29 lines
1.2 KiB
TypeScript
29 lines
1.2 KiB
TypeScript
import { APIError } from "better-auth/api";
|
|
import * as z from "zod";
|
|
import { getAuth, getCustomerSession } from "@/lib/auth/server";
|
|
import { errorResponse, HttpError, readJson, requireSameOrigin } from "@/lib/security/http";
|
|
import { limitRequest } from "@/lib/security/rate-limit";
|
|
|
|
export async function POST(request: Request) {
|
|
try {
|
|
requireSameOrigin(request);
|
|
const session = await getCustomerSession();
|
|
if (!session) throw new HttpError(401, "unauthorized");
|
|
await limitRequest("password-set", session.user.id, 5, 3600);
|
|
const parsed = z.object({ newPassword: z.string().min(6).max(128) })
|
|
.safeParse(await readJson(request, 1024));
|
|
if (!parsed.success) throw new HttpError(400, "invalid-password");
|
|
await getAuth().api.setPassword({ headers: request.headers, body: parsed.data });
|
|
return new Response(null, { status: 204, headers: { "Cache-Control": "no-store" } });
|
|
} catch (cause) {
|
|
if (cause instanceof APIError) {
|
|
const error = typeof cause.body?.code === "string" ? cause.body.code : "password-setting-failed";
|
|
return Response.json({ error }, {
|
|
status: cause.statusCode || 400,
|
|
headers: { "Cache-Control": "no-store" },
|
|
});
|
|
}
|
|
return errorResponse(cause);
|
|
}
|
|
}
|