|
| 1 | +import { formSchema } from "@/app/sensitive-info/schema"; |
| 2 | +import arcjet, { sensitiveInfo, shield } from "@/lib/arcjet"; |
| 3 | +import { NextRequest, NextResponse } from "next/server"; |
| 4 | + |
| 5 | +// Add rules to the base Arcjet instance outside of the handler function |
| 6 | +const aj = arcjet |
| 7 | + .withRule( |
| 8 | + // Arcjet's protectSignup rule is a combination of email validation, bot |
| 9 | + // protection and rate limiting. Each of these can also be used separately |
| 10 | + // on other routes e.g. rate limiting on a login route. See |
| 11 | + // https://docs.arcjet.com/get-started |
| 12 | + sensitiveInfo({ |
| 13 | + mode: "LIVE", // Will block requests, use "DRY_RUN" to log only |
| 14 | + deny: ["CREDIT_CARD_NUMBER", "EMAIL"], // Deny requests with credit card numbers |
| 15 | + }), |
| 16 | + ) |
| 17 | + // You can chain multiple rules, so we'll include shield |
| 18 | + .withRule( |
| 19 | + // Shield detects suspicious behavior, such as SQL injection and cross-site |
| 20 | + // scripting attacks. |
| 21 | + shield({ |
| 22 | + mode: "LIVE", |
| 23 | + }), |
| 24 | + ); |
| 25 | + |
| 26 | +export async function POST(req: NextRequest) { |
| 27 | + const fingerprint = req.ip!; |
| 28 | + const decision = await aj.protect(req, { fingerprint }); |
| 29 | + |
| 30 | + console.log("Arcjet decision: ", decision); |
| 31 | + |
| 32 | + if (decision.isDenied()) { |
| 33 | + if (decision.reason.isSensitiveInfo()) { |
| 34 | + const message = |
| 35 | + "please do not include credit card numbers in your message."; |
| 36 | + |
| 37 | + return NextResponse.json( |
| 38 | + { message, reason: decision.reason }, |
| 39 | + { status: 400 }, |
| 40 | + ); |
| 41 | + } else { |
| 42 | + return NextResponse.json({ message: "Forbidden" }, { status: 403 }); |
| 43 | + } |
| 44 | + } else if (decision.isErrored()) { |
| 45 | + console.error("Arcjet error:", decision.reason); |
| 46 | + if (decision.reason.message == "[unauthenticated] invalid key") { |
| 47 | + return NextResponse.json( |
| 48 | + { |
| 49 | + message: |
| 50 | + "invalid Arcjet key. Is the ARCJET_KEY environment variable set?", |
| 51 | + }, |
| 52 | + { status: 500 }, |
| 53 | + ); |
| 54 | + } else { |
| 55 | + return NextResponse.json( |
| 56 | + { message: "Internal server error: " + decision.reason.message }, |
| 57 | + { status: 500 }, |
| 58 | + ); |
| 59 | + } |
| 60 | + } |
| 61 | + |
| 62 | + const json = await req.json(); |
| 63 | + const data = formSchema.safeParse(json); |
| 64 | + |
| 65 | + if (!data.success) { |
| 66 | + const { error } = data; |
| 67 | + |
| 68 | + return NextResponse.json( |
| 69 | + { message: "invalid request", error }, |
| 70 | + { status: 400 }, |
| 71 | + ); |
| 72 | + } |
| 73 | + |
| 74 | + return NextResponse.json({ |
| 75 | + ok: true, |
| 76 | + }); |
| 77 | +} |
0 commit comments