From d5e985efd9606be82220f8cf193d9142b26e92d8 Mon Sep 17 00:00:00 2001
From: Jake Jarvis <jake@jarv.is>
Date: Tue, 3 Mar 2026 11:13:14 -0500
Subject: [PATCH] Add auth guards to search and discover API routes

---
 app/api/explore/discover/route.ts | 9 +++++++++
 app/api/search/route.ts           | 9 +++++++++
 app/api/titles/import/route.ts    | 3 ++-
 app/api/titles/resolve/route.ts   | 3 ++-
 4 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/app/api/explore/discover/route.ts b/app/api/explore/discover/route.ts
index 384041b..da0cdd2 100644
--- a/app/api/explore/discover/route.ts
+++ b/app/api/explore/discover/route.ts
@@ -1,9 +1,18 @@
+import { headers } from "next/headers";
 import { type NextRequest, NextResponse } from "next/server";
+import { auth } from "@/lib/auth/server";
 import { isTmdbConfigured } from "@/lib/config";
 import { discover } from "@/lib/tmdb/client";
 import { tmdbImageUrl } from "@/lib/tmdb/image";
 
 export async function GET(req: NextRequest) {
+  const session = await auth.api.getSession({
+    headers: await headers(),
+  });
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
   if (!isTmdbConfigured()) {
     return NextResponse.json(
       {
diff --git a/app/api/search/route.ts b/app/api/search/route.ts
index 0b5c75b..ef5d2d2 100644
--- a/app/api/search/route.ts
+++ b/app/api/search/route.ts
@@ -1,10 +1,19 @@
+import { headers } from "next/headers";
 import { type NextRequest, NextResponse } from "next/server";
+import { auth } from "@/lib/auth/server";
 import { isTmdbConfigured } from "@/lib/config";
 import { searchMovies, searchMulti, searchTv } from "@/lib/tmdb/client";
 import { tmdbImageUrl } from "@/lib/tmdb/image";
 import type { TmdbSearchResponse } from "@/lib/tmdb/types";
 
 export async function GET(req: NextRequest) {
+  const session = await auth.api.getSession({
+    headers: await headers(),
+  });
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
   if (!isTmdbConfigured()) {
     return NextResponse.json(
       {
diff --git a/app/api/titles/import/route.ts b/app/api/titles/import/route.ts
index d2e1091..eb8b1fc 100644
--- a/app/api/titles/import/route.ts
+++ b/app/api/titles/import/route.ts
@@ -8,8 +8,9 @@ export async function POST(req: NextRequest) {
   const session = await auth.api.getSession({
     headers: await headers(),
   });
-  if (!session)
+  if (!session) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
 
   const body = await req.json();
   const { tmdbId, type } = body;
diff --git a/app/api/titles/resolve/route.ts b/app/api/titles/resolve/route.ts
index d7ac006..2c7c567 100644
--- a/app/api/titles/resolve/route.ts
+++ b/app/api/titles/resolve/route.ts
@@ -8,8 +8,9 @@ export async function POST(req: NextRequest) {
   const session = await auth.api.getSession({
     headers: await headers(),
   });
-  if (!session)
+  if (!session) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
 
   const body = await req.json();
   const { tmdbId, type } = body;