client passwords

app/api/client/[token]/auth/route.ts

@@ -0,0 +1,48 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/lib/db";
+import bcrypt from "bcryptjs";
+import { makeUnlockCookieValue } from "@/lib/review-auth";
+
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ token: string }> }
+) {
+  const { token } = await params;
+
+  const body = await req.json().catch(() => ({}));
+  const { password } = body as { password?: string };
+
+  if (!password || typeof password !== "string") {
+    return NextResponse.json({ error: "Password required" }, { status: 400 });
+  }
+
+  const session = await db.reviewSession.findUnique({ where: { token } });
+  if (!session || !session.isActive) {
+    return NextResponse.json({ error: "Invalid or expired review link" }, { status: 403 });
+  }
+  if (session.expiresAt && session.expiresAt < new Date()) {
+    return NextResponse.json({ error: "Invalid or expired review link" }, { status: 403 });
+  }
+
+  if (!session.passwordHash) {
+    return NextResponse.json({ success: true });
+  }
+
+  const valid = await bcrypt.compare(password, session.passwordHash);
+  if (!valid) {
+    return NextResponse.json({ error: "Incorrect password" }, { status: 401 });
+  }
+
+  const cookieName = `rsauth_${token}`;
+  const cookieValue = makeUnlockCookieValue(token);
+
+  const res = NextResponse.json({ success: true });
+  res.cookies.set(cookieName, cookieValue, {
+    httpOnly: true,
+    sameSite: "lax",
+    path: "/",
+    expires: session.expiresAt,
+    secure: process.env.NODE_ENV === "production",
+  });
+  return res;
+}