Security Enhancement: - Server-side validation of email status before allowing verification - Only allow verifying emails in VerificationPending state - Show "Action not possible" message for invalid states - Extract and validate share-id on server side - Return 404 for invalid share-ids or missing tenant emails Implementation: - Convert page.tsx to async server component - Fetch location and check tenantEmailStatus - Pass isPending prop to client component - Add bilingual "not-allowed" translations (same as unsubscribe page) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
46 lines
1.4 KiB
TypeScript
46 lines
1.4 KiB
TypeScript
import { Suspense } from 'react';
|
|
import EmailVerifyPage from './EmailVerifyPage';
|
|
import { Main } from '@/app/ui/Main';
|
|
import { getDbClient } from '@/app/lib/dbClient';
|
|
import { BillingLocation, EmailStatus } from '@/app/lib/db-types';
|
|
import { extractShareId, validateShareChecksum } from '@/app/lib/shareChecksum';
|
|
import { notFound } from 'next/navigation';
|
|
|
|
export default async function Page({ params: { id } }: { params: { id: string } }) {
|
|
// Extract and validate share ID
|
|
const extracted = extractShareId(id);
|
|
if (!extracted) {
|
|
notFound();
|
|
}
|
|
|
|
const { locationId, checksum } = extracted;
|
|
|
|
// Validate checksum
|
|
if (!validateShareChecksum(locationId, checksum)) {
|
|
notFound();
|
|
}
|
|
|
|
// Fetch location to check email status
|
|
const dbClient = await getDbClient();
|
|
const location = await dbClient.collection<BillingLocation>("lokacije")
|
|
.findOne(
|
|
{ _id: locationId },
|
|
{ projection: { tenantEmail: 1, tenantEmailStatus: 1 } }
|
|
);
|
|
|
|
if (!location || !location.tenantEmail) {
|
|
notFound();
|
|
}
|
|
|
|
// Check if email is pending verification
|
|
const isPending = location.tenantEmailStatus === EmailStatus.VerificationPending;
|
|
|
|
return (
|
|
<Main>
|
|
<Suspense fallback={<div className="text-center p-8">Loading...</div>}>
|
|
<EmailVerifyPage shareId={id} isPending={isPending} />
|
|
</Suspense>
|
|
</Main>
|
|
);
|
|
}
|