diff --git a/packages/trpc/server/routers/viewer/auth/_router.tsx b/packages/trpc/server/routers/viewer/auth/_router.tsx index b82b797d3c..d69b9ab0e4 100644 --- a/packages/trpc/server/routers/viewer/auth/_router.tsx +++ b/packages/trpc/server/routers/viewer/auth/_router.tsx @@ -71,7 +71,7 @@ export const authRouter = router({ }); }), - sendVerifyEmailCode: publicProcedure.input(ZSendVerifyEmailCodeSchema).mutation(async ({ input }) => { + sendVerifyEmailCode: publicProcedure.input(ZSendVerifyEmailCodeSchema).mutation(async ({ input, ctx }) => { if (!UNSTABLE_HANDLER_CACHE.sendVerifyEmailCode) { UNSTABLE_HANDLER_CACHE.sendVerifyEmailCode = await import("./sendVerifyEmailCode.handler").then( (mod) => mod.sendVerifyEmailCodeHandler @@ -85,6 +85,7 @@ export const authRouter = router({ return UNSTABLE_HANDLER_CACHE.sendVerifyEmailCode({ input, + req: ctx.req, }); }), diff --git a/packages/trpc/server/routers/viewer/auth/sendVerifyEmailCode.handler.ts b/packages/trpc/server/routers/viewer/auth/sendVerifyEmailCode.handler.ts index 5960dfaf81..97f3f9c8f8 100644 --- a/packages/trpc/server/routers/viewer/auth/sendVerifyEmailCode.handler.ts +++ b/packages/trpc/server/routers/viewer/auth/sendVerifyEmailCode.handler.ts @@ -1,12 +1,25 @@ -import { sendEmailVerificationByCode } from "@calcom/features/auth/lib/verifyEmail"; +import type { NextApiRequest } from "next"; +import { sendEmailVerificationByCode } from "@calcom/features/auth/lib/verifyEmail"; +import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError"; +import getIP from "@calcom/lib/getIP"; + +import type { TRPCContext } from "../../../createContext"; import type { TSendVerifyEmailCodeSchema } from "./sendVerifyEmailCode.schema"; type SendVerifyEmailCode = { input: TSendVerifyEmailCodeSchema; + req: TRPCContext["req"] | undefined; }; -export const sendVerifyEmailCodeHandler = async ({ input }: SendVerifyEmailCode) => { +export const sendVerifyEmailCodeHandler = async ({ input, req }: SendVerifyEmailCode) => { + const identifer = req ? getIP(req as NextApiRequest) : input.email; + + await checkRateLimitAndThrowError({ + rateLimitingType: "core", + identifier: `emailVerifyByCode.${identifer}`, + }); + const email = await sendEmailVerificationByCode({ email: input.email, username: input.username,