uploadsDir)) fs.mkdirSync(uploadsDir, { recursive: true });
+
+    const filename = `video_${Date.now()}_${path.basename(file.originalFilename || 'video.mp4')}`;
+    const destPath = path.join(uploadsDir, filename);
+    const srcPath = (file as any).filepath || (file as any).path;
+    if (!srcPath) return res.status(400).json({ success: false, error: 'Invalid upload temp path' });
+    await fs.promises.copyFile(srcPath, destPath);
+
+    const contentUrl = `/api/v1/files/${filename}`;
+
+    const newMaterial = await MaterialService.createMaterial(req.user!.id, {
+      title: fields?.title?.toString() || 'Video Asset',
+      description: fields?.description?.toString() || 'Uploaded video asset',
+      type: 'VIDEO',
+      contentUrl,
+      tags: (fields?.tags?.toString() || '').split(',').filter(Boolean),
+    });
+
+    return res.status(201).json({ success: true, data: newMaterial });
+  } catch (error: any) {
+    console.error('Upload VIDEO error:', error);
+    return res.status(500).json({ success: false, error: error.message || 'Upload failed' });
+  }
+}

pages/api/v1/materials/upload-zip.ts

@@ -0,0 +1,80 @@
+import type { NextApiResponse } from 'next';
+import type { AuthenticatedRequest } from '../../../../lib/middleware/authMiddleware';
+import { requireAuth } from '../../../../lib/middleware/authMiddleware';
+import { getServerConfig } from '../../../../lib/serverConfig';
+import { MaterialService } from '../../../../backend/services/materialService';
+import formidable, { Files, File } from 'formidable';
+import fs from 'fs';
+import path from 'path';
+
+export const config = {
+  api: {
+    bodyParser: false,
+  },
+};
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+  if (req.method !== 'POST') {
+    return res.status(405).json({ success: false, error: 'Method not allowed' });
+  }
+
+  const isAuthenticated = await requireAuth(req, res);
+  if (!isAuthenticated) return;
+
+  const { uploadMaxMB } = getServerConfig();
+  const maxBytes = uploadMaxMB * 1024 * 1024;
+
+  const form = formidable({
+    maxFileSize: maxBytes,
+    multiples: false,
+    filter: ({ mimetype, originalFilename }) => {
+      return (mimetype === 'application/zip' || (originalFilename || '').toLowerCase().endsWith('.zip'));
+    },
+  });
+
+  const getFirstFile = (files: Files | undefined): File | null => {
+    if (!files) return null;
+    const entries = Object.values(files || {});
+    if (!entries.length) return null;
+    const candidate = entries[0] as any;
+    if (Array.isArray(candidate)) return candidate[0] || null;
+    return candidate || null;
+  };
+
+  try {
+    const parsed: { fields: any; files: Files } = await new Promise((resolve, reject) => {
+      form.parse(req as any, (err, fields, files) => {
+        if (err) reject(err);
+        else resolve({ fields, files });
+      });
+    });
+    const { fields, files } = parsed;
+    const file = getFirstFile(files);
+    if (!file) return res.status(400).json({ success: false, error: 'No file provided' });
+    if ((file.size || 0) > maxBytes) return res.status(413).json({ success: false, error: `File too large. Max ${uploadMaxMB}MB` });
+
+    const uploadsDir = path.join(process.cwd(), getServerConfig().uploadDir);
+    if (!fs.existsSync(uploadsDir)) fs.mkdirSync(uploadsDir, { recursive: true });
+
+    const filename = `zip_${Date.now()}_${path.basename(file.originalFilename || 'asset.zip')}`;
+    const destPath = path.join(uploadsDir, filename);
+    const srcPath = (file as any).filepath || (file as any).path;
+    if (!srcPath) return res.status(400).json({ success: false, error: 'Invalid upload temp path' });
+    await fs.promises.copyFile(srcPath, destPath);
+
+    const contentUrl = `/api/v1/files/${filename}`;
+
+    const newMaterial = await MaterialService.createMaterial(req.user!.id, {
+      title: fields?.title?.toString() || 'ZIP Asset',
+      description: fields?.description?.toString() || 'Uploaded ZIP asset',
+      type: 'ASSET_ZIP',
+      contentUrl,
+      tags: (fields?.tags?.toString() || '').split(',').filter(Boolean),
+    });
+
+    return res.status(201).json({ success: true, data: newMaterial });
+  } catch (error: any) {
+    console.error('Upload ZIP error:', error);
+    return res.status(500).json({ success: false, error: error.message || 'Upload failed' });
+  }
+}

pages/api/v1/users/me.ts

@@ -0,0 +1,30 @@
+import { NextApiResponse } from 'next';
+import { AuthenticatedRequest, requireAuth } from '../../../../lib/middleware/authMiddleware';
+import { UserService } from '../../../../backend/services/userService';
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+    if (req.method !== 'PATCH') {
+        return res.status(405).json({ success: false, error: 'Method not allowed' });
+    }
+
+    // Require authentication
+    const isAuthenticated = await requireAuth(req, res);
+    if (!isAuthenticated) {
+        return;
+    }
+
+    try {
+        const { username, avatarUrl } = req.body;
+
+        // Update user
+        const updatedUser = await UserService.updateUser(req.user!.id, {
+            username,
+            avatarUrl
+        });
+
+        return res.status(200).json({ success: true, data: updatedUser });
+    } catch (error) {
+        console.error('Error updating user:', error);
+        return res.status(500).json({ success: false, error: 'Failed to update user' });
+    }
+}

pages/api/v1/users/me/favorites.ts

@@ -0,0 +1,23 @@
+import { NextApiResponse } from 'next';
+import { AuthenticatedRequest, requireAuth } from '@/lib/middleware/authMiddleware';
+import { MaterialService } from '@/backend/services/materialService';
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+    if (req.method !== 'GET') {
+        return res.status(405).json({ success: false, error: 'Method not allowed' });
+    }
+
+    try {
+        const isAuthenticated = await requireAuth(req, res);
+        if (!isAuthenticated) return;
+        const page = parseInt((req.query.page as string) || '1', 10) || 1;
+        const limit = parseInt((req.query.limit as string) || '20', 10) || 20;
+        const { items, total } = await MaterialService.getFavoritedMaterialsByUser(req.user!.id, page, limit);
+        const hasNext = page * limit < total;
+
+        return res.status(200).json({ success: true, data: { items, total, page, limit, hasNext }, timestamp: new Date().toISOString() });
+    } catch (error: any) {
+        console.error('Get user favorites error:', error);
+        return res.status(500).json({ success: false, error: error.message || 'Failed to get favorites' });
+    }
+}

pages/api/v1/users/me/materials.ts

@@ -0,0 +1,24 @@
+import { NextApiResponse } from 'next';
+import { AuthenticatedRequest, requireAuth } from '@/lib/middleware/authMiddleware';
+import { MaterialService } from '@/backend/services/materialService';
+
+export default async function handler(req: AuthenticatedRequest, res: NextApiResponse) {
+    if (req.method !== 'GET') {
+        return res.status(405).json({ success: false, error: 'Method not allowed' });
+    }
+
+    try {
+        const isAuthenticated = await requireAuth(req, res);
+        if (!isAuthenticated) return;
+        const { user } = req;
+        const page = parseInt((req.query.page as string) || '1', 10) || 1;
+        const limit = parseInt((req.query.limit as string) || '20', 10) || 20;
+        const { items, total } = await MaterialService.getMaterialsByAuthor(user!.id, page, limit);
+        const hasNext = page * limit < total;
+
+        return res.status(200).json({ success: true, data: { items, total, page, limit, hasNext }, timestamp: new Date().toISOString() });
+    } catch (error: any) {
+        console.error('Get user materials error:', error);
+        return res.status(500).json({ success: false, error: error.message || 'Failed to get materials' });
+    }
+}