94 lines
3.6 KiB
TypeScript
94 lines
3.6 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { getPayload } from "payload";
|
|
import config from "@payload-config";
|
|
import { checkRateLimit, getClientIp } from "@/lib/auth/rateLimit";
|
|
import { allowVerificationEmail } from "@/lib/auth/verificationRateLimit";
|
|
import { EMAIL_VERIFICATION_TTL_MS, generateVerificationToken, hashVerificationToken, verificationExpiryISO } from "@/lib/auth/verification";
|
|
import { verificationEmail } from "@/lib/email/authTemplates";
|
|
import { sendEmail } from "@/lib/email/sendBookingEmails";
|
|
import type { Customer } from "@/payload-types";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
// Deliberately identical whether or not an account exists / is already
|
|
// verified — this endpoint must never let a caller find out either of
|
|
// those things about an email address that isn't their own session.
|
|
const GENERIC_RESPONSE = {
|
|
ok: true,
|
|
message: "Falls ein Konto mit dieser E-Mail-Adresse existiert und noch nicht bestätigt ist, wurde eine neue Bestätigungs-E-Mail gesendet.",
|
|
};
|
|
|
|
async function issueAndSend(payload: Awaited<ReturnType<typeof getPayload>>, customer: Customer) {
|
|
const token = generateVerificationToken();
|
|
await payload.update({
|
|
collection: "customers",
|
|
id: customer.id,
|
|
data: {
|
|
emailVerificationTokenHash: hashVerificationToken(token),
|
|
emailVerificationExpires: verificationExpiryISO(),
|
|
},
|
|
});
|
|
|
|
const serverUrl = process.env.NEXT_PUBLIC_SERVER_URL || "http://localhost:3000";
|
|
await sendEmail(
|
|
customer.email,
|
|
verificationEmail({
|
|
name: customer.name,
|
|
verifyUrl: `${serverUrl}/auth/verify-email/${token}`,
|
|
expiresHours: Math.round(EMAIL_VERIFICATION_TTL_MS / (60 * 60 * 1000)),
|
|
}),
|
|
);
|
|
}
|
|
|
|
export async function POST(request: Request) {
|
|
const ip = getClientIp(request);
|
|
if (!checkRateLimit(`resend-verification:ip:${ip}`, { max: 10, windowMs: 60 * 60 * 1000 })) {
|
|
return NextResponse.json({ error: "Zu viele Anfragen. Bitte versuche es später erneut." }, { status: 429 });
|
|
}
|
|
|
|
try {
|
|
const payload = await getPayload({ config });
|
|
const { user } = await payload.auth({ headers: request.headers });
|
|
|
|
let customer: Customer | null = null;
|
|
|
|
if (user && user.collection === "customers") {
|
|
customer = user as Customer;
|
|
} else {
|
|
let body: { email?: unknown } = {};
|
|
try {
|
|
body = await request.json();
|
|
if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("Invalid body");
|
|
} catch {
|
|
// no body — handled below as a missing email
|
|
}
|
|
const email = typeof body?.email === "string" ? body.email.trim().toLowerCase() : "";
|
|
if (!email || email.length > 254) {
|
|
return NextResponse.json({ error: "E-Mail-Adresse erforderlich." }, { status: 400 });
|
|
}
|
|
if (!checkRateLimit(`resend-verification:email:${email}`, { max: 3, windowMs: 60 * 60 * 1000 })) {
|
|
return NextResponse.json({ error: "Zu viele Anfragen. Bitte versuche es später erneut." }, { status: 429 });
|
|
}
|
|
|
|
const { docs } = await payload.find({
|
|
collection: "customers",
|
|
where: { email: { equals: email } },
|
|
limit: 1,
|
|
});
|
|
customer = (docs[0] as Customer) ?? null;
|
|
}
|
|
|
|
if (customer && !customer.emailVerified) {
|
|
if (!allowVerificationEmail(request, customer.email, customer.id)) {
|
|
return NextResponse.json(GENERIC_RESPONSE);
|
|
}
|
|
await issueAndSend(payload, customer);
|
|
}
|
|
|
|
return NextResponse.json(GENERIC_RESPONSE);
|
|
} catch (error) {
|
|
console.error("resend verification failed", error);
|
|
return NextResponse.json({ error: "Die Bestätigungs-E-Mail konnte nicht gesendet werden." }, { status: 500 });
|
|
}
|
|
}
|