4 files changed, 171 insertions, 69 deletions
diff --git a/apps/web/src/app/api/auth/[...all]/route.ts b/apps/web/src/app/api/auth/[...all]/route.ts
index 393fb7e7..5deef204 100644
--- a/apps/web/src/app/api/auth/[...all]/route.ts
+++ b/apps/web/src/app/api/auth/[...all]/route.ts
@@ -1,4 +1,4 @@
-import { auth } from "@opencut/auth/server";
-import { toNextJsHandler } from "better-auth/next-js";
-
-export const { POST, GET } = toNextJsHandler(auth);
-\ No newline at end of file
+import { auth } from "@opencut/auth";
+import { toNextJsHandler } from "better-auth/next-js";
+
+export const { POST, GET } = toNextJsHandler(auth);
diff --git a/apps/web/src/app/api/health/route.ts b/apps/web/src/app/api/health/route.ts
index ecb9ce04..f8c951fe 100644
--- a/apps/web/src/app/api/health/route.ts
+++ b/apps/web/src/app/api/health/route.ts
@@ -1,5 +1,5 @@
 import { NextRequest } from "next/server";
 
 export async function GET(request: NextRequest) {
-  return new Response("OK", { status: 200 });
+	return new Response("OK", { status: 200 });
 }
diff --git a/apps/web/src/app/api/waitlist/route.ts b/apps/web/src/app/api/waitlist/route.ts
index f6f81103..98232e49 100644
--- a/apps/web/src/app/api/waitlist/route.ts
+++ b/apps/web/src/app/api/waitlist/route.ts
@@ -1,64 +1,105 @@
-import { NextRequest, NextResponse } from "next/server";
-import { db, eq } from "@opencut/db";
-import { waitlist } from "@opencut/db/schema";
-import { nanoid } from "nanoid";
-import { waitlistRateLimit } from "@/lib/rate-limit";
-import { z } from "zod";
-
-const waitlistSchema = z.object({
-  email: z.string().email("Invalid email format").min(1, "Email is required"),
-});
-
-export async function POST(request: NextRequest) {
-  // Rate limit check
-  const identifier = request.headers.get("x-forwarded-for") ?? "127.0.0.1";
-  const { success } = await waitlistRateLimit.limit(identifier);
-
-  if (!success) {
-    return NextResponse.json(
-      { error: "Too many requests. Please try again later." },
-      { status: 429 }
-    );
-  }
-
-  try {
-    const body = await request.json();
-    const { email } = waitlistSchema.parse(body);
-
-    // Check if email already exists
-    const existingEmail = await db
-      .select()
-      .from(waitlist)
-      .where(eq(waitlist.email, email.toLowerCase()))
-      .limit(1);
-
-    if (existingEmail.length > 0) {
-      return NextResponse.json(
-        { error: "Email already registered" },
-        { status: 409 }
-      );
-    }
-
-    // Add to waitlist
-    await db.insert(waitlist).values({
-      id: nanoid(),
-      email: email.toLowerCase(),
-    });
-
-    return NextResponse.json(
-      { message: "Successfully joined waitlist!" },
-      { status: 201 }
-    );
-  } catch (error) {
-    if (error instanceof z.ZodError) {
-      const firstError = error.errors[0];
-      return NextResponse.json({ error: firstError.message }, { status: 400 });
-    }
-
-    console.error("Waitlist signup error:", error);
-    return NextResponse.json(
-      { error: "Internal server error" },
-      { status: 500 }
-    );
-  }
-}
+import { NextRequest, NextResponse } from "next/server";
+import { db, eq, waitlist } from "@opencut/db";
+import { checkBotId } from "botid/server";
+import { nanoid } from "nanoid";
+import { waitlistRateLimit } from "@/lib/rate-limit";
+import { z } from "zod";
+import { env } from "@/env";
+import { cookies } from "next/headers";
+import crypto from "crypto";
+
+const waitlistSchema = z.object({
+	email: z.string().email("Invalid email format").min(1, "Email is required"),
+});
+
+const CSRF_TOKEN_NAME = "waitlist-csrf";
+const TOKEN_EXPIRY = 60 * 60 * 1000;
+
+async function validateCSRFToken(request: NextRequest): Promise<boolean> {
+	const clientToken = request.headers.get("x-csrf-token");
+	if (!clientToken) return false;
+
+	const cookieStore = await cookies();
+	const cookieValue = cookieStore.get(CSRF_TOKEN_NAME)?.value;
+	if (!cookieValue) return false;
+
+	const [token, timestamp, signature] = cookieValue.split(":");
+	if (!token || !timestamp || !signature) return false;
+
+	if (clientToken !== token) return false;
+
+	const now = Date.now();
+	const tokenTime = parseInt(timestamp);
+	if (now - tokenTime > TOKEN_EXPIRY) return false;
+
+	const expectedSignature = crypto
+		.createHmac("sha256", env.BETTER_AUTH_SECRET)
+		.update(`${token}:${timestamp}`)
+		.digest("hex");
+
+	return signature === expectedSignature;
+}
+
+export async function POST(request: NextRequest) {
+	const verification = await checkBotId();
+
+	if (verification.isBot) {
+		return NextResponse.json({ error: "Access denied" }, { status: 403 });
+	}
+
+	const identifier = request.headers.get("x-forwarded-for") ?? "127.0.0.1";
+	const { success } = await waitlistRateLimit.limit(identifier);
+
+	if (!success) {
+		return NextResponse.json(
+			{ error: "Too many requests. Please try again later." },
+			{ status: 429 },
+		);
+	}
+	const isValidToken = await validateCSRFToken(request);
+	if (!isValidToken) {
+		return NextResponse.json(
+			{ error: "Invalid security token" },
+			{ status: 403 },
+		);
+	}
+
+	try {
+		const body = await request.json();
+		const { email } = waitlistSchema.parse(body);
+
+		const existingEmail = await db
+			.select()
+			.from(waitlist)
+			.where(eq(waitlist.email, email.toLowerCase()))
+			.limit(1);
+
+		if (existingEmail.length > 0) {
+			return NextResponse.json(
+				{ error: "Email already registered" },
+				{ status: 409 },
+			);
+		}
+
+		await db.insert(waitlist).values({
+			id: nanoid(),
+			email: email.toLowerCase(),
+		});
+
+		return NextResponse.json(
+			{ message: "Successfully joined waitlist!" },
+			{ status: 201 },
+		);
+	} catch (error) {
+		if (error instanceof z.ZodError) {
+			const firstError = error.errors[0];
+			return NextResponse.json({ error: firstError.message }, { status: 400 });
+		}
+
+		console.error("Waitlist signup error:", error);
+		return NextResponse.json(
+			{ error: "Internal server error" },
+			{ status: 500 },
+		);
+	}
+}
diff --git a/apps/web/src/app/api/waitlist/token/route.ts b/apps/web/src/app/api/waitlist/token/route.ts
new file mode 100644
index 00000000..6f5ee18f
--- /dev/null
+++ b/apps/web/src/app/api/waitlist/token/route.ts
@@ -0,0 +1,61 @@
+import { NextRequest, NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import crypto from "crypto";
+import { env } from "@/env";
+
+const CSRF_TOKEN_NAME = "waitlist-csrf";
+const TOKEN_EXPIRY = 60 * 60 * 1000;
+const allowedHosts =
+	env.NODE_ENV === "development"
+		? ["localhost:3000", "127.0.0.1:3000"]
+		: ["opencut.app", "www.opencut.app"];
+
+export async function GET(request: NextRequest) {
+	const referer = request.headers.get("referer");
+	const host = request.headers.get("host");
+
+	if (referer) {
+		const refererUrl = new URL(referer);
+
+		if (
+			!allowedHosts.some(
+				(allowed) =>
+					refererUrl.host === allowed || refererUrl.host.endsWith(allowed),
+			)
+		) {
+			return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+		}
+	} else if (host) {
+		if (
+			!allowedHosts.some(
+				(allowed) => host === allowed || host.endsWith(allowed),
+			)
+		) {
+			return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+		}
+	} else {
+		return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+	}
+
+	if (!env.BETTER_AUTH_SECRET) {
+		throw new Error("BETTER_AUTH_SECRET must be configured");
+	}
+
+	const token = crypto.randomBytes(32).toString("hex");
+	const timestamp = Date.now();
+	const signature = crypto
+		.createHmac("sha256", env.BETTER_AUTH_SECRET)
+		.update(`${token}:${timestamp}`)
+		.digest("hex");
+
+	const cookieStore = await cookies();
+	cookieStore.set(CSRF_TOKEN_NAME, `${token}:${timestamp}:${signature}`, {
+		httpOnly: true,
+		secure: env.NODE_ENV === "production",
+		sameSite: "strict",
+		maxAge: TOKEN_EXPIRY / 1000,
+		path: "/",
+	});
+
+	return NextResponse.json({ token });
+}