RomanNum3ral
/
OpenCut
mirror of https://github.com/OpenCut-app/OpenCut.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

coderabbit comments

This commit is contained in:
Ahmet Kilinc 2025-07-16 01:05:42 +01:00
parent eb49500592
commit ece9c78b16
3 changed files with 20 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
apps/web/src/app/api/waitlist/route.ts
View File

@ -135,10 +135,7 @@ async function validateCSRFToken(request: NextRequest): Promise<boolean> {
const tokenTime = parseInt(timestamp);
if (now - tokenTime > TOKEN_EXPIRY) return false;
const expectedSignature = crypto
.createHmac("sha256", env.BETTER_AUTH_SECRET || "fallback-secret")
.update(`${token}:${timestamp}`)
.digest("hex");
const expectedSignature = crypto.createHmac("sha256", env.BETTER_AUTH_SECRET).update(`${token}:${timestamp}`).digest("hex");
return signature === expectedSignature;
}

13
apps/web/src/app/api/waitlist/token/route.ts
View File

@ -5,6 +5,7 @@ import { env } from "@/env";
const CSRF_TOKEN_NAME = "waitlist-csrf";
const TOKEN_EXPIRY = 60 * 60 * 1000;
const allowedHosts = env.NODE_ENV === "development" ? ["localhost:3000", "127.0.0.1:3000"] : ["opencut.app", "www.opencut.app"];
export async function GET(request: NextRequest) {
const referer = request.headers.get("referer");
@ -12,14 +13,11 @@ export async function GET(request: NextRequest) {
if (referer) {
const refererUrl = new URL(referer);
const allowedHosts = env.NODE_ENV === "development" ? ["localhost:3000", "127.0.0.1:3000"] : ["opencut.app", "www.opencut.app"];
if (!allowedHosts.some((allowed) => refererUrl.host === allowed || refererUrl.host.endsWith(allowed))) {
return NextResponse.json({ error: "Forbidden" }, { status: 403 });
}
} else if (host) {
const allowedHosts = env.NODE_ENV === "development" ? ["localhost:3000", "127.0.0.1:3000"] : ["opencut.app", "www.opencut.app"];
if (!allowedHosts.some((allowed) => host === allowed || host.endsWith(allowed))) {
return NextResponse.json({ error: "Forbidden" }, { status: 403 });
}
@ -27,12 +25,13 @@ export async function GET(request: NextRequest) {
return NextResponse.json({ error: "Forbidden" }, { status: 403 });
}
if (!env.BETTER_AUTH_SECRET) {
throw new Error("BETTER_AUTH_SECRET must be configured");
}
const token = crypto.randomBytes(32).toString("hex");
const timestamp = Date.now();
const signature = crypto
.createHmac("sha256", env.BETTER_AUTH_SECRET || "fallback-secret")
.update(`${token}:${timestamp}`)
.digest("hex");
const signature = crypto.createHmac("sha256", env.BETTER_AUTH_SECRET).update(`${token}:${timestamp}`).digest("hex");
const cookieStore = await cookies();
cookieStore.set(CSRF_TOKEN_NAME, `${token}:${timestamp}:${signature}`, {

15
apps/web/src/components/landing/hero.tsx
View File

@ -16,16 +16,24 @@ export function Hero() {
const [csrfToken, setCsrfToken] = useState<string | null>(null);
useEffect(() => {
let isMounted = true;
fetch("/api/waitlist/token", {
credentials: "include",
})
.then((res) => res.json())
.then((data) => {
if (data.token) {
if (isMounted && data.token) {
setCsrfToken(data.token);
}
})
.catch((err) => console.error("Failed to fetch CSRF token:", err));
.catch((err) => {
console.error("Failed to fetch CSRF token:", err);
if (isMounted) {
toast.error("Security initialization failed", {
description: "Please refresh the page to continue.",
});
}
});
}, []);
const handleSubmit = async (e: React.FormEvent) => {
@ -70,6 +78,9 @@ export function Hero() {
.then((res) => res.json())
.then((data) => {
if (data.token) setCsrfToken(data.token);
})
.catch((err) => {
console.error("Failed to refresh CSRF token:", err);
});
} else {
toast.error("Oops!", {