ThreadCount
a6f1059ddf
Uniform stock management for healthcare linen rooms: the coordinator app, the phone counter and the staff app, for your own server. Built from a113353 on 2026-09-15. Licensed under the Functional Source License (FSL-1.1-ALv2).
29 lines
1.7 KiB
TypeScript
29 lines
1.7 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { prisma } from "@/lib/db";
|
|
import { sameOriginJson } from "@/lib/csrf";
|
|
import { allow, clientIp } from "@/lib/ratelimit";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
/* Which door does this address belong at?
|
|
*
|
|
* The sign-in screen asks for the address first and only then shows a password box, a single
|
|
* sign-on button or a pointer to the staff app. This answers the last of those: an address that
|
|
* has no coordinator account but does have a staff-app account belongs in the staff app, and
|
|
* telling the person so beats a "wrong password" they can never get past. It answers nothing about
|
|
* coordinator accounts — a coordinator address and an unknown address get the same reply, so the
|
|
* box cannot be used to test which addresses have one. Throttled per connection like the SSO lookup. */
|
|
export async function POST(req: NextRequest) {
|
|
const csrf = sameOriginJson(req);
|
|
if (csrf) return NextResponse.json({ error: csrf }, { status: 403 });
|
|
if (!allow("lookup:" + clientIp(req.headers), 60, 15 * 60 * 1000)) return NextResponse.json({ staff: false });
|
|
let body: { email?: unknown };
|
|
try { body = await req.json(); } catch { return NextResponse.json({ error: "Bad request" }, { status: 400 }); }
|
|
const email = String(body.email ?? "").trim().toLowerCase().slice(0, 160);
|
|
if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) return NextResponse.json({ staff: false });
|
|
const user = await prisma.user.findUnique({ where: { email }, select: { id: true } });
|
|
if (user) return NextResponse.json({ staff: false });
|
|
const acc = await prisma.staffAccount.findUnique({ where: { email }, select: { id: true } });
|
|
return NextResponse.json({ staff: !!acc });
|
|
}
|