maroandClaude Sonnet 5
1cd15aff25
- Customer accounts now require email verification (hashed, single-use, time-limited tokens) before they can request/confirm bookings, with resend flows on login/account/booking widget and rate limiting. - Admins get a private, rotatable iCalendar (ICS) subscription feed of their confirmed bookings and public events, timezone-correct for Europe/Berlin including DST, never exposing meeting passwords. - Adds a full SEO layer: per-page canonical/OG/Twitter metadata with CMS-editable overrides and content-derived fallbacks, a dynamic sitemap.xml and robots.txt driven by real published content, JSON-LD (Organization/LocalBusiness, WebSite, WebPage, BreadcrumbList, Service, Event, BlogPosting) that never fabricates data, and a CMS-managed redirect table for changed slugs. - Global ANOUMA-naming audit: the brand name is never used to label personal account/calendar areas anywhere in the app, CMS, or emails. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
23 lines
826 B
TypeScript
23 lines
826 B
TypeScript
import { createHash, randomBytes } from "node:crypto";
|
|
|
|
/** How long a freshly issued email-verification link stays valid. */
|
|
export const EMAIL_VERIFICATION_TTL_MS = 24 * 60 * 60 * 1000;
|
|
|
|
/** 256 bits of randomness, hex-encoded — not guessable, never derived from user data. */
|
|
export function generateVerificationToken(): string {
|
|
return randomBytes(32).toString("hex");
|
|
}
|
|
|
|
/**
|
|
* Only this hash is ever persisted (see collections/Customers.ts) — the
|
|
* plaintext token exists only in the URL sent by email and briefly in
|
|
* memory while that email is being sent.
|
|
*/
|
|
export function hashVerificationToken(token: string): string {
|
|
return createHash("sha256").update(token).digest("hex");
|
|
}
|
|
|
|
export function verificationExpiryISO(): string {
|
|
return new Date(Date.now() + EMAIL_VERIFICATION_TTL_MS).toISOString();
|
|
}
|