1 files changed, 19 insertions, 4 deletions

diff --git a/apps/web/src/app/api/waitlist/token/route.ts b/apps/web/src/app/api/waitlist/token/route.ts
index 4c7695fa..fc2ff32c 100644
--- a/apps/web/src/app/api/waitlist/token/route.ts
+++ b/apps/web/src/app/api/waitlist/token/route.ts
@@ -5,7 +5,10 @@ import { env } from "@/env";
 
 const CSRF_TOKEN_NAME = "waitlist-csrf";
 const TOKEN_EXPIRY = 60 * 60 * 1000;
-const allowedHosts = env.NODE_ENV === "development" ? ["localhost:3000", "127.0.0.1:3000"] : ["opencut.app", "www.opencut.app"];
+const allowedHosts =
+  env.NODE_ENV === "development"
+    ? ["localhost:3000", "127.0.0.1:3000"]
+    : ["opencut.app", "www.opencut.app"];
 
 export async function GET(request: NextRequest) {
   const referer = request.headers.get("referer");
@@ -14,11 +17,20 @@ export async function GET(request: NextRequest) {
   if (referer) {
     const refererUrl = new URL(referer);
 
-    if (!allowedHosts.some((allowed) => refererUrl.host === allowed || refererUrl.host.endsWith(allowed))) {
+    if (
+      !allowedHosts.some(
+        (allowed) =>
+          refererUrl.host === allowed || refererUrl.host.endsWith(allowed)
+      )
+    ) {
       return NextResponse.json({ error: "Forbidden" }, { status: 403 });
     }
   } else if (host) {
-    if (!allowedHosts.some((allowed) => host === allowed || host.endsWith(allowed))) {
+    if (
+      !allowedHosts.some(
+        (allowed) => host === allowed || host.endsWith(allowed)
+      )
+    ) {
       return NextResponse.json({ error: "Forbidden" }, { status: 403 });
     }
   } else {
@@ -31,7 +43,10 @@ export async function GET(request: NextRequest) {
 
   const token = crypto.randomBytes(32).toString("hex");
   const timestamp = Date.now();
-  const signature = crypto.createHmac("sha256", env.BETTER_AUTH_SECRET).update(`${token}:${timestamp}`).digest("hex");
+  const signature = crypto
+    .createHmac("sha256", env.BETTER_AUTH_SECRET)
+    .update(`${token}:${timestamp}`)
+    .digest("hex");
 
   const cookieStore = await cookies();
   cookieStore.set(CSRF_TOKEN_NAME, `${token}:${timestamp}:${signature}`, {