Cambio de email con doble confirmación (completa el bloque de auth)

- lib/change-email.ts: requestEmailChange (valida pass/email/token, crea activación con old_email/old_email_hash, email al correo actual), confirmOldEmail (marca is_used, email al nuevo), confirmNewEmail (re-deriva verifier con el nuevo email + actualiza battlenet_accounts y account; borra la activación). - components/ConfirmClient.tsx: cliente genérico que confirma un hash por POST al abrir. - Routes /api/account/change-email, /confirm-old-email, /confirm-new-email. - Páginas /change-email (protegida) y /confirm-old-email, /confirm-new-email (auto). - Catálogos ChangeEmail, ConfirmOldEmail, ConfirmNewEmail. Verificado: change-email protegida (401/redirect), confirmaciones con hash inválido -> invalidLink sin crash. AUTH 100% reimplementado en Next.js. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 23:41:42 +00:00
parent 1da7349373
commit cceab26999
11 changed files with 390 additions and 0 deletions
@@ -0,0 +1,61 @@
+'use client'
+
+import { useState } from 'react'
+import { useTranslations } from 'next-intl'
+
+const ERROR_KEYS = ['missingFields', 'wrongCurrentEmail', 'invalidEmail', 'invalidToken', 'wrongCurrentPassword'] as const
+
+export function ChangeEmailForm() {
+  const t = useTranslations('ChangeEmail')
+  const [form, setForm] = useState({ currentPassword: '', currentEmail: '', newEmail: '', confEmail: '', token: '' })
+  const [busy, setBusy] = useState(false)
+  const [message, setMessage] = useState<{ ok: boolean; text: string } | null>(null)
+
+  function upd(k: string, v: string) {
+    setForm((f) => ({ ...f, [k]: v }))
+  }
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault()
+    if (busy) return
+    setBusy(true)
+    setMessage(null)
+    try {
+      const res = await fetch('/api/account/change-email', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        credentials: 'same-origin',
+        body: JSON.stringify(form),
+      })
+      const data: { success?: boolean; error?: string } = await res.json()
+      if (data.success) setMessage({ ok: true, text: t('success') })
+      else {
+        const key = (ERROR_KEYS as readonly string[]).includes(data.error ?? '') ? data.error! : 'genericError'
+        setMessage({ ok: false, text: t(key) })
+      }
+    } catch {
+      setMessage({ ok: false, text: t('genericError') })
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  const field = 'w-full rounded border border-amber-900/60 bg-[#2c1e14] px-3 py-2'
+
+  return (
+    <div className="mx-auto max-w-sm">
+      <p className="mb-4 text-sm text-amber-200/70">{t('info')}</p>
+      <form onSubmit={handleSubmit} className="space-y-3">
+        <input type="password" maxLength={16} placeholder={t('currentPassword')} value={form.currentPassword} onChange={(e) => upd('currentPassword', e.target.value)} className={field} />
+        <input type="email" placeholder={t('currentEmail')} value={form.currentEmail} onChange={(e) => upd('currentEmail', e.target.value)} className={field} />
+        <input type="email" placeholder={t('newEmail')} value={form.newEmail} onChange={(e) => upd('newEmail', e.target.value)} className={field} />
+        <input type="email" placeholder={t('confEmail')} value={form.confEmail} onChange={(e) => upd('confEmail', e.target.value)} className={field} />
+        <input type="text" maxLength={6} placeholder={t('token')} value={form.token} onChange={(e) => upd('token', e.target.value)} className={field} />
+        <button type="submit" disabled={busy} className="w-full rounded bg-amber-600 px-4 py-2 font-semibold text-[#1b120b] disabled:opacity-60">
+          {busy ? t('sending') : t('submit')}
+        </button>
+      </form>
+      {message && <p className={`mt-3 text-center ${message.ok ? 'text-green-400' : 'text-red-400'}`}>{message.text}</p>}
+    </div>
+  )
+}
@@ -0,0 +1,21 @@
+import { getTranslations, setRequestLocale } from 'next-intl/server'
+import { redirect } from '@/i18n/navigation'
+import { getSession } from '@/lib/session'
+import { ChangeEmailForm } from './ChangeEmailForm'
+
+export const dynamic = 'force-dynamic'
+
+export default async function ChangeEmailPage({ params }: { params: Promise<{ locale: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  const t = await getTranslations('ChangeEmail')
+  const session = await getSession()
+  if (!session.bnetId) redirect({ href: '/login', locale })
+  if (!session.username) redirect({ href: '/select-account', locale })
+  return (
+    <main className="mx-auto max-w-3xl px-4 py-8">
+      <h1 className="mb-6 text-center text-2xl font-bold text-amber-500">{t('title')}</h1>
+      <ChangeEmailForm />
+    </main>
+  )
+}
@@ -0,0 +1,15 @@
+import { getTranslations, setRequestLocale } from 'next-intl/server'
+import { ConfirmClient } from '@/components/ConfirmClient'
+
+export default async function Page({ params, searchParams }: { params: Promise<{ locale: string }>; searchParams: Promise<{ hash?: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  const { hash } = await searchParams
+  const t = await getTranslations('ConfirmNewEmail')
+  return (
+    <main className="mx-auto max-w-lg px-4 py-12">
+      <h1 className="mb-6 text-center text-2xl font-bold text-amber-500">{t('title')}</h1>
+      <ConfirmClient hash={hash ?? ''} endpoint="/api/account/confirm-new-email" namespace="ConfirmNewEmail" showLogin />
+    </main>
+  )
+}
@@ -0,0 +1,15 @@
+import { getTranslations, setRequestLocale } from 'next-intl/server'
+import { ConfirmClient } from '@/components/ConfirmClient'
+
+export default async function Page({ params, searchParams }: { params: Promise<{ locale: string }>; searchParams: Promise<{ hash?: string }> }) {
+  const { locale } = await params
+  setRequestLocale(locale)
+  const { hash } = await searchParams
+  const t = await getTranslations('ConfirmOldEmail')
+  return (
+    <main className="mx-auto max-w-lg px-4 py-12">
+      <h1 className="mb-6 text-center text-2xl font-bold text-amber-500">{t('title')}</h1>
+      <ConfirmClient hash={hash ?? ''} endpoint="/api/account/confirm-old-email" namespace="ConfirmOldEmail" />
+    </main>
+  )
+}
@@ -0,0 +1,23 @@
+import { getSession } from '@/lib/session'
+import { requestEmailChange } from '@/lib/change-email'
+
+export async function POST(request: Request) {
+  const session = await getSession()
+  if (!session.accountId) return Response.json({ success: false, error: 'notAuthenticated' }, { status: 401 })
+  let b: Record<string, string> = {}
+  try {
+    b = await request.json()
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+  return Response.json(
+    await requestEmailChange(
+      session,
+      String(b.currentPassword ?? ''),
+      String(b.currentEmail ?? ''),
+      String(b.newEmail ?? ''),
+      String(b.confEmail ?? ''),
+      String(b.token ?? ''),
+    ),
+  )
+}
@@ -0,0 +1,13 @@
+import { confirmNewEmail } from '@/lib/change-email'
+
+export async function POST(request: Request) {
+  let hash = ''
+  try {
+    const b = await request.json()
+    hash = String(b.hash ?? '')
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+  if (!hash) return Response.json({ success: false, error: 'invalidLink' })
+  return Response.json(await confirmNewEmail(hash))
+}
@@ -0,0 +1,13 @@
+import { confirmOldEmail } from '@/lib/change-email'
+
+export async function POST(request: Request) {
+  let hash = ''
+  try {
+    const b = await request.json()
+    hash = String(b.hash ?? '')
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+  if (!hash) return Response.json({ success: false, error: 'invalidLink' })
+  return Response.json(await confirmOldEmail(hash))
+}