2 files changed, 196 insertions, 24 deletions
diff --git a/apps/web/src/app/api/waitlist/route.ts b/apps/web/src/app/api/waitlist/route.ts
index f6f81103..4d64be77 100644
--- a/apps/web/src/app/api/waitlist/route.ts
+++ b/apps/web/src/app/api/waitlist/route.ts
@@ -4,51 +4,179 @@ import { waitlist } from "@opencut/db/schema";
 import { nanoid } from "nanoid";
 import { waitlistRateLimit } from "@/lib/rate-limit";
 import { z } from "zod";
+import { env } from "@/env";
+import { cookies } from "next/headers";
+import crypto from "crypto";
 
 const waitlistSchema = z.object({
   email: z.string().email("Invalid email format").min(1, "Email is required"),
 });
 
+const CSRF_TOKEN_NAME = "waitlist-csrf";
+const TOKEN_EXPIRY = 60 * 60 * 1000;
+
+function validateBrowserRequest(request: NextRequest): boolean {
+  const origin = request.headers.get("origin");
+  const referer = request.headers.get("referer");
+  const userAgent = request.headers.get("user-agent") || "";
+  const secFetchSite = request.headers.get("sec-fetch-site");
+  const secFetchMode = request.headers.get("sec-fetch-mode");
+  const secFetchDest = request.headers.get("sec-fetch-dest");
+  const contentType = request.headers.get("content-type");
+  const accept = request.headers.get("accept");
+
+  if (env.NODE_ENV === "development") {
+    console.log("=== Validating Browser Request ===");
+    console.log("Origin:", origin);
+    console.log("Referer:", referer);
+    console.log("User-Agent:", userAgent);
+    console.log("Sec-Fetch-Site:", secFetchSite);
+    console.log("Sec-Fetch-Mode:", secFetchMode);
+    console.log("Sec-Fetch-Dest:", secFetchDest);
+    console.log("Content-Type:", contentType);
+    console.log("Accept:", accept);
+  }
+
+  const allowedOrigins =
+    env.NODE_ENV === "development" ? ["http://localhost:3000", "http://127.0.0.1:3000"] : ["https://opencut.app", "https://www.opencut.app"];
+
+  if (!origin || !allowedOrigins.includes(origin)) {
+    console.log("Failed: Invalid origin");
+    return false;
+  }
+
+  if (!referer || !referer.startsWith(origin)) {
+    console.log("Failed: Invalid referer");
+    return false;
+  }
+
+  const suspiciousUserAgents = [
+    "curl",
+    "wget",
+    "postman",
+    "insomnia",
+    "thunder client",
+    "httpie",
+    "python-requests",
+    "node-fetch",
+    "axios",
+    "scrapy",
+    "httpclient",
+    "okhttp",
+    "libwww-perl",
+    "python-urllib",
+    "go-http-client",
+    "java/",
+    "apache-httpclient",
+  ];
+
+  const lowerUserAgent = userAgent.toLowerCase();
+  if (!userAgent || suspiciousUserAgents.some((agent) => lowerUserAgent.includes(agent))) {
+    console.log("Failed: Suspicious user agent");
+    return false;
+  }
+
+  const hasBrowserIndicators =
+    lowerUserAgent.includes("mozilla/") ||
+    lowerUserAgent.includes("chrome/") ||
+    lowerUserAgent.includes("safari/") ||
+    lowerUserAgent.includes("firefox/") ||
+    lowerUserAgent.includes("edge/");
+
+  if (!hasBrowserIndicators) {
+    console.log("Failed: No browser indicators in user agent");
+    return false;
+  }
+
+  if (secFetchSite && secFetchSite !== "same-origin") {
+    console.log("Failed: Invalid Sec-Fetch-Site:", secFetchSite);
+    return false;
+  }
+
+  if (secFetchMode && secFetchMode !== "cors") {
+    console.log("Failed: Invalid Sec-Fetch-Mode:", secFetchMode);
+    return false;
+  }
+
+  if (secFetchDest && secFetchDest !== "empty") {
+    console.log("Failed: Invalid Sec-Fetch-Dest:", secFetchDest);
+    return false;
+  }
+
+  if (!contentType || !contentType.includes("application/json")) {
+    console.log("Failed: Invalid Content-Type");
+    return false;
+  }
+
+  if (!accept || (!accept.includes("application/json") && !accept.includes("*/*"))) {
+    console.log("Failed: Invalid Accept header");
+    return false;
+  }
+
+  console.log("Browser validation passed!");
+  return true;
+}
+
+async function validateCSRFToken(request: NextRequest): Promise<boolean> {
+  const clientToken = request.headers.get("x-csrf-token");
+  if (!clientToken) return false;
+
+  const cookieStore = await cookies();
+  const cookieValue = cookieStore.get(CSRF_TOKEN_NAME)?.value;
+  if (!cookieValue) return false;
+
+  const [token, timestamp, signature] = cookieValue.split(":");
+  if (!token || !timestamp || !signature) return false;
+
+  if (clientToken !== token) return false;
+
+  const now = Date.now();
+  const tokenTime = parseInt(timestamp);
+  if (now - tokenTime > TOKEN_EXPIRY) return false;
+
+  const expectedSignature = crypto
+    .createHmac("sha256", env.BETTER_AUTH_SECRET || "fallback-secret")
+    .update(`${token}:${timestamp}`)
+    .digest("hex");
+
+  return signature === expectedSignature;
+}
+
 export async function POST(request: NextRequest) {
-  // Rate limit check
   const identifier = request.headers.get("x-forwarded-for") ?? "127.0.0.1";
   const { success } = await waitlistRateLimit.limit(identifier);
 
   if (!success) {
-    return NextResponse.json(
-      { error: "Too many requests. Please try again later." },
-      { status: 429 }
-    );
+    return NextResponse.json({ error: "Too many requests. Please try again later." }, { status: 429 });
+  }
+
+  if (!validateBrowserRequest(request)) {
+    await new Promise((resolve) => setTimeout(resolve, Math.random() * 2000 + 1000));
+
+    return NextResponse.json({ error: "Invalid request" }, { status: 403 });
+  }
+
+  const isValidToken = await validateCSRFToken(request);
+  if (!isValidToken) {
+    return NextResponse.json({ error: "Invalid security token" }, { status: 403 });
   }
 
   try {
     const body = await request.json();
     const { email } = waitlistSchema.parse(body);
 
-    // Check if email already exists
-    const existingEmail = await db
-      .select()
-      .from(waitlist)
-      .where(eq(waitlist.email, email.toLowerCase()))
-      .limit(1);
+    const existingEmail = await db.select().from(waitlist).where(eq(waitlist.email, email.toLowerCase())).limit(1);
 
     if (existingEmail.length > 0) {
-      return NextResponse.json(
-        { error: "Email already registered" },
-        { status: 409 }
-      );
+      return NextResponse.json({ error: "Email already registered" }, { status: 409 });
     }
 
-    // Add to waitlist
     await db.insert(waitlist).values({
       id: nanoid(),
       email: email.toLowerCase(),
     });
 
-    return NextResponse.json(
-      { message: "Successfully joined waitlist!" },
-      { status: 201 }
-    );
+    return NextResponse.json({ message: "Successfully joined waitlist!" }, { status: 201 });
   } catch (error) {
     if (error instanceof z.ZodError) {
       const firstError = error.errors[0];
@@ -56,9 +184,6 @@ export async function POST(request: NextRequest) {
     }
 
     console.error("Waitlist signup error:", error);
-    return NextResponse.json(
-      { error: "Internal server error" },
-      { status: 500 }
-    );
+    return NextResponse.json({ error: "Internal server error" }, { status: 500 });
   }
 }
diff --git a/apps/web/src/app/api/waitlist/token/route.ts b/apps/web/src/app/api/waitlist/token/route.ts
new file mode 100644
index 00000000..76622fc5
--- /dev/null
+++ b/apps/web/src/app/api/waitlist/token/route.ts
@@ -0,0 +1,47 @@
+import { NextRequest, NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import crypto from "crypto";
+import { env } from "@/env";
+
+const CSRF_TOKEN_NAME = "waitlist-csrf";
+const TOKEN_EXPIRY = 60 * 60 * 1000;
+
+export async function GET(request: NextRequest) {
+  const referer = request.headers.get("referer");
+  const host = request.headers.get("host");
+
+  if (referer) {
+    const refererUrl = new URL(referer);
+    const allowedHosts = env.NODE_ENV === "development" ? ["localhost:3000", "127.0.0.1:3000"] : ["opencut.app", "www.opencut.app"];
+
+    if (!allowedHosts.some((allowed) => refererUrl.host === allowed || refererUrl.host.endsWith(allowed))) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+  } else if (host) {
+    const allowedHosts = env.NODE_ENV === "development" ? ["localhost:3000", "127.0.0.1:3000"] : ["opencut.app", "www.opencut.app"];
+
+    if (!allowedHosts.some((allowed) => host === allowed || host.endsWith(allowed))) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+  } else {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  const token = crypto.randomBytes(32).toString("hex");
+  const timestamp = Date.now();
+  const signature = crypto
+    .createHmac("sha256", env.BETTER_AUTH_SECRET || "fallback-secret")
+    .update(`${token}:${timestamp}`)
+    .digest("hex");
+
+  const cookieStore = await cookies();
+  cookieStore.set(CSRF_TOKEN_NAME, `${token}:${timestamp}:${signature}`, {
+    httpOnly: true,
+    secure: env.NODE_ENV === "production",
+    sameSite: "strict",
+    maxAge: TOKEN_EXPIRY / 1000,
+    path: "/",
+  });
+
+  return NextResponse.json({ token });
+}