TikTok V5 + Security

src/app/(main)/api/auth/signup/route.ts

@@ -1,19 +1,20 @@
-import { NextRequest, NextResponse } from 'next/server';
-import bcrypt from 'bcryptjs';
-import { db } from '@/lib/db';
+import { NextRequest, NextResponse } from 'next/server';
+import bcrypt from 'bcryptjs';
+import { db } from '@/lib/db';
 import { z } from 'zod';
 import { csrfProtection } from '@/lib/csrf';
 import { rateLimit, getClientIdentifier, RateLimits } from '@/lib/rateLimit';
-import { getAuthCookieOptions } from '@/lib/cookieConfig';
-import { signupSchema, validateRequest } from '@/lib/validationSchemas';
-import { sendWelcomeEmail } from '@/lib/email';
-import { sendConversionEvent } from '@/lib/metaConversions';
-import {
-  ATTRIBUTION_COOKIE_NAME,
-  getEmailDomain,
-  parseAttributionCookie,
-} from '@/lib/revops';
-import { triggerLifecycleScoring } from '@/lib/revops-server';
+import { getAuthCookieOptions } from '@/lib/cookieConfig';
+import { signUserId } from '@/lib/session';
+import { signupSchema, validateRequest } from '@/lib/validationSchemas';
+import { sendWelcomeEmail } from '@/lib/email';
+import { sendConversionEvent } from '@/lib/metaConversions';
+import {
+  ATTRIBUTION_COOKIE_NAME,
+  getEmailDomain,
+  parseAttributionCookie,
+} from '@/lib/revops';
+import { triggerLifecycleScoring } from '@/lib/revops-server';
 
 export async function POST(request: NextRequest) {
   try {
@@ -72,29 +73,29 @@ export async function POST(request: NextRequest) {
     // Hash password
     const hashedPassword = await bcrypt.hash(password, 12);
 
-    const firstTouch = parseAttributionCookie(request.cookies.get(ATTRIBUTION_COOKIE_NAME)?.value);
-    const onboardingStartedAt = new Date();
-
-    // Create user
-    const user = await db.user.create({
-      data: {
-        name,
-        email,
-        password: hashedPassword,
-        onboardingStartedAt,
-        emailDomain: getEmailDomain(email),
-        signupSource: firstTouch?.signupSource || null,
-        signupMedium: firstTouch?.signupMedium || null,
-        signupCampaign: firstTouch?.signupCampaign || null,
-        signupContent: firstTouch?.signupContent || null,
-        signupTerm: firstTouch?.signupTerm || null,
-        signupReferrer: firstTouch?.signupReferrer || null,
-        signupLandingPath: firstTouch?.signupLandingPath || '/signup',
-        signupFirstSeenAt: firstTouch?.signupFirstSeenAt ? new Date(firstTouch.signupFirstSeenAt) : onboardingStartedAt,
-      },
-    });
-
-    triggerLifecycleScoring(user.id, 'signup');
+    const firstTouch = parseAttributionCookie(request.cookies.get(ATTRIBUTION_COOKIE_NAME)?.value);
+    const onboardingStartedAt = new Date();
+
+    // Create user
+    const user = await db.user.create({
+      data: {
+        name,
+        email,
+        password: hashedPassword,
+        onboardingStartedAt,
+        emailDomain: getEmailDomain(email),
+        signupSource: firstTouch?.signupSource || null,
+        signupMedium: firstTouch?.signupMedium || null,
+        signupCampaign: firstTouch?.signupCampaign || null,
+        signupContent: firstTouch?.signupContent || null,
+        signupTerm: firstTouch?.signupTerm || null,
+        signupReferrer: firstTouch?.signupReferrer || null,
+        signupLandingPath: firstTouch?.signupLandingPath || '/signup',
+        signupFirstSeenAt: firstTouch?.signupFirstSeenAt ? new Date(firstTouch.signupFirstSeenAt) : onboardingStartedAt,
+      },
+    });
+
+    triggerLifecycleScoring(user.id, 'signup');
 
     // Send welcome email (fire-and-forget — never block signup)
     try {
@@ -117,22 +118,22 @@ export async function POST(request: NextRequest) {
     }).catch(console.error);
 
     // Create response
-    const response = NextResponse.json({
-      success: true,
-      needsOnboarding: true,
-      user: {
-        id: user.id,
-        name: user.name,
-        email: user.email,
-        plan: 'FREE',
+    const response = NextResponse.json({
+      success: true,
+      needsOnboarding: true,
+      user: {
+        id: user.id,
+        name: user.name,
+        email: user.email,
+        plan: 'FREE',
       },
     });
-
-    // Set cookie for auto-login after signup
-    response.cookies.set('userId', user.id, getAuthCookieOptions());
-    response.cookies.delete(ATTRIBUTION_COOKIE_NAME);
-
-    return response;
+
+    // Set cookie for auto-login after signup
+    response.cookies.set('userId', signUserId(user.id), getAuthCookieOptions());
+    response.cookies.delete(ATTRIBUTION_COOKIE_NAME);
+
+    return response;
   } catch (error) {
     if (error instanceof z.ZodError) {
       return NextResponse.json(
@@ -147,4 +148,4 @@ export async function POST(request: NextRequest) {
       { status: 500 }
     );
   }
-}
+}