qrcode route: get application from user model

Author: tomasohCHOM

src/app/(site)/portal/_components/user-portal.tsx

@@ -92,7 +92,7 @@ export default function UserPortal({ user }: UserProps) {
         <div className="grid gap-2">
           <p className="text-center">Food QR Code:</p>
           <img
-            src={`/api/qrcode?email=${encodeURIComponent(user.email)}`}
+            src="/api/qrcode"
             alt="User QR Code"
             className="aspect-square w-64"
           />

src/app/api/qrcode/route.ts

@@ -9,29 +9,24 @@ export async function GET(req: NextRequest) {
   if (!session || !session.user?.email) {
     return new NextResponse("Unauthorized", { status: 401 });
   }
-  const userEmail = session.user.email;
-  const emailParam = req.nextUrl.searchParams.get("email");
-
-  if (userEmail !== emailParam) {
-    return new NextResponse("Forbidden", { status: 403 });
-  }
 
-  const application = await prisma.application.findFirst({
+  const userEmail = session.user.email;
+  const user = await prisma.user.findUnique({
     where: { email: userEmail },
-    select: { approved: true }
+    include: { application: true }
   });
-  if (!application?.approved) {
-    return new NextResponse("Application was not approved", { status: 403 });
+  if (!user || !user.application || !user.application.approved) {
+    return new NextResponse("Forbidden", { status: 403 });
   }
 
+  const email = user.application.email;
+  if (!email) {
+    return new NextResponse("Missing email", { status: 400 });
+  }
   const token = process.env.QRCODE_TOKEN;
   if (!token) {
     return new NextResponse("Token not present", { status: 400 });
   }
-  const email = req.nextUrl.searchParams.get("email");
-  if (!email) {
-    return new NextResponse("Missing email", { status: 400 });
-  }
   const targetUrl = `https://fullyhacksqr.acmcsuf.com/users/${email}/qr.png`;
   const imageRes = await fetch(targetUrl, {
     headers: {