7 improvements: spam protection, comment moderation, SEO, sitemap, 404

- Rate limit comments to 5/hour per IP (same pattern as votes)
- Admin Comments tab: view/hide/remove comments by status
- Fix APM-XXXX -> APM-0001 in about page
- Add revalidate=60 to /agent/[slug] and /tag/[slug] pages
- Sitemap now includes all individual agent and tag URLs
- Custom 404 page matching site design
- Admin API route for comment moderation (GET/PATCH)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: royalpinto007

app/(public)/about/page.tsx

@@ -62,7 +62,7 @@ export default function AboutPage() {
         <p>
           Every submission is reviewed before publication. We reject cases that
           are vague, unverifiable, or appear to be targeted harassment. Approved
-          cases are assigned a permanent case number (APM-XXXX) and indexed
+          cases are assigned a permanent case number (APM-0001) and indexed
           immediately.
         </p>
 

app/(public)/agent/[slug]/page.tsx

@@ -5,6 +5,8 @@ import { PostCard } from "@/components/post/PostCard";
 import { AGENTS } from "@/lib/constants/agents";
 import { fetchPostsByAgent } from "@/lib/db/posts";
 
+export const revalidate = 60;
+
 interface PageProps {
   params: { slug: string };
 }

app/(public)/tag/[slug]/page.tsx

@@ -5,6 +5,8 @@ import { PostCard } from "@/components/post/PostCard";
 import { TAGS } from "@/lib/constants/tags";
 import { fetchPostsByTag } from "@/lib/db/posts";
 
+export const revalidate = 60;
+
 interface PageProps {
   params: { slug: string };
 }

app/admin/page.tsx

@@ -0,0 +1,51 @@
+import { NextRequest, NextResponse } from "next/server";
+import { createSupabaseAdminClient } from "@/lib/supabase/admin";
+
+function checkAuth(req: NextRequest): boolean {
+  const pwd = req.headers.get("x-admin-password");
+  return pwd === process.env.ADMIN_PASSWORD;
+}
+
+export async function GET(req: NextRequest) {
+  if (!checkAuth(req)) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const rawStatus = req.nextUrl.searchParams.get("status") ?? "visible";
+  const status = ["visible", "hidden", "removed"].includes(rawStatus)
+    ? (rawStatus as "visible" | "hidden" | "removed")
+    : ("visible" as const);
+  const supabase = createSupabaseAdminClient();
+
+  const { data, error } = await supabase
+    .from("comments")
+    .select(
+      "id, body, is_anonymous, author_handle, status, created_at, post_id, posts(case_number, title)",
+    )
+    .eq("status", status)
+    .order("created_at", { ascending: false })
+    .limit(100);
+
+  if (error) return NextResponse.json({ comments: [] });
+  return NextResponse.json({ comments: data ?? [] });
+}
+
+export async function PATCH(req: NextRequest) {
+  if (!checkAuth(req)) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const { id, status } = await req.json();
+  if (!id || !["visible", "hidden", "removed"].includes(status)) {
+    return NextResponse.json({ error: "Invalid request" }, { status: 400 });
+  }
+
+  const supabase = createSupabaseAdminClient();
+  const { error } = await supabase
+    .from("comments")
+    .update({ status })
+    .eq("id", id);
+
+  if (error) return NextResponse.json({ error: "Failed" }, { status: 500 });
+  return NextResponse.json({ ok: true });
+}

app/api/admin/comments/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { createHash } from "crypto";
 import { createSupabaseServerClient } from "@/lib/supabase/server";
 import { createSupabaseAdminClient } from "@/lib/supabase/admin";
+import { consumeSharedRateLimit } from "@/lib/rate-limit/shared";
 
 function hashIp(ip: string): string {
   const pepper = process.env.IP_HASH_PEPPER ?? "default-pepper";
@@ -47,7 +48,21 @@ export async function POST(req: NextRequest) {
       );
     }
 
-    const ip_hash = hashIp(getIp(req));
+    const ip = getIp(req);
+    const ip_hash = hashIp(ip);
+
+    const rateLimit = await consumeSharedRateLimit(
+      `comment:${ip_hash}`,
+      3600,
+      5,
+    );
+    if (!rateLimit.allowed) {
+      return NextResponse.json(
+        { error: "Too many comments. Try again later." },
+        { status: 429 },
+      );
+    }
+
     const supabase = createSupabaseAdminClient();
 
     const { data, error } = await supabase

app/api/comments/route.ts

@@ -0,0 +1,42 @@
+import Link from "next/link";
+
+export default function NotFound() {
+  return (
+    <div className="flex min-h-[60vh] flex-col items-center justify-center px-4 text-center">
+      <div className="mb-6 flex items-center gap-2">
+        <div className="h-1.5 w-1.5 rounded-sm bg-accent-red" />
+        <span className="font-mono text-[10px] uppercase tracking-widest text-text-tertiary">
+          Case Not Found
+        </span>
+      </div>
+
+      <div className="mb-2 font-mono text-6xl font-bold tabular-nums text-border-strong">
+        404
+      </div>
+
+      <h1 className="mt-4 font-serif text-2xl font-normal text-text-primary">
+        No case on file.
+      </h1>
+
+      <p className="mt-3 max-w-sm text-sm leading-relaxed text-text-secondary">
+        The case you&apos;re looking for doesn&apos;t exist, was removed, or the
+        URL is incorrect.
+      </p>
+
+      <div className="mt-8 flex flex-wrap items-center justify-center gap-4">
+        <Link
+          href="/"
+          className="rounded border border-accent-red bg-accent-red-soft px-5 py-2.5 font-mono text-[11px] uppercase tracking-wider text-accent-red transition-all hover:bg-accent-red hover:text-white"
+        >
+          ← Back to Registry
+        </Link>
+        <Link
+          href="/submit"
+          className="font-mono text-[11px] uppercase tracking-wider text-text-tertiary transition-colors hover:text-text-primary"
+        >
+          File a Report →
+        </Link>
+      </div>
+    </div>
+  );
+}

app/not-found.tsx

@@ -1,5 +1,7 @@
 import { MetadataRoute } from "next";
 import { createSupabaseAdminClient } from "@/lib/supabase/admin";
+import { AGENTS } from "@/lib/constants/agents";
+import { TAGS } from "@/lib/constants/tags";
 
 export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
   const siteUrl =
@@ -63,5 +65,17 @@ export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
       priority: 0.4,
     },
     ...postUrls,
+    ...AGENTS.map((a) => ({
+      url: `${siteUrl}/agent/${a.slug}`,
+      lastModified: new Date(),
+      changeFrequency: "weekly" as const,
+      priority: 0.6,
+    })),
+    ...TAGS.map((t) => ({
+      url: `${siteUrl}/tag/${t.slug}`,
+      lastModified: new Date(),
+      changeFrequency: "weekly" as const,
+      priority: 0.5,
+    })),
   ];
 }