Matt
f183f58b0c
Address the CRITICAL + high-leverage HIGH items from the types-auditor:
**C1 — `tx: any` in client-restore.service**
Export a canonical `Tx` type from `lib/db/utils.ts` (derived from
Drizzle's `db.transaction` callback shape) and use it in
`applyReversal` so the 12+ downstream tx writes get full inference.
**C2 — berth-detail page stacked `useQuery<any>` escape hatches**
Export `BerthDetailData` from berth-detail-header and consume it
through useQuery + apiFetch. Removed three `any` escapes in the
highest-traffic detail page. Also collapsed the duplicate `BerthData`
in berth-tabs.tsx to import from berth-detail-header so the two
types can't drift.
**C3 — parseBody migration for portal/public routes**
Replace raw `await req.json() + schema.parse(body)` with the
project-standard `parseBody(req, schema)` helper across 7 routes:
- portal/auth/{change-password, activate, reset-password}
- auth/set-password
- public/{interests, residential-inquiries}
Skipped the three anti-enumeration routes (forgot-password, sign-in,
sign-in-by-identifier) where the manual validation gives opaque
errors on purpose. website-inquiries already wraps the parse in a
custom 400 — left as-is.
**HIGH #5 — `toAuditJson<T>` helper (21 → 0 inline casts)**
Introduce `toAuditJson<T extends object>(row: T): Record<string,
unknown>` in lib/audit.ts (mirrors gdpr-bundle-builder's `toJsonRow`
that already exists for the same reason). Codemod 21 `<row> as unknown
as Record<string, unknown>` sites across:
- invoices.ts × 6
- expenses.ts × 6
- berths.service × 2
- documents.service × 2
- ocr-config.service × 2
- ai-budget.service × 2
- yachts.service, companies.service, company-memberships.service × 1 each
document-templates' `payload as unknown as Record<...>` is a different
shape (Documenso form-values widening, not an audit log) — kept the
manual cast there. Tests stay 1315/1315.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
26 lines
831 B
TypeScript
26 lines
831 B
TypeScript
import { NextRequest, NextResponse } from 'next/server';
|
|
import { z } from 'zod';
|
|
|
|
import { enforcePublicRateLimit, parseBody } from '@/lib/api/route-helpers';
|
|
import { errorResponse } from '@/lib/errors';
|
|
import { resetPassword } from '@/lib/services/portal-auth.service';
|
|
|
|
const bodySchema = z.object({
|
|
token: z.string().min(1),
|
|
password: z.string().min(9),
|
|
});
|
|
|
|
export async function POST(req: NextRequest): Promise<NextResponse> {
|
|
// 10/hour/IP — bounds brute-force against the 32-byte reset token.
|
|
const limited = await enforcePublicRateLimit(req, 'portalToken');
|
|
if (limited) return limited;
|
|
|
|
try {
|
|
const { token, password } = await parseBody(req, bodySchema);
|
|
await resetPassword(token, password);
|
|
return NextResponse.json({ success: true });
|
|
} catch (err) {
|
|
return errorResponse(err);
|
|
}
|
|
}
|