summaryrefslogtreecommitdiff
path: root/apps/web/src/app/api/waitlist/token
diff options
context:
space:
mode:
authorHyteq <DerpsDer.es@gmail.com>2025-07-20 10:50:17 +0300
committerHyteq <DerpsDer.es@gmail.com>2025-07-20 10:50:17 +0300
commitfe020be6cea00691d6ce66e21843915defa5e944 (patch)
tree65718c8aee56a61b6c42032f8ebd96915cd13dc6 /apps/web/src/app/api/waitlist/token
parenteab8ec3ba81b86fdd4ade920d999c28fb34785b1 (diff)
downloadopencut-fe020be6cea00691d6ce66e21843915defa5e944.tar.gz
Revert "format, cleanup, deps"
This reverts commit eab8ec3ba81b86fdd4ade920d999c28fb34785b1.
Diffstat (limited to 'apps/web/src/app/api/waitlist/token')
-rw-r--r--apps/web/src/app/api/waitlist/token/route.ts75
1 files changed, 30 insertions, 45 deletions
diff --git a/apps/web/src/app/api/waitlist/token/route.ts b/apps/web/src/app/api/waitlist/token/route.ts
index 6f5ee18f..4c7695fa 100644
--- a/apps/web/src/app/api/waitlist/token/route.ts
+++ b/apps/web/src/app/api/waitlist/token/route.ts
@@ -5,57 +5,42 @@ import { env } from "@/env";
const CSRF_TOKEN_NAME = "waitlist-csrf";
const TOKEN_EXPIRY = 60 * 60 * 1000;
-const allowedHosts =
- env.NODE_ENV === "development"
- ? ["localhost:3000", "127.0.0.1:3000"]
- : ["opencut.app", "www.opencut.app"];
+const allowedHosts = env.NODE_ENV === "development" ? ["localhost:3000", "127.0.0.1:3000"] : ["opencut.app", "www.opencut.app"];
export async function GET(request: NextRequest) {
- const referer = request.headers.get("referer");
- const host = request.headers.get("host");
+ const referer = request.headers.get("referer");
+ const host = request.headers.get("host");
- if (referer) {
- const refererUrl = new URL(referer);
+ if (referer) {
+ const refererUrl = new URL(referer);
- if (
- !allowedHosts.some(
- (allowed) =>
- refererUrl.host === allowed || refererUrl.host.endsWith(allowed),
- )
- ) {
- return NextResponse.json({ error: "Forbidden" }, { status: 403 });
- }
- } else if (host) {
- if (
- !allowedHosts.some(
- (allowed) => host === allowed || host.endsWith(allowed),
- )
- ) {
- return NextResponse.json({ error: "Forbidden" }, { status: 403 });
- }
- } else {
- return NextResponse.json({ error: "Forbidden" }, { status: 403 });
- }
+ if (!allowedHosts.some((allowed) => refererUrl.host === allowed || refererUrl.host.endsWith(allowed))) {
+ return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+ }
+ } else if (host) {
+ if (!allowedHosts.some((allowed) => host === allowed || host.endsWith(allowed))) {
+ return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+ }
+ } else {
+ return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+ }
- if (!env.BETTER_AUTH_SECRET) {
- throw new Error("BETTER_AUTH_SECRET must be configured");
- }
+ if (!env.BETTER_AUTH_SECRET) {
+ throw new Error("BETTER_AUTH_SECRET must be configured");
+ }
- const token = crypto.randomBytes(32).toString("hex");
- const timestamp = Date.now();
- const signature = crypto
- .createHmac("sha256", env.BETTER_AUTH_SECRET)
- .update(`${token}:${timestamp}`)
- .digest("hex");
+ const token = crypto.randomBytes(32).toString("hex");
+ const timestamp = Date.now();
+ const signature = crypto.createHmac("sha256", env.BETTER_AUTH_SECRET).update(`${token}:${timestamp}`).digest("hex");
- const cookieStore = await cookies();
- cookieStore.set(CSRF_TOKEN_NAME, `${token}:${timestamp}:${signature}`, {
- httpOnly: true,
- secure: env.NODE_ENV === "production",
- sameSite: "strict",
- maxAge: TOKEN_EXPIRY / 1000,
- path: "/",
- });
+ const cookieStore = await cookies();
+ cookieStore.set(CSRF_TOKEN_NAME, `${token}:${timestamp}:${signature}`, {
+ httpOnly: true,
+ secure: env.NODE_ENV === "production",
+ sameSite: "strict",
+ maxAge: TOKEN_EXPIRY / 1000,
+ path: "/",
+ });
- return NextResponse.json({ token });
+ return NextResponse.json({ token });
}