From 5d2c05dcbf05038899fc39c63001be2b831e1fda Mon Sep 17 00:00:00 2001
From: Christomatt <christomatt.89@gmail.com>
Date: Mon, 26 Jan 2026 13:31:23 +0100
Subject: [PATCH] fix(posts): Decode URL-encoded post IDs in API routes

- Add decodeURIComponent() to handle URL-encoded characters in post IDs
- Update like endpoint POST and DELETE handlers to decode rawId parameter
- Update repost endpoint POST and DELETE handlers to decode rawId parameter
- Update post retrieval GET handler to decode rawId parameter
- Fixes issues with special characters (e.g., %3A for colons) in post identifiers
---
 src/app/api/posts/[id]/like/route.ts   | 6 ++++--
 src/app/api/posts/[id]/repost/route.ts | 6 ++++--
 src/app/api/posts/[id]/route.ts        | 4 +++-
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/src/app/api/posts/[id]/like/route.ts b/src/app/api/posts/[id]/like/route.ts
index bd3b6c0..6737f5e 100644
--- a/src/app/api/posts/[id]/like/route.ts
+++ b/src/app/api/posts/[id]/like/route.ts
@@ -34,7 +34,8 @@ function extractSwarmPostId(apId: string): string | null {
 export async function POST(request: Request, context: RouteContext) {
     try {
         const user = await requireAuth();
-        const { id: postId } = await context.params;
+        const { id: rawId } = await context.params;
+        const postId = decodeURIComponent(rawId);
         const nodeDomain = process.env.NEXT_PUBLIC_NODE_DOMAIN || 'localhost:3000';
 
         if (user.isSuspended || user.isSilenced) {
@@ -210,7 +211,8 @@ export async function POST(request: Request, context: RouteContext) {
 export async function DELETE(request: Request, context: RouteContext) {
     try {
         const user = await requireAuth();
-        const { id: postId } = await context.params;
+        const { id: rawId } = await context.params;
+        const postId = decodeURIComponent(rawId);
         const nodeDomain = process.env.NEXT_PUBLIC_NODE_DOMAIN || 'localhost:3000';
 
         if (user.isSuspended || user.isSilenced) {
diff --git a/src/app/api/posts/[id]/repost/route.ts b/src/app/api/posts/[id]/repost/route.ts
index bec1ba9..a0c3485 100644
--- a/src/app/api/posts/[id]/repost/route.ts
+++ b/src/app/api/posts/[id]/repost/route.ts
@@ -34,7 +34,8 @@ function extractSwarmPostId(apId: string): string | null {
 export async function POST(request: Request, context: RouteContext) {
     try {
         const user = await requireAuth();
-        const { id: postId } = await context.params;
+        const { id: rawId } = await context.params;
+        const postId = decodeURIComponent(rawId);
         const nodeDomain = process.env.NEXT_PUBLIC_NODE_DOMAIN || 'localhost:3000';
 
         if (user.isSuspended || user.isSilenced) {
@@ -229,7 +230,8 @@ export async function POST(request: Request, context: RouteContext) {
 export async function DELETE(request: Request, context: RouteContext) {
     try {
         const user = await requireAuth();
-        const { id: postId } = await context.params;
+        const { id: rawId } = await context.params;
+        const postId = decodeURIComponent(rawId);
         const nodeDomain = process.env.NEXT_PUBLIC_NODE_DOMAIN || 'localhost:3000';
 
         if (user.isSuspended || user.isSilenced) {
diff --git a/src/app/api/posts/[id]/route.ts b/src/app/api/posts/[id]/route.ts
index 6b9cb7a..db6084d 100644
--- a/src/app/api/posts/[id]/route.ts
+++ b/src/app/api/posts/[id]/route.ts
@@ -8,7 +8,9 @@ export async function GET(
     { params }: { params: Promise<{ id: string }> }
 ) {
     try {
-        const { id } = await params;
+        const { id: rawId } = await params;
+        // Decode URL-encoded characters (e.g., %3A -> :)
+        const id = decodeURIComponent(rawId);
 
         const nodeDomain = process.env.NEXT_PUBLIC_NODE_DOMAIN || 'localhost:3000';