64ce70daa4
- NextAuth v5 with email+password credentials, JWT sessions - Registration, login, email verification, password reset flows - Stripe integration: Free (15/day), Starter ($5/1k/mo), Pro ($20/100k/mo) - API key management (cb_ prefix) with hash-based validation - Dashboard with generations history, settings, billing management - Rate limiting: Redis daily counter (free), DB monthly (paid) - Generate route auth: Bearer API key + session, anonymous allowed - Worker userId propagation for generation history - Pricing section on landing page, auth-aware navbar - Middleware with route protection, CORS for codeboard.vectry.tech - Docker env vars for auth, Stripe, email (smtp.migadu.com)
74 lines
2.1 KiB
TypeScript
74 lines
2.1 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { createHash } from "crypto";
|
|
import { hash } from "bcryptjs";
|
|
import { z } from "zod";
|
|
import { prisma } from "@/lib/prisma";
|
|
import { checkRateLimit, AUTH_RATE_LIMITS } from "@/lib/rate-limit";
|
|
|
|
const resetPasswordSchema = z.object({
|
|
token: z.string().min(1, "Token is required"),
|
|
password: z.string().min(8, "Password must be at least 8 characters"),
|
|
});
|
|
|
|
function hashToken(token: string): string {
|
|
return createHash("sha256").update(token).digest("hex");
|
|
}
|
|
|
|
export async function POST(request: Request) {
|
|
try {
|
|
const ip = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
|
|
const rl = await checkRateLimit(`reset:${ip}`, AUTH_RATE_LIMITS.resetPassword);
|
|
if (!rl.allowed) {
|
|
return NextResponse.json(
|
|
{ error: "Too many attempts. Please try again later." },
|
|
{ status: 429, headers: { "Retry-After": String(Math.ceil((rl.resetAt - Date.now()) / 1000)) } }
|
|
);
|
|
}
|
|
|
|
const body: unknown = await request.json();
|
|
const parsed = resetPasswordSchema.safeParse(body);
|
|
|
|
if (!parsed.success) {
|
|
return NextResponse.json(
|
|
{ error: parsed.error.issues[0]?.message ?? "Invalid input" },
|
|
{ status: 400 }
|
|
);
|
|
}
|
|
|
|
const { token, password } = parsed.data;
|
|
const tokenHash = hashToken(token);
|
|
|
|
const resetToken = await prisma.passwordResetToken.findUnique({
|
|
where: { token: tokenHash },
|
|
include: { user: true },
|
|
});
|
|
|
|
if (!resetToken || resetToken.used || resetToken.expiresAt < new Date()) {
|
|
return NextResponse.json(
|
|
{ error: "Invalid or expired reset link" },
|
|
{ status: 400 }
|
|
);
|
|
}
|
|
|
|
const passwordHash = await hash(password, 12);
|
|
|
|
await prisma.$transaction([
|
|
prisma.user.update({
|
|
where: { id: resetToken.userId },
|
|
data: { passwordHash },
|
|
}),
|
|
prisma.passwordResetToken.update({
|
|
where: { id: resetToken.id },
|
|
data: { used: true },
|
|
}),
|
|
]);
|
|
|
|
return NextResponse.json({ success: true });
|
|
} catch {
|
|
return NextResponse.json(
|
|
{ error: "Internal server error" },
|
|
{ status: 500 }
|
|
);
|
|
}
|
|
}
|