Audit fixes: VIP self-grant, draft leak, onboarding flag, hero personalization, gated downloads

web/src/app/api/auth/resend-verification/route.ts

@@ -0,0 +1,35 @@
+import { NextResponse } from 'next/server'
+import { getPayload } from 'payload'
+import { headers } from 'next/headers'
+import { randomBytes } from 'crypto'
+import configPromise from '@payload-config'
+import { sendVerificationEmail } from '@/lib/mail'
+
+export const dynamic = 'force-dynamic'
+
+/* POST /api/auth/resend-verification — logged-in user asks for a fresh
+   verification email. Regenerates the token so old links die. */
+export async function POST() {
+  const payload = await getPayload({ config: configPromise })
+  const { user } = await payload.auth({ headers: await headers() })
+  if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (user.emailVerified) return NextResponse.json({ already: true })
+
+  const token = randomBytes(32).toString('hex')
+  await payload.update({
+    collection: 'users',
+    id: user.id,
+    data: { verificationToken: token },
+    overrideAccess: true,
+    context: { systemActivation: true },
+  })
+
+  const { sent } = await sendVerificationEmail(user.email, token)
+  if (!sent) {
+    return NextResponse.json(
+      { error: 'خدمة البريد غير مربوطة بعد — ستعمل تلقائياً بعد ضبط SMTP على الاستضافة.' },
+      { status: 503 },
+    )
+  }
+  return NextResponse.json({ sent: true })
+}