Function POST

web/src/app/api/auth/cli/code/route.ts:20–123

(req: Request)

import { getLoginUrlOrigin } from './_origin'

export async function POST(req: Request) {
  const reqSchema = z.object({
    fingerprintId: z.string(),
  })
  const requestBody = await req.json()
  const result = reqSchema.safeParse(requestBody)
  if (!result.success) {
    return NextResponse.json({ error: 'Invalid request body' }, { status: 400 })
  }

  const { fingerprintId } = result.data

  try {
    const expiresAt = Date.now() + 60 * 60 * 1000 // 1 hour
    const fingerprintHash = genAuthCode(
      fingerprintId,
      expiresAt.toString(),
      env.NEXTAUTH_SECRET,
    )

    // Check if this fingerprint has any active sessions
    const existingSession = await db
      .select({
        userId: schema.session.userId,
        expires: schema.session.expires,
      })
      .from(schema.session)
      .where(
        and(
          eq(schema.session.fingerprint_id, fingerprintId),
          gt(schema.session.expires, new Date()),
        ),
      )
      .limit(1)

    if (existingSession.length > 0) {
      // There's an active session - log this for monitoring
      logger.info(
        {
          fingerprintId,
          existingUserId: existingSession[0].userId,
          event: 'relogin_attempt_with_active_session',
        },
        'Login attempt for fingerprint with active session',
      )
    }

    const authCode = buildCliAuthCode(
      fingerprintId,
      expiresAt.toString(),
      fingerprintHash,
    )
    const loginToken = randomBytes(32).toString('base64url')

    await db.insert(schema.verificationToken).values({
      identifier: getCliAuthCodeTokenIdentifier(loginToken),
      token: authCode,
      expires: new Date(expiresAt),