homeio

1import { NextResponse } from "next/server";
2import { z } from "zod";
3
4import {
5  createRequestId,
6  logServerAction,
7  withServerTiming,
8} from "@/lib/server/logging/logger";
9import { requireApiSession } from "@/lib/server/modules/auth/api";
10import {
11  TotpServiceError,
12  completeTotpEnrollment,
13} from "@/lib/server/modules/auth/totp-service";
14
15export const runtime = "nodejs";
16
17const verifySchema = z.object({
18  code: z.string().trim().min(1).max(16),
19});
20
21export async function POST(request: Request) {
22  const requestId = createRequestId();
23  const apiSession = await requireApiSession(request);
24  if (apiSession.response) return apiSession.response;
25
26  let body: unknown;
27  try {
28    body = await request.json();
29  } catch {
30    return NextResponse.json(
31      { error: "Invalid request payload" },
32      { status: 400 },
33    );
34  }
35
36  const parsed = verifySchema.safeParse(body);
37  if (!parsed.success) {
38    return NextResponse.json(
39      { error: "Invalid request payload" },
40      { status: 400 },
41    );
42  }
43
44  try {
45    const data = await withServerTiming(
46      {
47        layer: "api",
48        action: "auth.2fa.verify",
49        requestId,
50      },
51      async () =>
52        completeTotpEnrollment({
53          userId: apiSession.session.userId,
54          code: parsed.data.code,
55        }),
56    );
57
58    return NextResponse.json({ data });
59  } catch (error) {
60    if (error instanceof TotpServiceError) {
61      logServerAction({
62        level: "warn",
63        layer: "api",
64        action: "auth.2fa.verify",
65        status: "error",
66        requestId,
67        error,
68        meta: { code: error.code },
69      });
70      return NextResponse.json(
71        { error: error.publicMessage, code: error.code },
72        { status: error.statusCode },
73      );
74    }
75
76    logServerAction({
77      level: "error",
78      layer: "api",
79      action: "auth.2fa.verify",
80      status: "error",
81      requestId,
82      error,
83    });
84    return NextResponse.json(
85      { error: "Failed to verify two-factor code" },
86      { status: 500 },
87    );
88  }
89}
90