client passwords

app/api/client/[token]/approve/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { db } from "@/lib/db";
 import { ApprovalStatus } from "@prisma/client";
 import { recalcShotStatus } from "@/lib/shot-status";
+import { validateReviewToken } from "@/lib/review-auth";
 
 async function getOrCreateClientUser(email: string, label?: string | null) {
   const existing = await db.user.findUnique({ where: { email } });
@@ -16,22 +17,19 @@ async function getOrCreateClientUser(email: string, label?: string | null) {
   });
 }
 
-async function validateToken(token: string) {
-  const session = await db.reviewSession.findUnique({ where: { token } });
-  if (!session || !session.isActive) return null;
-  if (session.expiresAt && session.expiresAt < new Date()) return null;
-  return session;
-}
-
 export async function POST(
   req: NextRequest,
   { params }: { params: Promise<{ token: string }> }
 ) {
   const { token } = await params;
-  const session = await validateToken(token);
-  if (!session) {
+  const result = await validateReviewToken(token, req);
+  if (result.type === "requiresPassword") {
+    return NextResponse.json({ requiresPassword: true }, { status: 401 });
+  }
+  if (result.type === "invalid") {
     return NextResponse.json({ error: "Invalid or expired review link" }, { status: 403 });
   }
+  const session = result.session;
 
   const body = await req.json();
   const { versionId, shotId, action, status, notes } = body;