From fff0d7af11e605646cc936d3d119af6f079d55fa Mon Sep 17 00:00:00 2001
From: Ruslan Bakiev <572431+veikab@users.noreply.github.com>
Date: Sat, 9 May 2026 14:18:07 +0700
Subject: [PATCH] Reject generated place ids for voice reviews

---
 src/graphql/voice-experiences.ts | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/src/graphql/voice-experiences.ts b/src/graphql/voice-experiences.ts
index d5608ba..3552168 100644
--- a/src/graphql/voice-experiences.ts
+++ b/src/graphql/voice-experiences.ts
@@ -2,6 +2,7 @@ import { enqueueVoiceExperience } from '../hatchet/enqueue-voice-experience.js';
 import { prisma } from '../prisma.js';
 
 const minimumVoiceExperienceSeconds = 30;
+const forbiddenGeneratedPlaceIdPrefix = 'manual-';
 
 export type CreateVoiceExperienceInput = {
   googlePlaceId: string;
@@ -19,17 +20,28 @@ export async function createVoiceExperience(
   if (input.durationSeconds < minimumVoiceExperienceSeconds) {
     throw new Error('Voice experience must be at least 30 seconds.');
   }
+  const googlePlaceId = input.googlePlaceId.trim();
+  const googleName = input.googleName.trim();
+  if (googlePlaceId === '') {
+    throw new Error('Google place id is required.');
+  }
+  if (googlePlaceId.startsWith(forbiddenGeneratedPlaceIdPrefix)) {
+    throw new Error('Voice experience must be linked to a Google place.');
+  }
+  if (googleName === '') {
+    throw new Error('Google place name is required.');
+  }
 
   const place = await prisma.place.upsert({
-    where: { googlePlaceId: input.googlePlaceId },
+    where: { googlePlaceId },
     create: {
-      googlePlaceId: input.googlePlaceId,
-      name: input.googleName,
+      googlePlaceId,
+      name: googleName,
       latitude: input.latitude,
       longitude: input.longitude,
     },
     update: {
-      name: input.googleName,
+      name: googleName,
       latitude: input.latitude,
       longitude: input.longitude,
     },