twotalesanimation
49 lines
1.5 KiB
TypeScript
49 lines
1.5 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { db } from "@/lib/db";
|
|
import bcrypt from "bcryptjs";
|
|
import { makeUnlockCookieValue } from "@/lib/review-auth";
|
|
|
|
export async function POST(
|
|
req: NextRequest,
|
|
{ params }: { params: Promise<{ token: string }> }
|
|
) {
|
|
const { token } = await params;
|
|
|
|
const body = await req.json().catch(() => ({}));
|
|
const { password } = body as { password?: string };
|
|
|
|
if (!password || typeof password !== "string") {
|
|
return NextResponse.json({ error: "Password required" }, { status: 400 });
|
|
}
|
|
|
|
const session = await db.reviewSession.findUnique({ where: { token } });
|
|
if (!session || !session.isActive) {
|
|
return NextResponse.json({ error: "Invalid or expired review link" }, { status: 403 });
|
|
}
|
|
if (session.expiresAt && session.expiresAt < new Date()) {
|
|
return NextResponse.json({ error: "Invalid or expired review link" }, { status: 403 });
|
|
}
|
|
|
|
if (!session.passwordHash) {
|
|
return NextResponse.json({ success: true });
|
|
}
|
|
|
|
const valid = await bcrypt.compare(password, session.passwordHash);
|
|
if (!valid) {
|
|
return NextResponse.json({ error: "Incorrect password" }, { status: 401 });
|
|
}
|
|
|
|
const cookieName = `rsauth_${token}`;
|
|
const cookieValue = makeUnlockCookieValue(token);
|
|
|
|
const res = NextResponse.json({ success: true });
|
|
res.cookies.set(cookieName, cookieValue, {
|
|
httpOnly: true,
|
|
sameSite: "lax",
|
|
path: "/",
|
|
expires: session.expiresAt,
|
|
secure: process.env.NODE_ENV === "production",
|
|
});
|
|
return res;
|
|
}
|