client passwords

app/api/review-sessions/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { auth } from "@/auth";
 import { db } from "@/lib/db";
 import { addDays } from "date-fns";
+import bcrypt from "bcryptjs";
 
 export async function GET(req: NextRequest) {
   const session = await auth();
@@ -32,7 +33,7 @@ export async function POST(req: NextRequest) {
   }
 
   const body = await req.json();
-  const { projectId, label, email, expiresInDays = 30 } = body;
+  const { projectId, label, email, expiresInDays = 30, password } = body;
 
   if (!projectId) {
     return NextResponse.json({ error: "projectId is required" }, { status: 400 });
@@ -43,11 +44,17 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: "Project not found" }, { status: 404 });
   }
 
+  const passwordHash =
+    password && typeof password === "string" && password.length > 0
+      ? await bcrypt.hash(password, 12)
+      : null;
+
   const reviewSession = await db.reviewSession.create({
     data: {
       projectId,
       label: label || `Review — ${project.name}`,
       email: email || null,
+      passwordHash,
       expiresAt: addDays(new Date(), expiresInDays),
     },
   });