client passwords

app/api/client/[token]/comment/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db } from "@/lib/db";
 import { slackNotifyNewFeedback } from "@/lib/slack";
+import { validateReviewToken } from "@/lib/review-auth";
 
 /** Find or create a guest user for the client reviewer based on the session email */
 async function getOrCreateClientUser(email: string, label?: string | null) {
@@ -16,22 +17,19 @@ async function getOrCreateClientUser(email: string, label?: string | null) {
   });
 }
 
-async function validateToken(token: string) {
-  const session = await db.reviewSession.findUnique({ where: { token } });
-  if (!session || !session.isActive) return null;
-  if (session.expiresAt && session.expiresAt < new Date()) return null;
-  return session;
-}
-
 export async function POST(
   req: NextRequest,
   { params }: { params: Promise<{ token: string }> }
 ) {
   const { token } = await params;
-  const session = await validateToken(token);
-  if (!session) {
+  const result = await validateReviewToken(token, req);
+  if (result.type === "requiresPassword") {
+    return NextResponse.json({ requiresPassword: true }, { status: 401 });
+  }
+  if (result.type === "invalid") {
     return NextResponse.json({ error: "Invalid or expired review link" }, { status: 403 });
   }
+  const session = result.session;
 
   const body = await req.json();
   const { versionId, frameNumber, timestamp, text } = body;