fix: enforce auth-first ordering in admin [id] route handlers

Move auth() call before await context.params in all admin [id] routes
so unauthorized requests are rejected before resolving route params.

Affected files:
- api/admin/blog/[id] (GET, PUT, DELETE)
- api/admin/careers/[id] (GET, PUT, DELETE)
- api/admin/messages/[id] (PUT, DELETE)
- api/admin/team/[id] (GET, PUT, DELETE)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: onerandomdevv

src/app/api/admin/blog/[id]/route.ts

@@ -34,12 +34,13 @@ type RouteContext = {
 };
 
 export async function GET(_request: Request, context: RouteContext) {
-  const params = await context.params;
   const session = await auth();
   if (!session) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const params = await context.params;
+
   try {
     const parsedId = idSchema.safeParse(params.id);
 
@@ -68,12 +69,13 @@ export async function GET(_request: Request, context: RouteContext) {
 }
 
 export async function PUT(request: Request, context: RouteContext) {
-  const params = await context.params;
   const session = await auth();
   if (!session) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const params = await context.params;
+
   try {
     const parsedId = idSchema.safeParse(params.id);
     const parsedBody = blogPostUpdateSchema.safeParse(await request.json());
@@ -129,12 +131,13 @@ export async function PUT(request: Request, context: RouteContext) {
 }
 
 export async function DELETE(_request: Request, context: RouteContext) {
-  const params = await context.params;
   const session = await auth();
   if (!session) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const params = await context.params;
+
   try {
     const parsedId = idSchema.safeParse(params.id);
 

src/app/api/admin/careers/[id]/route.ts

@@ -21,12 +21,13 @@ type RouteContext = {
 };
 
 export async function GET(_request: Request, context: RouteContext) {
-  const params = await context.params;
   const session = await auth();
   if (!session) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const params = await context.params;
+
   try {
     const parsedId = idSchema.safeParse(params.id);
 
@@ -55,12 +56,13 @@ export async function GET(_request: Request, context: RouteContext) {
 }
 
 export async function PUT(request: Request, context: RouteContext) {
-  const params = await context.params;
   const session = await auth();
   if (!session) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const params = await context.params;
+
   try {
     const parsedId = idSchema.safeParse(params.id);
     const parsedBody = careerUpdateSchema.safeParse(await request.json());
@@ -96,12 +98,13 @@ export async function PUT(request: Request, context: RouteContext) {
 }
 
 export async function DELETE(_request: Request, context: RouteContext) {
-  const params = await context.params;
   const session = await auth();
   if (!session) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const params = await context.params;
+
   try {
     const parsedId = idSchema.safeParse(params.id);
 

src/app/api/admin/messages/[id]/route.ts

@@ -16,12 +16,13 @@ type RouteContext = {
 };
 
 export async function PUT(request: Request, context: RouteContext) {
-  const params = await context.params;
   const session = await auth();
   if (!session) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const params = await context.params;
+
   try {
     const parsedId = idSchema.safeParse(params.id);
     const parsedBody = messageUpdateSchema.safeParse(await request.json());
@@ -57,12 +58,13 @@ export async function PUT(request: Request, context: RouteContext) {
 }
 
 export async function DELETE(_request: Request, context: RouteContext) {
-  const params = await context.params;
   const session = await auth();
   if (!session) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const params = await context.params;
+
   try {
     const parsedId = idSchema.safeParse(params.id);
 

src/app/api/admin/team/[id]/route.ts

@@ -24,12 +24,13 @@ type RouteContext = {
 };
 
 export async function GET(_request: Request, context: RouteContext) {
-  const params = await context.params;
   const session = await auth();
   if (!session) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const params = await context.params;
+
   try {
     const parsedId = idSchema.safeParse(params.id);
 
@@ -58,12 +59,13 @@ export async function GET(_request: Request, context: RouteContext) {
 }
 
 export async function PUT(request: Request, context: RouteContext) {
-  const params = await context.params;
   const session = await auth();
   if (!session) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const params = await context.params;
+
   try {
     const parsedId = idSchema.safeParse(params.id);
     const parsedBody = teamMemberUpdateSchema.safeParse(await request.json());
@@ -99,12 +101,13 @@ export async function PUT(request: Request, context: RouteContext) {
 }
 
 export async function DELETE(_request: Request, context: RouteContext) {
-  const params = await context.params;
   const session = await auth();
   if (!session) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const params = await context.params;
+
   try {
     const parsedId = idSchema.safeParse(params.id);