1import type { EmailOtpType } from "@supabase/supabase-js";2import { redirect } from "next/navigation";3import type { NextRequest } from "next/server";..4import { createSupabaseClient } from "@/lib/supabase";56/**7 * a public GET endpoint that is linked to by the supabase email confirmation linked

1import type { EmailOtpType } from "@supabase/supabase-js";2import { redirect } from "next/navigation";3import type { NextRequest } from "next/server";4import { createUser } from "@/lib/dal";5import { createSupabaseClient } from "@/lib/supabase";67/**8 * a public GET endpoint that is linked to by the supabase email confirmation linked

12  const token_hash = searchParams.get("token_hash");13  const type = searchParams.get("type") as EmailOtpType | null;14  const next = searchParams.get("next") ?? "/";1516  if (token_hash && type) {17    const supabase = await createSupabaseClient();1819    // this call invokes _saveSession and sets cookies20    const { error } = await supabase.auth.verifyOtp({ type, token_hash });..............2122    // redirects preserve cookies23    if (!error) {24      redirect(next);25    }26  }2728  redirect("/error");

11export async function GET(request: NextRequest) {12  const { searchParams } = new URL(request.url);13  const token_hash = searchParams.get("token_hash");1415  if (token_hash) {....16    const supabase = await createSupabaseClient();17    const { data, error } = await supabase.auth.verifyOtp({ type: "email", token_hash });1819    // redirects preserve cookies20    if (!error) {21      const username = data.user?.user_metadata?.username;2223      // TODO: technically possible user name was claimed by another user between email confirmation delays24      // should show some error and let user select another username25      if (username) {26        await createUser(username);27      }28      redirect("/onboarding");29    }30  }3132  redirect("/error");

77  }7879  const { error } = await supabase.auth.signInWithOtp({80    email,81    options: { shouldCreateUser: true },82  });8384  if (error) return { error: error.message };85  if (redirectTo) redirect(redirectTo);

80  // we don't differentiate between new and existing for security: otherwise attackers would be able to tell what81  // user exists / doesn't exist82  const { error } = await supabase.auth.signInWithOtp({83    email,84    options: { shouldCreateUser: true, data: { username } },85  });8687  if (error) return { error: error.message };88  if (redirectTo) redirect(redirectTo);