Audit fixes: VIP self-grant, draft leak, onboarding flag, hero personalization, gated downloads

web/src/app/api/auth/resend-verification/route.ts

@@ -0,0 +1,35 @@
+import { NextResponse } from 'next/server'
+import { getPayload } from 'payload'
+import { headers } from 'next/headers'
+import { randomBytes } from 'crypto'
+import configPromise from '@payload-config'
+import { sendVerificationEmail } from '@/lib/mail'
+
+export const dynamic = 'force-dynamic'
+
+/* POST /api/auth/resend-verification — logged-in user asks for a fresh
+   verification email. Regenerates the token so old links die. */
+export async function POST() {
+  const payload = await getPayload({ config: configPromise })
+  const { user } = await payload.auth({ headers: await headers() })
+  if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (user.emailVerified) return NextResponse.json({ already: true })
+
+  const token = randomBytes(32).toString('hex')
+  await payload.update({
+    collection: 'users',
+    id: user.id,
+    data: { verificationToken: token },
+    overrideAccess: true,
+    context: { systemActivation: true },
+  })
+
+  const { sent } = await sendVerificationEmail(user.email, token)
+  if (!sent) {
+    return NextResponse.json(
+      { error: 'خدمة البريد غير مربوطة بعد — ستعمل تلقائياً بعد ضبط SMTP على الاستضافة.' },
+      { status: 503 },
+    )
+  }
+  return NextResponse.json({ sent: true })
+}

web/src/app/api/auth/verify-email/route.ts

@@ -0,0 +1,34 @@
+import { NextResponse } from 'next/server'
+import { getPayload } from 'payload'
+import { redirect } from 'next/navigation'
+import configPromise from '@payload-config'
+
+export const dynamic = 'force-dynamic'
+
+/* GET /api/auth/verify-email?token=... — the link sent by email.
+   Marks the account verified and lands the user on onboarding. */
+export async function GET(request: Request) {
+  const token = new URL(request.url).searchParams.get('token')
+  if (!token) redirect('/verify-email?invalid=1')
+
+  const payload = await getPayload({ config: configPromise })
+  const { docs } = await payload.find({
+    collection: 'users',
+    where: { verificationToken: { equals: token } },
+    depth: 0,
+    limit: 1,
+    overrideAccess: true,
+  })
+  const user = docs[0]
+  if (!user) redirect('/verify-email?invalid=1')
+
+  await payload.update({
+    collection: 'users',
+    id: user.id,
+    data: { emailVerified: true, verificationToken: null },
+    overrideAccess: true,
+    context: { systemActivation: true },
+  })
+
+  redirect('/onboarding')
+}