Maarten Elsenaar
0bd5825e98
Vervangt server action door /api/auto-login GET route zodat <a target="_blank"> werkt. Server action verwijderd. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
29 lines
1.2 KiB
TypeScript
29 lines
1.2 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { createHmac } from "crypto";
|
|
import { getSession } from "../../../lib/auth";
|
|
import { getPlatformDb } from "../../../lib/platform-db";
|
|
|
|
export async function GET(request: NextRequest) {
|
|
const session = await getSession();
|
|
if (!session) return NextResponse.redirect(new URL("/login", request.url));
|
|
|
|
const accountId = Number(request.nextUrl.searchParams.get("account_id"));
|
|
const slug = request.nextUrl.searchParams.get("slug");
|
|
if (!accountId || !slug) return NextResponse.redirect(new URL("/tenants", request.url));
|
|
|
|
const db = getPlatformDb();
|
|
const user = db
|
|
.prepare("SELECT id FROM users WHERE account_id = ? AND role = 'admin' LIMIT 1")
|
|
.get(accountId) as { id: number } | undefined;
|
|
|
|
if (!user) return NextResponse.redirect(new URL("/tenants?error=no-admin", request.url));
|
|
|
|
const secret = process.env.AUTO_LOGIN_SECRET!;
|
|
const expires = Date.now() + 60_000;
|
|
const payload = `${user.id}:${accountId}:${expires}`;
|
|
const sig = createHmac("sha256", secret).update(payload).digest("hex");
|
|
const token = encodeURIComponent(`${payload}:${sig}`);
|
|
|
|
return NextResponse.redirect(`https://${slug}.rikxplatform.nl/auto-login?token=${token}`);
|
|
}
|