feat: complete i18n support, telegram webhook, and security improvements

lib/mail-session.ts

@@ -1,16 +1,12 @@
-/**
- * lib/mail-session.ts
- * Stores/retrieves mail credentials in an encrypted httpOnly cookie.
- * Credentials never hit the database.
- */
-
 import { cookies } from "next/headers";
+import { auth } from "@/auth";
 
 const COOKIE_NAME = "ayrismail_creds";
 
 export interface MailSessionData {
   email: string;
   password: string;
+  ownerId: string; // Dashboard user ID who owns this mail session
 }
 
 /**
@@ -30,9 +26,19 @@ function decode(token: string): MailSessionData | null {
 }
 
 /** Save mail credentials to cookie */
-export async function setMailSession(data: MailSessionData): Promise<void> {
+export async function setMailSession(data: Omit<MailSessionData, "ownerId">): Promise<void> {
+  const session = await auth();
+  if (!session?.user?.id) {
+    throw new Error("Cannot set mail session without dashboard session");
+  }
+
   const cookieStore = await cookies();
-  cookieStore.set(COOKIE_NAME, encode(data), {
+  const sessionData: MailSessionData = {
+    ...data,
+    ownerId: session.user.id,
+  };
+
+  cookieStore.set(COOKIE_NAME, encode(sessionData), {
     httpOnly: true,
     secure: process.env.NODE_ENV === "production",
     sameSite: "lax",
@@ -43,10 +49,24 @@ export async function setMailSession(data: MailSessionData): Promise<void> {
 
 /** Get mail credentials from cookie */
 export async function getMailSession(): Promise<MailSessionData | null> {
+  const session = await auth();
+  if (!session?.user?.id) return null;
+
   const cookieStore = await cookies();
   const cookie = cookieStore.get(COOKIE_NAME);
   if (!cookie?.value) return null;
-  return decode(cookie.value);
+
+  const data = decode(cookie.value);
+  if (!data) return null;
+
+  // Verify that this mail session belongs to the current dashboard user
+  if (data.ownerId !== session.user.id) {
+    // Session belongs to another user, clear it for safety
+    await clearMailSession();
+    return null;
+  }
+
+  return data;
 }
 
 /** Clear mail credentials cookie */