client passwords

app/api/client/[token]/project/route.ts

@@ -1,12 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db } from "@/lib/db";
-
-async function validateToken(token: string) {
-  const session = await db.reviewSession.findUnique({ where: { token } });
-  if (!session || !session.isActive) return null;
-  if (session.expiresAt && session.expiresAt < new Date()) return null;
-  return session;
-}
+import { validateReviewToken } from "@/lib/review-auth";
 
 /** GET /api/client/[token]/project — returns project + shots with tasks that have client-visible versions */
 export async function GET(
@@ -14,10 +8,14 @@ export async function GET(
   { params }: { params: Promise<{ token: string }> }
 ) {
   const { token } = await params;
-  const session = await validateToken(token);
-  if (!session) {
+  const result = await validateReviewToken(token, req);
+  if (result.type === "requiresPassword") {
+    return NextResponse.json({ requiresPassword: true }, { status: 401 });
+  }
+  if (result.type === "invalid") {
     return NextResponse.json({ error: "Invalid or expired review link" }, { status: 403 });
   }
+  const session = result.session;
 
   const project = await db.project.findUnique({
     where: { id: session.projectId },