Merge branch 'main' into fix/improve-shortcuts

2 files changed, 124 insertions, 87 deletions

diff --git a/apps/web/src/app/api/waitlist/route.ts b/apps/web/src/app/api/waitlist/route.ts
index e5c9fd94..9f00f221 100644
--- a/apps/web/src/app/api/waitlist/route.ts
+++ b/apps/web/src/app/api/waitlist/route.ts
@@ -1,83 +1,105 @@
-import { NextRequest, NextResponse } from "next/server";

-import { db, eq, waitlist } from "@opencut/db";

-import { checkBotId } from "botid/server";

-import { nanoid } from "nanoid";

-import { waitlistRateLimit } from "@/lib/rate-limit";

-import { z } from "zod";

-import { env } from "@/env";

-import { cookies } from "next/headers";

-import crypto from "crypto";

-

-const waitlistSchema = z.object({

-  email: z.string().email("Invalid email format").min(1, "Email is required"),

-});

-

-const CSRF_TOKEN_NAME = "waitlist-csrf";

-const TOKEN_EXPIRY = 60 * 60 * 1000;

-

-async function validateCSRFToken(request: NextRequest): Promise<boolean> {

-  const clientToken = request.headers.get("x-csrf-token");

-  if (!clientToken) return false;

-

-  const cookieStore = await cookies();

-  const cookieValue = cookieStore.get(CSRF_TOKEN_NAME)?.value;

-  if (!cookieValue) return false;

-

-  const [token, timestamp, signature] = cookieValue.split(":");

-  if (!token || !timestamp || !signature) return false;

-

-  if (clientToken !== token) return false;

-

-  const now = Date.now();

-  const tokenTime = parseInt(timestamp);

-  if (now - tokenTime > TOKEN_EXPIRY) return false;

-

-  const expectedSignature = crypto.createHmac("sha256", env.BETTER_AUTH_SECRET).update(`${token}:${timestamp}`).digest("hex");

-

-  return signature === expectedSignature;

-}

-

-export async function POST(request: NextRequest) {

-  const verification = await checkBotId();

-

-  if (verification.isBot) {

-    return NextResponse.json({ error: "Access denied" }, { status: 403 });

-  }

-

-  const identifier = request.headers.get("x-forwarded-for") ?? "127.0.0.1";

-  const { success } = await waitlistRateLimit.limit(identifier);

-

-  if (!success) {

-    return NextResponse.json({ error: "Too many requests. Please try again later." }, { status: 429 });

-  }

-  const isValidToken = await validateCSRFToken(request);

-  if (!isValidToken) {

-    return NextResponse.json({ error: "Invalid security token" }, { status: 403 });

-  }

-

-  try {

-    const body = await request.json();

-    const { email } = waitlistSchema.parse(body);

-

-    const existingEmail = await db.select().from(waitlist).where(eq(waitlist.email, email.toLowerCase())).limit(1);

-

-    if (existingEmail.length > 0) {

-      return NextResponse.json({ error: "Email already registered" }, { status: 409 });

-    }

-

-    await db.insert(waitlist).values({

-      id: nanoid(),

-      email: email.toLowerCase(),

-    });

-

-    return NextResponse.json({ message: "Successfully joined waitlist!" }, { status: 201 });

-  } catch (error) {

-    if (error instanceof z.ZodError) {

-      const firstError = error.errors[0];

-      return NextResponse.json({ error: firstError.message }, { status: 400 });

-    }

-

-    console.error("Waitlist signup error:", error);

-    return NextResponse.json({ error: "Internal server error" }, { status: 500 });

-  }

-}

+import { NextRequest, NextResponse } from "next/server";
+import { db, eq, waitlist } from "@opencut/db";
+import { checkBotId } from "botid/server";
+import { nanoid } from "nanoid";
+import { waitlistRateLimit } from "@/lib/rate-limit";
+import { z } from "zod";
+import { env } from "@/env";
+import { cookies } from "next/headers";
+import crypto from "crypto";
+
+const waitlistSchema = z.object({
+  email: z.string().email("Invalid email format").min(1, "Email is required"),
+});
+
+const CSRF_TOKEN_NAME = "waitlist-csrf";
+const TOKEN_EXPIRY = 60 * 60 * 1000;
+
+async function validateCSRFToken(request: NextRequest): Promise<boolean> {
+  const clientToken = request.headers.get("x-csrf-token");
+  if (!clientToken) return false;
+
+  const cookieStore = await cookies();
+  const cookieValue = cookieStore.get(CSRF_TOKEN_NAME)?.value;
+  if (!cookieValue) return false;
+
+  const [token, timestamp, signature] = cookieValue.split(":");
+  if (!token || !timestamp || !signature) return false;
+
+  if (clientToken !== token) return false;
+
+  const now = Date.now();
+  const tokenTime = parseInt(timestamp);
+  if (now - tokenTime > TOKEN_EXPIRY) return false;
+
+  const expectedSignature = crypto
+    .createHmac("sha256", env.BETTER_AUTH_SECRET)
+    .update(`${token}:${timestamp}`)
+    .digest("hex");
+
+  return signature === expectedSignature;
+}
+
+export async function POST(request: NextRequest) {
+  const verification = await checkBotId();
+
+  if (verification.isBot) {
+    return NextResponse.json({ error: "Access denied" }, { status: 403 });
+  }
+
+  const identifier = request.headers.get("x-forwarded-for") ?? "127.0.0.1";
+  const { success } = await waitlistRateLimit.limit(identifier);
+
+  if (!success) {
+    return NextResponse.json(
+      { error: "Too many requests. Please try again later." },
+      { status: 429 }
+    );
+  }
+  const isValidToken = await validateCSRFToken(request);
+  if (!isValidToken) {
+    return NextResponse.json(
+      { error: "Invalid security token" },
+      { status: 403 }
+    );
+  }
+
+  try {
+    const body = await request.json();
+    const { email } = waitlistSchema.parse(body);
+
+    const existingEmail = await db
+      .select()
+      .from(waitlist)
+      .where(eq(waitlist.email, email.toLowerCase()))
+      .limit(1);
+
+    if (existingEmail.length > 0) {
+      return NextResponse.json(
+        { error: "Email already registered" },
+        { status: 409 }
+      );
+    }
+
+    await db.insert(waitlist).values({
+      id: nanoid(),
+      email: email.toLowerCase(),
+    });
+
+    return NextResponse.json(
+      { message: "Successfully joined waitlist!" },
+      { status: 201 }
+    );
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      const firstError = error.errors[0];
+      return NextResponse.json({ error: firstError.message }, { status: 400 });
+    }
+
+    console.error("Waitlist signup error:", error);
+    return NextResponse.json(
+      { error: "Internal server error" },
+      { status: 500 }
+    );
+  }
+}
diff --git a/apps/web/src/app/api/waitlist/token/route.ts b/apps/web/src/app/api/waitlist/token/route.ts
index 4c7695fa..fc2ff32c 100644
--- a/apps/web/src/app/api/waitlist/token/route.ts
+++ b/apps/web/src/app/api/waitlist/token/route.ts
@@ -5,7 +5,10 @@ import { env } from "@/env";
 
 const CSRF_TOKEN_NAME = "waitlist-csrf";
 const TOKEN_EXPIRY = 60 * 60 * 1000;
-const allowedHosts = env.NODE_ENV === "development" ? ["localhost:3000", "127.0.0.1:3000"] : ["opencut.app", "www.opencut.app"];
+const allowedHosts =
+  env.NODE_ENV === "development"
+    ? ["localhost:3000", "127.0.0.1:3000"]
+    : ["opencut.app", "www.opencut.app"];
 
 export async function GET(request: NextRequest) {
   const referer = request.headers.get("referer");
@@ -14,11 +17,20 @@ export async function GET(request: NextRequest) {
   if (referer) {
     const refererUrl = new URL(referer);
 
-    if (!allowedHosts.some((allowed) => refererUrl.host === allowed || refererUrl.host.endsWith(allowed))) {
+    if (
+      !allowedHosts.some(
+        (allowed) =>
+          refererUrl.host === allowed || refererUrl.host.endsWith(allowed)
+      )
+    ) {
       return NextResponse.json({ error: "Forbidden" }, { status: 403 });
     }
   } else if (host) {
-    if (!allowedHosts.some((allowed) => host === allowed || host.endsWith(allowed))) {
+    if (
+      !allowedHosts.some(
+        (allowed) => host === allowed || host.endsWith(allowed)
+      )
+    ) {
       return NextResponse.json({ error: "Forbidden" }, { status: 403 });
     }
   } else {
@@ -31,7 +43,10 @@ export async function GET(request: NextRequest) {
 
   const token = crypto.randomBytes(32).toString("hex");
   const timestamp = Date.now();
-  const signature = crypto.createHmac("sha256", env.BETTER_AUTH_SECRET).update(`${token}:${timestamp}`).digest("hex");
+  const signature = crypto
+    .createHmac("sha256", env.BETTER_AUTH_SECRET)
+    .update(`${token}:${timestamp}`)
+    .digest("hex");
 
   const cookieStore = await cookies();
   cookieStore.set(CSRF_TOKEN_NAME, `${token}:${timestamp}:${signature}`, {