fix: use D1 database layer in API routes and fix SQL injection

src/app/api/clips/[clipId]/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import { getClipById, getRecordingById, deleteClip, dbRowToClip } from "@/lib/db";
+import { getClipById, getRecordingById, deleteClip, dbRowToClip } from "@/lib/db/d1";
 
 export async function GET(
   request: Request,
@@ -8,13 +8,13 @@ export async function GET(
   const { clipId } = await params;
 
   try {
-    const clipRow = getClipById(clipId);
+    const clipRow = await getClipById(clipId);
 
     if (!clipRow) {
       return NextResponse.json({ error: "Clip not found" }, { status: 404 });
     }
 
-    const recording = getRecordingById(clipRow.recording_id);
+    const recording = await getRecordingById(clipRow.recording_id);
     const clip = {
       ...dbRowToClip(clipRow),
       recordingTitle: recording?.title ?? "Unknown Recording",
@@ -37,7 +37,7 @@ export async function DELETE(
   const { clipId } = await params;
 
   try {
-    const deleted = deleteClip(clipId);
+    const deleted = await deleteClip(clipId);
 
     if (!deleted) {
       return NextResponse.json({ error: "Clip not found" }, { status: 404 });

src/app/api/clips/route.ts

@@ -1,9 +1,9 @@
 import { NextResponse } from "next/server";
-import { getAllClipsWithRecordingTitle, dbRowToClip } from "@/lib/db";
+import { getAllClipsWithRecordingTitle, dbRowToClip } from "@/lib/db/d1";
 
 export async function GET() {
   try {
-    const clipRows = getAllClipsWithRecordingTitle();
+    const clipRows = await getAllClipsWithRecordingTitle();
     const clips = clipRows.map((row) => ({
       ...dbRowToClip(row),
       recordingTitle: row.recording_title,

src/app/api/participants/route.ts

@@ -1,9 +1,9 @@
 import { NextResponse } from "next/server";
-import { getAllUniqueParticipants } from "@/lib/db";
+import { getAllUniqueParticipants } from "@/lib/db/d1";
 
 export async function GET() {
   try {
-    const participants = getAllUniqueParticipants();
+    const participants = await getAllUniqueParticipants();
     return NextResponse.json(participants);
   } catch (error) {
     console.error("Failed to fetch participants:", error);

src/app/api/recordings/[id]/clips/route.ts

@@ -5,7 +5,7 @@ import {
   getRecordingById,
   insertClip,
   dbRowToClip,
-} from "@/lib/db";
+} from "@/lib/db/d1";
 
 export async function GET(
   request: Request,
@@ -14,15 +14,15 @@ export async function GET(
   const { id: recordingId } = await params;
 
   try {
-    const recording = getRecordingById(recordingId);
+    const recording = await getRecordingById(recordingId);
     if (!recording) {
       return NextResponse.json(
         { error: "Recording not found" },
         { status: 404 }
       );
     }
 
-    const clipRows = getClipsByRecordingId(recordingId);
+    const clipRows = await getClipsByRecordingId(recordingId);
     const clips = clipRows.map(dbRowToClip);
 
     return NextResponse.json(clips);
@@ -42,7 +42,7 @@ export async function POST(
   const { id: recordingId } = await params;
 
   try {
-    const recording = getRecordingById(recordingId);
+    const recording = await getRecordingById(recordingId);
     if (!recording) {
       return NextResponse.json(
         { error: "Recording not found" },
@@ -82,7 +82,7 @@ export async function POST(
     }
 
     const clipId = nanoid(8);
-    const clipRow = insertClip({
+    const clipRow = await insertClip({
       id: clipId,
       recordingId,
       title: title || undefined,

src/app/api/recordings/[id]/route.ts

@@ -1,10 +1,8 @@
 import { NextResponse } from "next/server";
 import {
-  getRecordingDetails,
-  getTranscriptContent,
-} from "@/lib/zoom/recordings";
-import { transformZoomMeeting } from "@/lib/zoom/transform";
-import { updateRecordingCustomTitle, getRecordingById } from "@/lib/db";
+  getRecordingById,
+  updateRecordingCustomTitle,
+} from "@/lib/db/d1";
 
 export async function GET(
   request: Request,
@@ -13,17 +11,11 @@ export async function GET(
   const { id } = await params;
 
   try {
-    const details = await getRecordingDetails(id);
-
-    const recording = await transformZoomMeeting(
-      details,
-      details.download_access_token,
-      getTranscriptContent
-    );
+    const recording = await getRecordingById(id);
 
     if (!recording) {
       return NextResponse.json(
-        { error: "Recording not found or not ready" },
+        { error: "Recording not found" },
         { status: 404 }
       );
     }
@@ -48,17 +40,15 @@ export async function PATCH(
     const body = await request.json() as { customTitle?: string };
     const { customTitle } = body;
 
-    // Verify recording exists
-    const recording = getRecordingById(id);
+    const recording = await getRecordingById(id);
     if (!recording) {
       return NextResponse.json(
         { error: "Recording not found" },
         { status: 404 }
       );
     }
 
-    // Update custom title (null to revert to original)
-    updateRecordingCustomTitle(id, customTitle ?? null);
+    await updateRecordingCustomTitle(id, customTitle ?? null);
 
     return NextResponse.json({ success: true, customTitle: customTitle ?? null });
   } catch (error) {

src/app/api/recordings/[id]/summary/route.ts

@@ -3,7 +3,7 @@ import {
   getSegmentsByRecordingId,
   getSummaryByRecordingId,
   upsertSummary,
-} from "@/lib/db";
+} from "@/lib/db/d1";
 import { generateTranscriptSummary, SUMMARY_MODEL } from "@/lib/ai/summarize";
 import type { AISummary } from "@/types/video";
 
@@ -14,7 +14,7 @@ export async function GET(
   const { id } = await params;
 
   try {
-    const summaryRow = getSummaryByRecordingId(id);
+    const summaryRow = await getSummaryByRecordingId(id);
 
     if (!summaryRow) {
       return NextResponse.json(
@@ -45,8 +45,7 @@ export async function POST(
   const { id } = await params;
 
   try {
-    // Get transcript segments
-    const segments = getSegmentsByRecordingId(id);
+    const segments = await getSegmentsByRecordingId(id);
 
     if (segments.length === 0) {
       return NextResponse.json(
@@ -55,7 +54,6 @@ export async function POST(
       );
     }
 
-    // Transform to the expected format
     const transcriptSegments = segments.map((s) => ({
       id: s.id,
       startTime: s.start_time,
@@ -64,11 +62,9 @@ export async function POST(
       text: s.text,
     }));
 
-    // Generate new summary
     const summary = await generateTranscriptSummary(transcriptSegments);
 
-    // Save to database
-    upsertSummary({
+    await upsertSummary({
       recordingId: id,
       content: JSON.stringify(summary),
       model: SUMMARY_MODEL,

src/app/api/recordings/paginated/route.ts

@@ -3,7 +3,7 @@ import {
   getRecordingsPaginated,
   getSpeakersByRecordingIds,
   getSummariesByRecordingIds,
-} from "@/lib/db";
+} from "@/lib/db/d1";
 import type { AISummary } from "@/types/video";
 
 export async function GET(request: Request) {
@@ -16,15 +16,14 @@ export async function GET(request: Request) {
 
   const sourceFilter = source === "zoom" || source === "gong" ? source : "all";
 
-  const result = getRecordingsPaginated(sourceFilter, limit, cursor);
+  const result = await getRecordingsPaginated(sourceFilter, limit, cursor);
 
-  const speakersByRecording = getSpeakersByRecordingIds(
+  const speakersByRecording = await getSpeakersByRecordingIds(
     result.items.map((r) => r.id)
   );
 
-  // Fetch summaries if requested (for grid view)
   const summariesByRecording = includeSummaries
-    ? getSummariesByRecordingIds(result.items.map((r) => r.id))
+    ? await getSummariesByRecordingIds(result.items.map((r) => r.id))
     : {};
 
   const recordingsWithMeta = result.items.map((recording) => {

src/app/api/speakers/route.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from "next/server";
-import { getAllUniqueSpeakers } from "@/lib/db";
+import { getAllUniqueSpeakers } from "@/lib/db/d1";
 
 export async function GET() {
-  const speakers = getAllUniqueSpeakers();
+  const speakers = await getAllUniqueSpeakers();
   return NextResponse.json(speakers);
 }

src/app/c/[clipId]/page.tsx

@@ -1,6 +1,6 @@
 import { redirect, notFound } from "next/navigation";
 import type { Metadata } from "next";
-import { getClipById, getRecordingById, dbRowToClip } from "@/lib/db";
+import { getClipById, getRecordingById, dbRowToClip } from "@/lib/db/d1";
 
 function formatDuration(seconds: number): string {
   const mins = Math.floor(seconds / 60);
@@ -15,13 +15,13 @@ export async function generateMetadata({
   params: Promise<{ clipId: string }>;
 }): Promise<Metadata> {
   const { clipId } = await params;
-  const clipRow = getClipById(clipId);
+  const clipRow = await getClipById(clipId);
 
   if (!clipRow) {
     return { title: "Clip Not Found" };
   }
 
-  const recording = getRecordingById(clipRow.recording_id);
+  const recording = await getRecordingById(clipRow.recording_id);
   const clip = dbRowToClip(clipRow);
   const duration = formatDuration(clip.endTime - clip.startTime);
   const recordingTitle = recording?.custom_title ?? recording?.title ?? "Recording";
@@ -51,7 +51,7 @@ export default async function ClipRedirectPage({
   params: Promise<{ clipId: string }>;
 }) {
   const { clipId } = await params;
-  const clipRow = getClipById(clipId);
+  const clipRow = await getClipById(clipId);
 
   if (!clipRow) {
     notFound();

src/app/recordings/[id]/page.tsx

@@ -16,7 +16,7 @@ import {
   dbRowToClip,
   type RecordingRow,
   type ParticipantRow,
-} from "@/lib/db";
+} from "@/lib/db/d1";
 import { getRecording } from "@/data/mock-recordings";
 import { getZoomAccessToken } from "@/lib/zoom/auth";
 import { RecordingPlayer } from "./recording-player";
@@ -44,32 +44,29 @@ export default async function RecordingPage({
   const { clip: clipId } = await searchParams;
   const id = decodeURIComponent(rawId);
 
-  // Try mock data first (for demo IDs)
   const mockRecording = getRecording(id);
   if (mockRecording) {
     return <RecordingPageContent recording={mockRecording} relatedRecordings={[]} videoViews={[]} summary={null} activeClip={null} clips={[]} participants={[]} />;
   }
 
-  // Try SQLite database
-  const row = getRecordingById(id);
+  const row = await getRecordingById(id);
   if (!row) {
     notFound();
   }
 
-  const segments = getSegmentsByRecordingId(id);
-  const speakers = getSpeakersByRecordingId(id);
-  const participants = getParticipantsByRecordingId(id);
-  const relatedRecordings = getRelatedRecordings(row.title, id);
-  const videoFiles = getVideoFilesByRecordingId(id);
-  const chatMessages = getChatMessagesByRecordingId(id);
-  const summaryRow = getSummaryByRecordingId(id);
-  const clipRows = getClipsByRecordingId(id);
+  const segments = await getSegmentsByRecordingId(id);
+  const speakers = await getSpeakersByRecordingId(id);
+  const participants = await getParticipantsByRecordingId(id);
+  const relatedRecordings = await getRelatedRecordings(row.title, id);
+  const videoFiles = await getVideoFilesByRecordingId(id);
+  const chatMessages = await getChatMessagesByRecordingId(id);
+  const summaryRow = await getSummaryByRecordingId(id);
+  const clipRows = await getClipsByRecordingId(id);
   const clips = clipRows.map(dbRowToClip);
 
-  // Get active clip if specified
   let activeClip: Clip | null = null;
   if (clipId) {
-    const clipRow = getClipById(clipId);
+    const clipRow = await getClipById(clipId);
     if (clipRow && clipRow.recording_id === id) {
       activeClip = dbRowToClip(clipRow);
     }
@@ -84,7 +81,6 @@ export default async function RecordingPage({
     }
   }
 
-  // Get fresh access token for video playback (returns null if Zoom not configured)
   let accessToken: string | undefined;
   try {
     accessToken = (await getZoomAccessToken()) ?? undefined;
@@ -94,11 +90,9 @@ export default async function RecordingPage({
 
   const recording = dbRowToRecording(row, segments, speakers, accessToken);
 
-  // Check if Gong media URL has expired
   const mediaExpired =
     row.source === "gong" && isMediaUrlExpired(row.media_url_expires_at);
 
-  // Transform video files with labels and access token
   const videoViews = videoFiles.map((vf) => ({
     viewType: vf.view_type,
     label: VIEW_TYPE_LABELS[vf.view_type] || vf.view_type,
@@ -107,7 +101,6 @@ export default async function RecordingPage({
       : vf.video_url,
   }));
 
-  // Transform chat messages
   const chatMessagesFormatted = chatMessages.map((cm) => ({
     id: cm.id,
     timestamp: cm.timestamp,