mirror of
https://github.com/hanzo-apps/dataroom.git
synced 2026-10-30 14:47:36 +00:00
zeekayandHanzo Dev
6b68c9299e
The client was already @hanzo/kv; only the vocabulary was still Redis. Every module, symbol and comment now says what it connects to: lib/redis.ts -> lib/kv.ts (exports kv, lockKv) lib/redis-job-store.ts -> lib/kv-job-store.ts (KvJobStore) lib/redis-download-job-store.ts -> lib/kv-download-job-store.ts lib/files/tus-redis-locker.ts -> lib/files/tus-kv-locker.ts (KvLocker, KvLock) lib/api/domains/redis.ts -> lib/api/domains/kv.ts (getKey) lib/redis/ -> lib/kv-queue/ KV_URL is now the only endpoint variable — the REDIS_URL fallback and the redis://localhost default are gone, and the default scheme is kv://, which @hanzo/kv parses natively (utils/index.js). .env.example gained the KV_URL it never documented, and lost UPSTASH_REDIS_REST_LOCKER_URL/TOKEN: nothing has read those since the client changed — the locker opens a second connection to the same KV, so there is no second endpoint to configure. The second connection is `lockKv`, not `locker`: both tus routes already have a local `const locker = new KvLocker(...)`, so naming the client `locker` made the lock take itself as its own client. Verified against the repo's own gate (npx tsc --noEmit): 100 errors before and after, 0 introduced, compared set-wise by file:line:code. Behaviour is untouched — this is naming, one connection string, and dead config. Co-authored-by: Hanzo Dev <[email protected]>
99 lines
2.9 KiB
TypeScript
99 lines
2.9 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
|
|
import { fetchAndDeleteLoginCodeData } from "@/lib/emails/send-verification-request";
|
|
import { ratelimit } from "@/lib/kv";
|
|
|
|
// Rate limiters
|
|
const emailRateLimit = ratelimit(5, "1 m"); // 5 attempts per minute per email
|
|
const ipRateLimit = ratelimit(10, "1 m"); // 10 attempts per minute per IP
|
|
|
|
function getClientIp(request: NextRequest): string {
|
|
const forwarded = request.headers.get("x-forwarded-for");
|
|
const realIp = request.headers.get("x-real-ip");
|
|
return forwarded?.split(",")[0]?.trim() || realIp || "unknown";
|
|
}
|
|
|
|
// POST: Verify via email + code
|
|
export async function POST(request: NextRequest) {
|
|
try {
|
|
const body = await request.json();
|
|
const { email, code } = body;
|
|
|
|
// Type checks first to prevent calling .trim() on non-strings
|
|
if (typeof email !== "string" || typeof code !== "string") {
|
|
return NextResponse.json(
|
|
{ error: "Email and code are required." },
|
|
{ status: 400 },
|
|
);
|
|
}
|
|
|
|
// Normalize after type check
|
|
const normalizedEmail = email.trim().toLowerCase();
|
|
const normalizedCode = code.trim().toUpperCase();
|
|
|
|
// Validate non-empty email and exact code length
|
|
if (!normalizedEmail || normalizedCode.length !== 10) {
|
|
return NextResponse.json(
|
|
{ error: "Invalid email or code format." },
|
|
{ status: 400 },
|
|
);
|
|
}
|
|
|
|
const ip = getClientIp(request);
|
|
|
|
// Check both rate limits
|
|
const [emailLimit, ipLimit] = await Promise.all([
|
|
emailRateLimit.limit(`verify_code:${normalizedEmail}`),
|
|
ipRateLimit.limit(`verify_code:ip:${ip}`),
|
|
]);
|
|
|
|
if (!emailLimit.success) {
|
|
return NextResponse.json(
|
|
{
|
|
error: "Too many attempts. Please wait before trying again.",
|
|
retryAfter: Math.ceil((emailLimit.reset - Date.now()) / 1000),
|
|
remaining: 0,
|
|
},
|
|
{ status: 429 },
|
|
);
|
|
}
|
|
|
|
if (!ipLimit.success) {
|
|
return NextResponse.json(
|
|
{
|
|
error: "Too many attempts. Please wait before trying again.",
|
|
retryAfter: Math.ceil((ipLimit.reset - Date.now()) / 1000),
|
|
remaining: 0,
|
|
},
|
|
{ status: 429 },
|
|
);
|
|
}
|
|
|
|
// Atomically fetch and delete to prevent TOCTOU race condition
|
|
const loginCodeData = await fetchAndDeleteLoginCodeData(
|
|
normalizedEmail,
|
|
normalizedCode,
|
|
);
|
|
|
|
if (!loginCodeData) {
|
|
return NextResponse.json(
|
|
{
|
|
error: "Invalid code. Please check your email and try again.",
|
|
remaining: emailLimit.remaining,
|
|
},
|
|
{ status: 401 },
|
|
);
|
|
}
|
|
|
|
const { callbackUrl } = loginCodeData;
|
|
|
|
return NextResponse.json({ callbackUrl });
|
|
} catch (error) {
|
|
console.error("Error verifying code:", error);
|
|
return NextResponse.json(
|
|
{ error: "Verification failed. Please try again." },
|
|
{ status: 500 },
|
|
);
|
|
}
|
|
}
|