mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-08-12 16:11:35 +00:00
pezkuwichain
dc8533d707
The web app calls these three from TwoFactorSetup, TwoFactorVerify, NotificationBell, AdminPanel and EmailVerification, but this repo never defined them and they are not deployed to the self-hosted host the app points at. They were left behind on the cloud project when everything else moved, so every one of those calls has been hitting a function that is not there — two-factor auth, notifications and email verification have all been silently dead. Recovered from the deployed bundles on the cloud project and added here so the source is tracked and CI deploys them alongside the rest. The tables they need (two_factor_auth, notifications, activity_logs, profiles, email_verification_tokens) already exist on the self-hosted database, so this is a code move only. Registry on the host now lists all three under this project. NOTE: two-factor-auth and notifications-manager take userId straight from the request body while running with the service role, and neither checks the caller. That is how they run on the cloud project today, so this change does not make it worse, but it does mean anyone can disable another account's 2FA or read and delete their notifications. Fixing it properly needs an admin-role check alongside the JWT, because AdminPanel legitimately creates notifications for other users. Tracked separately rather than folded into a move.
101 lines
3.0 KiB
TypeScript
101 lines
3.0 KiB
TypeScript
export const corsHeaders = {
|
|
"Access-Control-Allow-Origin": "*",
|
|
"Access-Control-Allow-Headers":
|
|
"authorization, x-client-info, apikey, content-type",
|
|
};
|
|
|
|
Deno.serve(async (req) => {
|
|
if (req.method === "OPTIONS") {
|
|
return new Response("ok", { headers: corsHeaders });
|
|
}
|
|
|
|
try {
|
|
const { action, token, email } = await req.json();
|
|
|
|
if (action === "send") {
|
|
// Generate verification token
|
|
const verificationToken = crypto.randomUUID();
|
|
|
|
// Store token in database (expires in 24 hours)
|
|
const { createClient } =
|
|
await import("https://esm.sh/@supabase/supabase-js@2");
|
|
const supabaseUrl = Deno.env.get("SUPABASE_URL")!;
|
|
const supabaseKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!;
|
|
const supabase = createClient(supabaseUrl, supabaseKey);
|
|
|
|
const { data: user } = await supabase.auth.admin.getUserByEmail(email);
|
|
|
|
if (!user?.user) {
|
|
throw new Error("User not found");
|
|
}
|
|
|
|
await supabase.from("email_verification_tokens").insert({
|
|
user_id: user.user.id,
|
|
token: verificationToken,
|
|
email: email,
|
|
expires_at: new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(),
|
|
});
|
|
|
|
// In production, send email via email service
|
|
// For now, return the token
|
|
return new Response(
|
|
JSON.stringify({
|
|
success: true,
|
|
message: "Verification email sent",
|
|
token: verificationToken, // Remove in production
|
|
}),
|
|
{ headers: { ...corsHeaders, "Content-Type": "application/json" } },
|
|
);
|
|
}
|
|
|
|
if (action === "verify") {
|
|
const { createClient } =
|
|
await import("https://esm.sh/@supabase/supabase-js@2");
|
|
const supabaseUrl = Deno.env.get("SUPABASE_URL")!;
|
|
const supabaseKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!;
|
|
const supabase = createClient(supabaseUrl, supabaseKey);
|
|
|
|
// Check token validity
|
|
const { data: tokenData } = await supabase
|
|
.from("email_verification_tokens")
|
|
.select("*")
|
|
.eq("token", token)
|
|
.single();
|
|
|
|
if (!tokenData || new Date(tokenData.expires_at) < new Date()) {
|
|
throw new Error("Invalid or expired token");
|
|
}
|
|
|
|
// Update user profile
|
|
await supabase
|
|
.from("profiles")
|
|
.update({
|
|
email_verified: true,
|
|
email_verified_at: new Date().toISOString(),
|
|
})
|
|
.eq("id", tokenData.user_id);
|
|
|
|
// Delete used token
|
|
await supabase
|
|
.from("email_verification_tokens")
|
|
.delete()
|
|
.eq("token", token);
|
|
|
|
return new Response(
|
|
JSON.stringify({
|
|
success: true,
|
|
message: "Email verified successfully",
|
|
}),
|
|
{ headers: { ...corsHeaders, "Content-Type": "application/json" } },
|
|
);
|
|
}
|
|
|
|
throw new Error("Invalid action");
|
|
} catch (error) {
|
|
return new Response(JSON.stringify({ error: error.message }), {
|
|
headers: { ...corsHeaders, "Content-Type": "application/json" },
|
|
status: 400,
|
|
});
|
|
}
|
|
});
|