rc 1.0

app/api/drops/active/route.ts

@@ -51,6 +51,13 @@ export async function GET() {
         }
         const totalFill = salesFill + pendingFill
         
+        // Fetch images for this drop
+        const [imageRows] = await pool.execute(
+          'SELECT image_url FROM drop_images WHERE drop_id = ? ORDER BY display_order ASC LIMIT 4',
+          [drop.id]
+        )
+        const images = (imageRows as any[]).map((row: any) => row.image_url)
+        
         console.log(`Returning upcoming drop ${drop.id} (${drop.item}): fill=${totalFill}, size=${drop.size}, starts at ${startTime.toISOString()}`)
         return NextResponse.json({
           ...drop,
@@ -59,6 +66,7 @@ export async function GET() {
           pending_fill: pendingFill,
           is_upcoming: true,
           start_time: drop.start_time || drop.created_at,
+          images: images.length > 0 ? images : (drop.image_url ? [drop.image_url] : []), // Support legacy single image_url
         })
       }
       
@@ -118,6 +126,14 @@ export async function GET() {
       if (remaining > epsilon) {
         // Ensure pending_fill is explicitly 0 if no pending orders
         const finalPendingFill = Number(pendingFill) || 0
+        
+        // Fetch images for this drop
+        const [imageRows] = await pool.execute(
+          'SELECT image_url FROM drop_images WHERE drop_id = ? ORDER BY display_order ASC LIMIT 4',
+          [drop.id]
+        )
+        const images = (imageRows as any[]).map((row: any) => row.image_url)
+        
         console.log(`Returning active drop ${drop.id} with fill ${fillNum} < size ${dropSize}, pending_fill=${finalPendingFill} (raw: ${pendingFill})`)
         return NextResponse.json({
           ...drop,
@@ -126,6 +142,7 @@ export async function GET() {
           pending_fill: finalPendingFill, // Items on hold (explicitly 0 if no pending orders)
           is_upcoming: false,
           start_time: drop.start_time || drop.created_at,
+          images: images.length > 0 ? images : (drop.image_url ? [drop.image_url] : []), // Support legacy single image_url
         })
       } else {
         console.log(`Drop ${drop.id} is sold out: fill=${fillNum} >= size=${dropSize} (remaining=${remaining})`)

app/api/drops/images/route.ts

@@ -0,0 +1,72 @@
+import { NextRequest, NextResponse } from 'next/server'
+import pool from '@/lib/db'
+
+// GET /api/drops/images?drop_id=X - Get all images for a drop
+export async function GET(request: NextRequest) {
+  try {
+    const searchParams = request.nextUrl.searchParams
+    const dropId = searchParams.get('drop_id')
+
+    if (!dropId) {
+      return NextResponse.json(
+        { error: 'drop_id parameter is required' },
+        { status: 400 }
+      )
+    }
+
+    const [rows] = await pool.execute(
+      'SELECT id, image_url, display_order FROM drop_images WHERE drop_id = ? ORDER BY display_order ASC LIMIT 4',
+      [dropId]
+    )
+
+    return NextResponse.json(rows)
+  } catch (error) {
+    console.error('Error fetching drop images:', error)
+    return NextResponse.json(
+      { error: 'Failed to fetch drop images' },
+      { status: 500 }
+    )
+  }
+}
+
+// POST /api/drops/images - Add images to a drop
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json()
+    const { drop_id, image_urls } = body
+
+    if (!drop_id || !image_urls || !Array.isArray(image_urls)) {
+      return NextResponse.json(
+        { error: 'drop_id and image_urls array are required' },
+        { status: 400 }
+      )
+    }
+
+    if (image_urls.length > 4) {
+      return NextResponse.json(
+        { error: 'Maximum 4 images allowed per drop' },
+        { status: 400 }
+      )
+    }
+
+    // Delete existing images for this drop
+    await pool.execute('DELETE FROM drop_images WHERE drop_id = ?', [drop_id])
+
+    // Insert new images
+    for (let i = 0; i < image_urls.length; i++) {
+      await pool.execute(
+        'INSERT INTO drop_images (drop_id, image_url, display_order) VALUES (?, ?, ?)',
+        [drop_id, image_urls[i], i]
+      )
+    }
+
+    return NextResponse.json({ success: true })
+  } catch (error) {
+    console.error('Error saving drop images:', error)
+    return NextResponse.json(
+      { error: 'Failed to save drop images' },
+      { status: 500 }
+    )
+  }
+}
+

app/api/drops/past/route.ts

@@ -45,10 +45,18 @@ export async function GET() {
           (soldOutDate.getTime() - dropDate.getTime()) / (1000 * 60 * 60)
         )
         
+        // Fetch images for this drop
+        const [imageRows] = await pool.execute(
+          'SELECT image_url FROM drop_images WHERE drop_id = ? ORDER BY display_order ASC LIMIT 4',
+          [drop.id]
+        )
+        const images = (imageRows as any[]).map((row: any) => row.image_url)
+        
         soldOutDrops.push({
           ...drop,
           fill: fill,
           soldOutInHours: hoursDiff,
+          images: images.length > 0 ? images : (drop.image_url ? [drop.image_url] : []), // Support legacy single image_url
         })
       }
     }

app/api/drops/route.ts

@@ -9,7 +9,7 @@ export async function GET(request: NextRequest) {
     )
     const drops = rows as any[]
     
-    // Calculate fill from sales for each drop
+    // Calculate fill from sales for each drop and fetch images
     const dropsWithFill = await Promise.all(
       drops.map(async (drop) => {
         // Calculate fill from sales records
@@ -27,9 +27,17 @@ export async function GET(request: NextRequest) {
           fill = totalFillInGrams / 1000
         }
         
+        // Fetch images for this drop
+        const [imageRows] = await pool.execute(
+          'SELECT image_url FROM drop_images WHERE drop_id = ? ORDER BY display_order ASC',
+          [drop.id]
+        )
+        const images = (imageRows as any[]).map((row) => row.image_url)
+        
         return {
           ...drop,
           fill: fill,
+          images: images.length > 0 ? images : (drop.image_url ? [drop.image_url] : []),
         }
       })
     )

app/api/payments/create-invoice/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server'
 import { cookies } from 'next/headers'
 import pool from '@/lib/db'
 import { getNowPaymentsConfig } from '@/lib/nowpayments'
+import { ALLOWED_PAYMENT_CURRENCIES, isAllowedCurrency } from '@/lib/payment-currencies'
 
 // POST /api/payments/create-invoice - Create a NOWPayments payment
 // Note: Endpoint name kept as "create-invoice" for backward compatibility
@@ -32,6 +33,15 @@ export async function POST(request: NextRequest) {
       )
     }
 
+    // Validate pay_currency against allowed list
+    const normalizedPayCurrency = pay_currency ? String(pay_currency).trim().toLowerCase() : null
+    if (normalizedPayCurrency && !isAllowedCurrency(normalizedPayCurrency)) {
+      return NextResponse.json(
+        { error: `Invalid payment currency. Allowed currencies: ${ALLOWED_PAYMENT_CURRENCIES.join(', ').toUpperCase()}` },
+        { status: 400 }
+      )
+    }
+
     // Verify buyer_data_id exists and belongs to the buyer
     const [buyerDataRows] = await pool.execute(
       'SELECT id FROM buyer_data WHERE id = ? AND buyer_id = ?',
@@ -154,8 +164,9 @@ export async function POST(request: NextRequest) {
 
       // Create NOWPayments payment
       // Note: Payment API requires pay_currency (crypto currency)
-      // Use currency from request, or fall back to env/default
-      const payCurrency = pay_currency || process.env.NOWPAYMENTS_PAY_CURRENCY || 'btc'
+      // Use currency from request (already validated), or fall back to env/default (must be in allowed list)
+      const defaultCurrency = process.env.NOWPAYMENTS_PAY_CURRENCY?.toLowerCase() || 'btc'
+      const payCurrency = normalizedPayCurrency || (isAllowedCurrency(defaultCurrency) ? defaultCurrency : 'btc')
       
       // Optional: Use fixed rate for 20 minutes (prevents rate changes during checkout)
       // If is_fixed_rate is true, payment expires after 20 minutes if not paid

app/api/payments/currencies/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
 import { getNowPaymentsConfig } from '@/lib/nowpayments'
+import { ALLOWED_PAYMENT_CURRENCIES } from '@/lib/payment-currencies'
 
 // GET /api/payments/currencies - Get available payment currencies from NOWPayments
 export async function GET() {
@@ -27,10 +28,27 @@ export async function GET() {
     }
 
     const data = await response.json()
+    
+    // Filter currencies to only include the selected list
+    const currencies = (data.currencies || []).filter((c: any) => {
+      let currencyCode: string | null = null
+      
+      // Handle object format (when fixed_rate=true)
+      if (typeof c === 'object' && c !== null && c.currency) {
+        currencyCode = String(c.currency).trim().toLowerCase()
+      }
+      // Handle string format (when fixed_rate=false)
+      else if (typeof c === 'string') {
+        currencyCode = c.trim().toLowerCase()
+      }
+      
+      // Check if currency is in the allowed list
+      return currencyCode && ALLOWED_PAYMENT_CURRENCIES.includes(currencyCode as any)
+    })
 
-    // Return the currencies array
+    // Return the filtered currencies array
     return NextResponse.json({
-      currencies: data.currencies || [],
+      currencies: currencies,
     })
   } catch (error) {
     console.error('Error fetching currencies:', error)