Leon SerfatyandClaude Opus 4.8
5495b94924
Deploy config: - .do/app.yaml: build the Dockerfile directly from GitHub (deploy_on_push) instead of a pre-built DOCR image; NEXT_PUBLIC_* set RUN_AND_BUILD_TIME with the propertymanagement.network domain so they bake into the client bundle; add custom domains block (apex + www); wire Sentry DSN (server + browser). Included pending work from the audit-fixes branch: - AI provider abstraction (OpenAI/Anthropic, admin-selectable; Anthropic default) - Per-landlord e-signature (DocuSign OAuth + Dropbox Sign) + migration 0010 - Outbound webhooks / Zapier integration - PayPal removal (Stripe-only billing) - Storage hardening (fail-loud when Spaces unconfigured), security fixes Verified: full production Docker build (same build-args as DO) passes clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
50 lines
1.8 KiB
TypeScript
50 lines
1.8 KiB
TypeScript
import crypto from "crypto"
|
|
import { NextResponse } from "next/server"
|
|
import { getSessionUser } from "@/lib/session"
|
|
import { getAccountContext } from "@/lib/account"
|
|
import { getAdapter } from "@/lib/esign"
|
|
import { signState, ESIGN_NONCE_COOKIE } from "@/lib/esign/state"
|
|
|
|
// Starts the OAuth connect flow for an e-signature provider (owner-only).
|
|
// API-key providers (Dropbox Sign) don't use this — they connect via a form.
|
|
export async function GET(request: Request, { params }: { params: Promise<{ provider: string }> }) {
|
|
const { provider } = await params
|
|
const adapter = getAdapter(provider)
|
|
const settings = new URL("/settings/integrations", request.url)
|
|
|
|
if (!adapter) {
|
|
settings.searchParams.set("error", "unknown_provider")
|
|
return NextResponse.redirect(settings)
|
|
}
|
|
|
|
const user = await getSessionUser()
|
|
if (!user) return NextResponse.redirect(new URL("/login", request.url))
|
|
|
|
const ctx = await getAccountContext(user.id)
|
|
if (!ctx.isOwner) {
|
|
settings.searchParams.set("error", "owner_only")
|
|
return NextResponse.redirect(settings)
|
|
}
|
|
if (adapter.kind !== "oauth") {
|
|
settings.searchParams.set("error", "use_api_key")
|
|
return NextResponse.redirect(settings)
|
|
}
|
|
if (!adapter.available()) {
|
|
settings.searchParams.set("error", "not_configured")
|
|
return NextResponse.redirect(settings)
|
|
}
|
|
|
|
// Bind the round-trip to this browser: nonce in the signed state AND a cookie.
|
|
const nonce = crypto.randomUUID()
|
|
const state = signState({ ownerId: ctx.ownerId, provider, nonce })
|
|
const res = NextResponse.redirect(adapter.getAuthUrl(state))
|
|
res.cookies.set(ESIGN_NONCE_COOKIE, nonce, {
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === "production",
|
|
sameSite: "lax",
|
|
path: "/",
|
|
maxAge: 600,
|
|
})
|
|
return res
|
|
}
|