fix: Reject asset uploads in demo mode

1 files changed, 8 insertions, 0 deletions

diff --git a/apps/web/app/api/assets/route.ts b/apps/web/app/api/assets/route.ts
index 4e1746b3..f1c5ff6a 100644
--- a/apps/web/app/api/assets/route.ts
+++ b/apps/web/app/api/assets/route.ts
@@ -1,7 +1,9 @@
 import { createContextFromRequest } from "@/server/api/client";
+import { TRPCError } from "@trpc/server";
 
 import type { ZUploadResponse } from "@hoarder/trpc/types/uploads";
 import { saveAsset } from "@hoarder/shared/assetdb";
+import serverConfig from "@hoarder/shared/config";
 
 const SUPPORTED_ASSET_TYPES = new Set(["image/jpeg", "image/png"]);
 
@@ -13,6 +15,12 @@ export async function POST(request: Request) {
   if (!ctx.user) {
     return Response.json({ error: "Unauthorized" }, { status: 401 });
   }
+  if (serverConfig.demoMode) {
+    throw new TRPCError({
+      message: "Mutations are not allowed in demo mode",
+      code: "FORBIDDEN",
+    });
+  }
   const formData = await request.formData();
   const data = formData.get("image");
   let buffer;