39 lines
1.2 KiB
TypeScript
39 lines
1.2 KiB
TypeScript
import { generateFileToken } from '~~/server/utils/file-token';
|
|
|
|
const FILE_PREFIX = '/api/files/';
|
|
|
|
// Uploaded avatars are served to signed in people only, and whoever opens an
|
|
// invite is not signed in yet. A short-lived signed URL lets them see it.
|
|
const publicImage = (image: string | null): string | null => {
|
|
const secret = process.env.BETTER_AUTH_SECRET;
|
|
|
|
if (!image || !image.startsWith(FILE_PREFIX) || !secret) return image;
|
|
|
|
const { exp, sig } = generateFileToken(image.slice(FILE_PREFIX.length), secret);
|
|
|
|
return `${image}?exp=${exp}&sig=${sig}`;
|
|
};
|
|
|
|
/**
|
|
* Tells the register page whether an invite link still works and who it is
|
|
* from. Public on purpose, the person opening the link has no account yet.
|
|
*/
|
|
export default defineEventHandler(async (event) => {
|
|
const invite = await findUsableInvite(getRouterParam(event, 'token')!);
|
|
|
|
if (!invite) {
|
|
return { valid: false as const };
|
|
}
|
|
|
|
return {
|
|
valid: true as const,
|
|
expiresAt: invite.expiresAt,
|
|
singleUse: invite.maxUses === 1,
|
|
inviter: {
|
|
id: invite.inviterId,
|
|
name: invite.inviterName,
|
|
image: publicImage(invite.inviterImage),
|
|
},
|
|
};
|
|
});
|