homeio

1import { z } from "zod";
2import { type NextRequest, NextResponse } from "next/server";
3import {
4  createRequestId,
5  logServerAction,
6  withServerTiming,
7} from "@/lib/server/logging/logger";
8import { getAuthCookieName } from "@/lib/server/modules/auth/cookies";
9import { AuthError, verifyUnlockPassword } from "@/lib/server/modules/auth/service";
10
11export const runtime = "nodejs";
12
13const unlockSchema = z.object({
14  password: z.string().min(1),
15});
16
17export async function POST(request: NextRequest) {
18  const requestId = createRequestId();
19  const sessionToken = request.cookies.get(getAuthCookieName())?.value;
20
21  try {
22    const body = await request.json();
23    const parsed = unlockSchema.safeParse(body);
24
25    if (!parsed.success) {
26      return NextResponse.json(
27        {
28          error: "Invalid request payload",
29        },
30        { status: 400 },
31      );
32    }
33
34    await withServerTiming(
35      {
36        layer: "api",
37        action: "auth.unlock",
38        requestId,
39      },
40      async () => {
41        await verifyUnlockPassword({
42          sessionToken,
43          password: parsed.data.password,
44        });
45      },
46    );
47
48    return NextResponse.json({ ok: true });
49  } catch (error) {
50    const statusCode = error instanceof AuthError ? error.statusCode : 500;
51
52    logServerAction({
53      level: statusCode >= 500 ? "error" : "warn",
54      layer: "api",
55      action: "auth.unlock",
56      status: "error",
57      requestId,
58      error,
59    });
60
61    return NextResponse.json(
62      {
63        error: error instanceof AuthError ? error.message : "Unlock failed",
64      },
65      { status: statusCode },
66    );
67  }
68}
69