1// prisma/schema.prisma
2model Job {
3  id          String    @id @default(cuid())
4  title       String
5  company     String
6  location    String
7  description String    @db.Text
8  salary      Int?      // cents, never floats for money
9  createdAt   DateTime  @default(now())
10  updatedAt   DateTime  @updatedAt
11 
12  // Index for the listing page sort (most recent first)
13  @@index([createdAt(sort: Desc)])
14}
15 
16model User {
17  id       String  @id @default(cuid())
18  email    String  @unique
19  role     String  @default("user")  // "user" | "admin"
20  accounts Account[]
21  sessions Session[]
22}

1// app/jobs/page.tsx — Server Component (no loading state, data in HTML)
2import { db } from '@/lib/db';
3 
4export default async function JobsPage({
5  searchParams,
6}: {
7  searchParams: { cursor?: string }
8}) {
9  const jobs = await db.job.findMany({
10    take: 20,
11    ...(searchParams.cursor && {
12      skip: 1,
13      cursor: { id: searchParams.cursor },
14    }),
15    orderBy: { createdAt: 'desc' },
16    // include company data in one query — NOT a separate query per job
17  });
18 
19  const nextCursor = jobs.length === 20 ? jobs[jobs.length - 1].id : undefined;
20 
21  return (
22    <div>
23      {jobs.map(job => <JobCard key={job.id} job={job} />)}
24      {nextCursor && (
25        <a href={`/jobs?cursor=${nextCursor}`}>Load more</a>
26      )}
27    </div>
28  );
29}
30 
31// app/admin/jobs/new/page.tsx — protected route
32import { getServerSession } from 'next-auth';
33import { redirect } from 'next/navigation';
34 
35export default async function NewJobPage() {
36  const session = await getServerSession();
37  if (!session || session.user.role !== 'admin') {
38    redirect('/login');  // server-side redirect before any HTML is sent
39  }
40  return <NewJobForm />;
41}

1// app/admin/jobs/new/actions.ts
2'use server';
3import { z } from 'zod';
4import { getServerSession } from 'next-auth';
5import { revalidatePath } from 'next/cache';
6import { redirect } from 'next/navigation';
7import { db } from '@/lib/db';
8 
9const CreateJobSchema = z.object({
10  title: z.string().min(3).max(100),
11  company: z.string().min(2).max(100),
12  location: z.string().min(2),
13  description: z.string().min(50),
14  salary: z.coerce.number().positive().optional(),
15});
16 
17export async function createJob(formData: FormData) {
18  // 1. Auth check first — fail fast
19  const session = await getServerSession();
20  if (!session || session.user.role !== 'admin') {
21    throw new Error('Unauthorized');
22  }
23 
24  // 2. Validate — Prisma injection is safe, but we still need shape validation
25  const result = CreateJobSchema.safeParse(Object.fromEntries(formData));
26  if (!result.success) {
27    return { error: result.error.flatten() };
28  }
29 
30  // 3. Write — parameterized by Prisma, no SQL injection possible
31  const job = await db.job.create({ data: result.data });
32 
33  // 4. Invalidate cache for the listing page
34  revalidatePath('/jobs');
35 
36  // 5. Redirect to the new job
37  redirect(`/jobs/${job.id}`);
38}