Audit fixes: VIP self-grant, draft leak, onboarding flag, hero personalization, gated downloads

2026-10-09 16:20:55 +03:00
parent c34611dc36
commit 5ee706ebd6
150 changed files with 24054 additions and 0 deletions
@@ -0,0 +1,46 @@
+/* Cloudflare Email Sending (REST) — activates only when CLOUDFLARE_API_TOKEN
+   and CLOUDFLARE_ACCOUNT_ID are set. Without them, sendVerificationEmail
+   returns { sent: false } and the UI degrades to a clear status message; the
+   flow itself never breaks. Single-shot: no retry (resend route re-invokes). */
+export async function sendVerificationEmail(to: string, token: string): Promise<{ sent: boolean }> {
+  const apiToken = process.env.CLOUDFLARE_API_TOKEN
+  const accountId = process.env.CLOUDFLARE_ACCOUNT_ID
+  if (!apiToken || !accountId) return { sent: false }
+
+  const siteUrl = process.env.NEXT_PUBLIC_SITE_URL || 'http://localhost:3000'
+  const link = `${siteUrl}/api/auth/verify-email?token=${encodeURIComponent(token)}`
+
+  try {
+    const res = await fetch(`https://api.cloudflare.com/client/v4/accounts/${accountId}/email/sending/send`, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        to,
+        from: { address: process.env.MAIL_FROM ?? 'noreply@anwarpy.ai', name: 'أنور بي آي' },
+        subject: 'أكد بريدك — أنور بي آي',
+        html: `<p>مرحباً بك في أنور بي آي.</p>
+<p>أكّد بريدك بفتح هذا الرابط:</p>
+<p><a href="${link}">${link}</a></p>
+<p>إن لم تطلب هذا الحساب، تجاهل هذه الرسالة.</p>`,
+        text: `مرحباً بك في أنور بي آي.\n\nأكّد بريدك بفتح هذا الرابط:\n${link}\n\nإن لم تطلب هذا الحساب، تجاهل هذه الرسالة.`,
+      }),
+    })
+
+    if (!res.ok) {
+      console.error('cloudflare email sending failed:', res.status, await res.text())
+      return { sent: false }
+    }
+    const json = (await res.json()) as { success?: boolean }
+    if (!json.success) {
+      console.error('cloudflare email sending rejected:', JSON.stringify(json))
+      return { sent: false }
+    }
+    return { sent: true }
+  } catch (err) {
+    console.error('cloudflare email sending threw:', err)
+    return { sent: false }
+  }
+}