53a33c68fc
* feat: install rate-limiter-flexible and ioredis * feat: setup redis client * feat: add withRateLimit wrapper * feat: wrap trpc endpoint in withRateLimit * feat: wrap withRateLimit on remaining routes * feat: exclude webhook route from rate limiting * chore: update compose files and readme * refactor: move into api/db packages
106 lines
2.6 KiB
TypeScript
106 lines
2.6 KiB
TypeScript
import type { NextApiRequest, NextApiResponse } from "next";
|
||
import { Novu } from "@novu/api";
|
||
import { jwtVerify } from "jose";
|
||
import { z } from "zod";
|
||
|
||
import { env } from "~/env";
|
||
import { withRateLimit } from "@kan/api/utils/rateLimit";
|
||
|
||
const requestSchema = z.object({
|
||
token: z.string().min(1),
|
||
});
|
||
|
||
const tokenPayloadSchema = z.object({
|
||
subscriberId: z.string(),
|
||
});
|
||
|
||
type ResponseData =
|
||
| { success: true }
|
||
| { success: false; error: string; code?: string };
|
||
|
||
const textEncoder = new TextEncoder();
|
||
|
||
export default withRateLimit(
|
||
{ points: 100, duration: 60 },
|
||
async (req: NextApiRequest, res: NextApiResponse<ResponseData>) => {
|
||
if (process.env.NEXT_PUBLIC_KAN_ENV !== "cloud") {
|
||
return res.status(404).json({
|
||
success: false,
|
||
error: "Unsubscribe endpoint is not available.",
|
||
code: "UNAVAILABLE",
|
||
});
|
||
}
|
||
|
||
if (req.method !== "POST") {
|
||
res.setHeader("Allow", "POST");
|
||
return res.status(405).json({
|
||
success: false,
|
||
error: "Method not allowed.",
|
||
code: "METHOD_NOT_ALLOWED",
|
||
});
|
||
}
|
||
|
||
const parsedBody = requestSchema.safeParse(req.body);
|
||
|
||
if (!parsedBody.success) {
|
||
return res.status(400).json({
|
||
success: false,
|
||
error: "Invalid request payload.",
|
||
code: "BAD_REQUEST",
|
||
});
|
||
}
|
||
|
||
if (!env.EMAIL_UNSUBSCRIBE_SECRET || !env.NOVU_API_KEY) {
|
||
return res.status(500).json({
|
||
success: false,
|
||
error: "Unsubscribe service is not configured.",
|
||
code: "NOT_CONFIGURED",
|
||
});
|
||
}
|
||
|
||
let payload: z.infer<typeof tokenPayloadSchema>;
|
||
|
||
try {
|
||
const verified = await jwtVerify(
|
||
parsedBody.data.token,
|
||
textEncoder.encode(env.EMAIL_UNSUBSCRIBE_SECRET),
|
||
{
|
||
// We intentionally do not use exp/iat claims –
|
||
// tokens are long-lived and validated only by signature + payload.
|
||
clockTolerance: "0s",
|
||
},
|
||
);
|
||
payload = tokenPayloadSchema.parse(verified.payload);
|
||
} catch {
|
||
return res.status(401).json({
|
||
success: false,
|
||
error: "Your unsubscribe link is invalid or has expired.",
|
||
code: "INVALID_TOKEN",
|
||
});
|
||
}
|
||
|
||
const novu = new Novu({ secretKey: env.NOVU_API_KEY });
|
||
|
||
try {
|
||
await novu.subscribers.preferences.update(
|
||
{
|
||
channels: {
|
||
email: false,
|
||
},
|
||
},
|
||
payload.subscriberId,
|
||
);
|
||
} catch (error) {
|
||
console.error("Failed to update Novu preferences", error);
|
||
return res.status(502).json({
|
||
success: false,
|
||
error:
|
||
"We could not update your email preferences right now. Please try again later.",
|
||
code: "NOVU_ERROR",
|
||
});
|
||
}
|
||
|
||
return res.status(200).json({ success: true });
|
||
},
|
||
);
|