adds Vercel BotId

2026-07-13 21:52:53 +02:00 · 2025-07-16 01:00:40 +01:00
parent 5178732c4c
commit eb49500592
5 changed files with 24 additions and 1 deletions
@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db, eq } from "@opencut/db";
 import { waitlist } from "@opencut/db/schema";
+import { checkBotId } from "botid/server";
 import { nanoid } from "nanoid";
 import { waitlistRateLimit } from "@/lib/rate-limit";
 import { z } from "zod";
@@ -143,6 +144,12 @@ async function validateCSRFToken(request: NextRequest): Promise<boolean> {
 }

 export async function POST(request: NextRequest) {
+  const verification = await checkBotId();
+
+  if (verification.isBot) {
+    return NextResponse.json({ error: "Access denied" }, { status: 403 });
+  }
+
  const identifier = request.headers.get("x-forwarded-for") ?? "127.0.0.1";
  const { success } = await waitlistRateLimit.limit(identifier);

@@ -7,9 +7,17 @@ import { TooltipProvider } from "../components/ui/tooltip";
 import { StorageProvider } from "../components/storage-provider";
 import { baseMetaData } from "./metadata";
 import { defaultFont } from "../lib/font-config";
+import { BotIdClient } from "botid/client";

 export const metadata = baseMetaData;

+const protectedRoutes = [
+  {
+    path: "/api/waitlist",
+    method: "POST",
+  },
+];
+
 export default function RootLayout({
  children,
 }: Readonly<{
@@ -17,6 +25,9 @@ export default function RootLayout({
 }>) {
  return (
    <html lang="en" suppressHydrationWarning>
+      <head>
+        <BotIdClient protect={protectedRoutes} />
+      </head>
      <body className={`${defaultFont.className} font-sans antialiased`}>
        <ThemeProvider attribute="class" forcedTheme="dark">
          <TooltipProvider>