Add rate limiting, sliding sessions, email verification, GDPR self-service, order cancellation/returns, and critical-error alerting

Complements Payload's per-account login lockout with per-IP rate limiting
on auth routes; proxy.ts silently refreshes an active customer's session
via Payload's built-in refresh-token endpoint instead of a long-lived
token. Registration now sends a non-blocking email-verification link
(doesn't gate login, since checkout registers and immediately logs in
mid-purchase). /konto/profil gets GDPR export/delete; order detail pages
get self-service cancel/return-request, backed by a Payload hook that
closes a real gap (a customer's JWT could previously PATCH any field of
their own order, not just status). Checkout failures now email an alert
independent of Payload's own health, since Kuma's uptime checks can't see
an order silently failing to persist.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/api/account/delete/route.ts

@@ -0,0 +1,25 @@
+import { NextResponse } from "next/server";
+import { deleteCustomerAccount, getSessionCustomer, loginCustomer, clearSessionCookie } from "../../../lib/customerAuth";
+
+// GDPR self-service deletion. Password re-verified here (not just trusting
+// the active session) before anything is deleted — same reasoning as
+// changeCustomerPassword. See customerAuth.ts's deleteCustomerAccount for
+// what actually survives (past orders, anonymized-by-omission — their own
+// snapshot fields aren't touched, only the account/login disappears).
+export async function POST(request: Request) {
+  const session = await getSessionCustomer();
+  if (!session) return NextResponse.json({ ok: false, reason: "Bitte zuerst einloggen." }, { status: 401 });
+
+  const body = await request.json().catch(() => null);
+  const password = typeof body?.password === "string" ? body.password : "";
+  if (!password) return NextResponse.json({ ok: false, reason: "Bitte dein Passwort zur Bestätigung eingeben." }, { status: 400 });
+
+  const verify = await loginCustomer({ email: session.customer.email, password });
+  if (!verify.ok) return NextResponse.json({ ok: false, reason: "Passwort ist falsch." }, { status: 400 });
+
+  const deleted = await deleteCustomerAccount(verify.token, session.customer.id);
+  if (!deleted) return NextResponse.json({ ok: false, reason: "Konto konnte nicht gelöscht werden." }, { status: 500 });
+
+  await clearSessionCookie();
+  return NextResponse.json({ ok: true });
+}

app/api/account/export/route.ts

@@ -0,0 +1,30 @@
+import { NextResponse } from "next/server";
+import { getSessionCustomer, getCustomerProfile, getCustomerOrders, getCustomerOrderDetail } from "../../../lib/customerAuth";
+
+// GDPR data portability (Art. 20) — a full, structured, machine-readable
+// export of everything tied to the account: profile + every order's full
+// detail (not just the summary list, so this is a genuinely complete
+// export, not a teaser).
+export async function GET() {
+  const session = await getSessionCustomer();
+  if (!session) return NextResponse.json({ ok: false, reason: "Bitte zuerst einloggen." }, { status: 401 });
+
+  const profile = await getCustomerProfile(session.token);
+  const orderSummaries = await getCustomerOrders(session.token, session.customer.id);
+  const orders = await Promise.all(
+    orderSummaries.map((o) => getCustomerOrderDetail(session.token, session.customer.id, o.orderNumber)),
+  );
+
+  const payload = {
+    exportedAt: new Date().toISOString(),
+    profile,
+    orders: orders.filter(Boolean),
+  };
+
+  return new NextResponse(JSON.stringify(payload, null, 2), {
+    headers: {
+      "Content-Type": "application/json",
+      "Content-Disposition": 'attachment; filename="meine-daten.json"',
+    },
+  });
+}

app/api/account/login/route.ts

@@ -1,7 +1,16 @@
 import { NextResponse } from "next/server";
 import { loginCustomer, setSessionCookie } from "../../../lib/customerAuth";
+import { checkRateLimit, getClientIp } from "../../../lib/rateLimit";
 
 export async function POST(request: Request) {
+  // Complements Payload's own per-account lockout (5 attempts / 10min,
+  // see Customers.ts in the Payload repo) with a per-IP layer — that one
+  // alone doesn't stop someone spraying single attempts across many
+  // different email addresses from the same IP.
+  if (!checkRateLimit(`login:${getClientIp(request)}`, { limit: 10, windowMs: 15 * 60 * 1000 })) {
+    return NextResponse.json({ ok: false, reason: "Zu viele Versuche. Bitte in ein paar Minuten erneut probieren." }, { status: 429 });
+  }
+
   const body = await request.json().catch(() => null);
   const email = typeof body?.email === "string" ? body.email : "";
   const password = typeof body?.password === "string" ? body.password : "";

app/api/account/orders/[orderNumber]/route.ts

@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server";
+import {
+  getSessionCustomer,
+  getCustomerOrderDetail,
+  requestOrderStatusChange,
+  customerOrderAction,
+} from "../../../../lib/customerAuth";
+
+// The real security boundary is Orders.ts's beforeChange hook in Payload
+// (only `status` can change, only via an allowed transition) — the check
+// against customerOrderAction() here is just for a friendlier error
+// message than a bare 403 when the button's already stale (e.g. two tabs
+// open, order shipped in the meantime).
+export async function PATCH(request: Request, { params }: { params: Promise<{ orderNumber: string }> }) {
+  const session = await getSessionCustomer();
+  if (!session) return NextResponse.json({ ok: false, reason: "Bitte zuerst einloggen." }, { status: 401 });
+
+  const { orderNumber } = await params;
+  const body = await request.json().catch(() => null);
+  const action = body?.action;
+  if (action !== "cancel" && action !== "request-return") {
+    return NextResponse.json({ ok: false, reason: "Ungültige Aktion." }, { status: 400 });
+  }
+
+  const order = await getCustomerOrderDetail(session.token, session.customer.id, decodeURIComponent(orderNumber));
+  if (!order) return NextResponse.json({ ok: false, reason: "Bestellung nicht gefunden." }, { status: 404 });
+  if (customerOrderAction(order.status) !== action) {
+    return NextResponse.json({ ok: false, reason: "Diese Aktion ist für diese Bestellung gerade nicht möglich." }, { status: 400 });
+  }
+
+  const result = await requestOrderStatusChange(session.token, order.id, action);
+  return NextResponse.json(result, { status: result.ok ? 200 : 400 });
+}

app/api/account/password/route.ts

@@ -1,7 +1,12 @@
 import { NextResponse } from "next/server";
 import { changeCustomerPassword, getSessionCustomer } from "../../../lib/customerAuth";
+import { checkRateLimit, getClientIp } from "../../../lib/rateLimit";
 
 export async function POST(request: Request) {
+  if (!checkRateLimit(`password:${getClientIp(request)}`, { limit: 5, windowMs: 15 * 60 * 1000 })) {
+    return NextResponse.json({ ok: false, reason: "Zu viele Versuche. Bitte in ein paar Minuten erneut probieren." }, { status: 429 });
+  }
+
   const session = await getSessionCustomer();
   if (!session) return NextResponse.json({ ok: false, reason: "Bitte zuerst einloggen." }, { status: 401 });
 

app/api/account/register/route.ts

@@ -1,7 +1,12 @@
 import { NextResponse } from "next/server";
 import { registerCustomer, setSessionCookie } from "../../../lib/customerAuth";
+import { checkRateLimit, getClientIp } from "../../../lib/rateLimit";
 
 export async function POST(request: Request) {
+  if (!checkRateLimit(`register:${getClientIp(request)}`, { limit: 5, windowMs: 15 * 60 * 1000 })) {
+    return NextResponse.json({ ok: false, reason: "Zu viele Versuche. Bitte in ein paar Minuten erneut probieren." }, { status: 429 });
+  }
+
   const body = await request.json().catch(() => null);
   const { firstName, lastName, email, password } = body ?? {};
   if (

app/api/account/resend-verification/route.ts

@@ -0,0 +1,16 @@
+import { NextResponse } from "next/server";
+import { getSessionCustomer, resendVerificationEmail } from "../../../lib/customerAuth";
+import { checkRateLimit, getClientIp } from "../../../lib/rateLimit";
+
+export async function POST(request: Request) {
+  if (!checkRateLimit(`resend-verification:${getClientIp(request)}`, { limit: 3, windowMs: 15 * 60 * 1000 })) {
+    return NextResponse.json({ ok: false, reason: "Zu viele Versuche. Bitte in ein paar Minuten erneut probieren." }, { status: 429 });
+  }
+
+  const session = await getSessionCustomer();
+  if (!session) return NextResponse.json({ ok: false, reason: "Bitte zuerst einloggen." }, { status: 401 });
+  if (session.customer.emailVerified) return NextResponse.json({ ok: true });
+
+  const ok = await resendVerificationEmail(session);
+  return NextResponse.json({ ok }, { status: ok ? 200 : 500 });
+}

app/api/account/verify-email/route.ts

@@ -0,0 +1,15 @@
+import { NextRequest, NextResponse } from "next/server";
+import { verifyEmailByToken } from "../../../lib/customerAuth";
+
+// Entered from the link in the verification email — no session exists
+// yet at this point. See Customers.ts's own comment on why this is a
+// non-blocking flag (login already works before this is ever clicked).
+export async function GET(request: NextRequest) {
+  const token = request.nextUrl.searchParams.get("token");
+  if (!token) return new Response("Ungültiger Link.", { status: 400 });
+
+  const ok = await verifyEmailByToken(token);
+  const url = new URL("/konto/profil", request.url);
+  url.searchParams.set("verified", ok ? "1" : "0");
+  return NextResponse.redirect(url);
+}

app/api/checkout/route.ts

@@ -5,6 +5,7 @@ import { validateDiscountCode, redeemDiscountCode } from "../../lib/discountServ
 import { createOrder } from "../../lib/orderServer";
 import { getSessionCustomer, registerCustomer, setSessionCookie, type CustomerSummary } from "../../lib/customerAuth";
 import { fetchProductsBySlug } from "../../lib/productsServer";
+import { sendCriticalAlert } from "../../lib/alertAdmin";
 
 type CheckoutBody = {
   cart: CartItem[];
@@ -137,7 +138,21 @@ export async function POST(request: Request) {
     discountAmount,
     total,
   });
-  if (!order) return NextResponse.json({ ok: false, reason: "Bestellung konnte nicht gespeichert werden." }, { status: 500 });
+  if (!order) {
+    // The worst-case failure in this whole flow: the customer went
+    // through checkout believing they bought something, and nothing was
+    // persisted. Kuma's uptime checks can't see this (the site is up,
+    // this route just returned a 500) — this is the one alert path that
+    // can.
+    sendCriticalAlert("Bestellung konnte nicht gespeichert werden", {
+      customerId: customer.id,
+      customerEmail: body.email,
+      cart: body.cart,
+      total,
+      timestamp: new Date().toISOString(),
+    });
+    return NextResponse.json({ ok: false, reason: "Bestellung konnte nicht gespeichert werden." }, { status: 500 });
+  }
 
   return NextResponse.json({
     ok: true,

app/api/health/route.ts

@@ -0,0 +1,21 @@
+import { NextResponse } from "next/server";
+
+const PAYLOAD_URL = process.env.PAYLOAD_URL || "https://payload.mk360.de";
+
+// Deliberately checks Payload connectivity, not just "did this route
+// handler run" — the site can return 200s from every static/ISR page
+// while Payload itself is unreachable (stale cached content masks it for
+// a while). Meant for a Kuma HTTP monitor, added to the existing "Content
+// & API" group alongside the direct Payload monitors (see ~/dev/README.md).
+export async function GET() {
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 3000);
+    const res = await fetch(`${PAYLOAD_URL}/api/posts?limit=1`, { signal: controller.signal, cache: "no-store" });
+    clearTimeout(timeout);
+    if (!res.ok) return NextResponse.json({ ok: false, payload: false }, { status: 503 });
+    return NextResponse.json({ ok: true });
+  } catch {
+    return NextResponse.json({ ok: false, payload: false }, { status: 503 });
+  }
+}

app/konto/bestellungen/[orderNumber]/components/OrderActionButton.tsx

@@ -0,0 +1,53 @@
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+
+const LABEL = { cancel: "Bestellung stornieren", "request-return": "Rücksendung anfragen" } as const;
+const CONFIRM = {
+  cancel: "Bestellung wirklich stornieren?",
+  "request-return": "Rücksendung wirklich anfragen? Wir melden uns mit den nächsten Schritten.",
+} as const;
+
+export function OrderActionButton({ orderNumber, action }: { orderNumber: string; action: "cancel" | "request-return" }) {
+  const router = useRouter();
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  async function handleClick() {
+    if (!window.confirm(CONFIRM[action])) return;
+    setLoading(true);
+    setError(null);
+    try {
+      const res = await fetch(`/api/account/orders/${encodeURIComponent(orderNumber)}`, {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ action }),
+      });
+      const data = await res.json();
+      if (!data.ok) {
+        setError(data.reason || "Aktion war nicht möglich.");
+        setLoading(false);
+        return;
+      }
+      router.refresh();
+    } catch {
+      setError("Aktion war gerade nicht möglich.");
+      setLoading(false);
+    }
+  }
+
+  return (
+    <div className="flex flex-col gap-2 items-start">
+      <button
+        type="button"
+        onClick={handleClick}
+        disabled={loading}
+        className={`px-5 py-3 rounded-sm border border-border hover:border-brand font-bold text-body-sm text-text-primary transition-colors ${loading ? "opacity-70 pointer-events-none" : ""}`}
+      >
+        {loading ? "…" : LABEL[action]}
+      </button>
+      {error && <p className="text-label text-red-600">{error}</p>}
+    </div>
+  );
+}

app/konto/bestellungen/[orderNumber]/page.tsx

@@ -4,7 +4,8 @@ import Link from "next/link";
 import { Reveal } from "../../../components/Reveal";
 import { Footer } from "../../../components/Footer";
 import { formatPrice, formatDate } from "../../../lib/format";
-import { getSessionCustomer, getCustomerOrderDetail, ORDER_STATUS_LABEL } from "../../../lib/customerAuth";
+import { getSessionCustomer, getCustomerOrderDetail, ORDER_STATUS_LABEL, customerOrderAction } from "../../../lib/customerAuth";
+import { OrderActionButton } from "./components/OrderActionButton";
 
 export const metadata: Metadata = {
   title: "Bestelldetails",
@@ -23,6 +24,7 @@ export default async function KontoBestellungDetailPage({ params }: { params: Pr
     order.deliveryMethod === "address"
       ? order.street
       : `Packstation ${order.packstationNumber} · Postnummer ${order.postNumber}`;
+  const action = customerOrderAction(order.status);
 
   return (
     <>
@@ -104,6 +106,8 @@ export default async function KontoBestellungDetailPage({ params }: { params: Pr
               <span className="font-bold text-h-small text-text-primary">{formatPrice(order.total)}</span>
             </div>
           </div>
+
+          {action && <OrderActionButton orderNumber={order.orderNumber} action={action} />}
         </Reveal>
       </main>
       <Footer />

app/konto/profil/components/AccountDataSection.tsx

@@ -0,0 +1,93 @@
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import { Reveal } from "../../../components/Reveal";
+
+const inputClass =
+  "w-full border border-border rounded-sm px-4 py-3 text-body-sm text-text-primary outline-none focus:border-brand transition-colors";
+
+export function AccountDataSection() {
+  const router = useRouter();
+  const [confirming, setConfirming] = useState(false);
+  const [password, setPassword] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [deleting, setDeleting] = useState(false);
+
+  async function handleDelete(e: React.FormEvent<HTMLFormElement>) {
+    e.preventDefault();
+    setDeleting(true);
+    setError(null);
+    try {
+      const res = await fetch("/api/account/delete", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ password }),
+      });
+      const data = await res.json();
+      if (!data.ok) {
+        setError(data.reason || "Konto konnte nicht gelöscht werden.");
+        setDeleting(false);
+        return;
+      }
+      router.push("/");
+      router.refresh();
+    } catch {
+      setError("Konto konnte gerade nicht gelöscht werden.");
+      setDeleting(false);
+    }
+  }
+
+  return (
+    <Reveal className="flex flex-col gap-4 items-start w-full pt-4 border-t border-border">
+      <p className="font-semibold text-h-small text-text-primary" style={{ fontFamily: "var(--font-lora)" }}>
+        Konto &amp; Daten
+      </p>
+
+      <a href="/api/account/export" className="underline text-body-sm text-text-primary hover:text-brand transition-colors">
+        Meine Daten exportieren
+      </a>
+
+      {!confirming ? (
+        <button
+          type="button"
+          onClick={() => setConfirming(true)}
+          className="text-body-sm text-red-600 underline hover:text-red-700 transition-colors"
+        >
+          Konto löschen
+        </button>
+      ) : (
+        <form onSubmit={handleDelete} className="flex flex-col gap-3 items-start w-full max-w-sm">
+          <p className="text-body-sm text-text-primary">
+            Dein Konto und deine gespeicherte Adresse werden gelöscht. Bereits aufgegebene Bestellungen bleiben aus
+            steuerrechtlichen Gründen mit ihren eigenen Daten erhalten, sind danach aber keinem Konto mehr zugeordnet.
+          </p>
+          <label className="flex flex-col gap-2 items-start w-full">
+            <span className="text-label text-text-muted">Passwort zur Bestätigung</span>
+            <input
+              type="password"
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              autoComplete="current-password"
+              required
+              className={inputClass}
+            />
+          </label>
+          {error && <p className="text-label text-red-600">{error}</p>}
+          <div className="flex gap-3">
+            <button
+              type="submit"
+              disabled={deleting}
+              className={`px-5 py-3 rounded-sm bg-red-600 hover:bg-red-700 font-bold text-body-sm text-white transition-colors ${deleting ? "opacity-70 pointer-events-none" : ""}`}
+            >
+              {deleting ? "…" : "Konto endgültig löschen"}
+            </button>
+            <button type="button" onClick={() => setConfirming(false)} className="px-5 py-3 text-body-sm text-text-muted">
+              Abbrechen
+            </button>
+          </div>
+        </form>
+      )}
+    </Reveal>
+  );
+}

app/konto/profil/components/VerificationBanner.tsx

@@ -0,0 +1,54 @@
+"use client";
+
+import { useState } from "react";
+
+export function VerificationBanner({ emailVerified, justVerified }: { emailVerified: boolean; justVerified: "1" | "0" | undefined }) {
+  const [sent, setSent] = useState(false);
+  const [sending, setSending] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  if (emailVerified) {
+    // Only shown right after clicking the link — not a persistent banner
+    // once verified, that would just be noise on every future visit.
+    if (justVerified === "1") {
+      return <p className="text-label text-success w-full">E-Mail-Adresse bestätigt.</p>;
+    }
+    return null;
+  }
+
+  async function handleResend() {
+    setSending(true);
+    setError(null);
+    try {
+      const res = await fetch("/api/account/resend-verification", { method: "POST" });
+      const data = await res.json();
+      if (!data.ok) {
+        setError(data.reason || "Mail konnte nicht gesendet werden.");
+        setSending(false);
+        return;
+      }
+      setSent(true);
+      setSending(false);
+    } catch {
+      setError("Mail konnte gerade nicht gesendet werden.");
+      setSending(false);
+    }
+  }
+
+  return (
+    <div className="bg-bg-muted rounded-md p-4 flex flex-col gap-1 w-full">
+      <p className="text-body-sm text-text-primary">
+        {justVerified === "0"
+          ? "Der Bestätigungslink ist ungültig oder abgelaufen."
+          : "Bitte bestätige deine E-Mail-Adresse."}{" "}
+        {!sent && (
+          <button type="button" onClick={handleResend} disabled={sending} className="underline font-bold hover:text-brand transition-colors">
+            {sending ? "…" : "Erneut senden"}
+          </button>
+        )}
+        {sent && <span className="text-success">Mail wurde erneut gesendet.</span>}
+      </p>
+      {error && <p className="text-label text-red-600">{error}</p>}
+    </div>
+  );
+}

app/konto/profil/page.tsx

@@ -4,25 +4,35 @@ import { Footer } from "../../components/Footer";
 import { getSessionCustomer, getCustomerProfile } from "../../lib/customerAuth";
 import { ProfileForm } from "./components/ProfileForm";
 import { PasswordForm } from "./components/PasswordForm";
+import { VerificationBanner } from "./components/VerificationBanner";
+import { AccountDataSection } from "./components/AccountDataSection";
 
 export const metadata: Metadata = {
   title: "Mein Profil",
   robots: { index: false, follow: true },
 };
 
-export default async function KontoProfilPage() {
+export default async function KontoProfilPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ verified?: string }>;
+}) {
   const session = await getSessionCustomer();
   if (!session) redirect("/konto/login");
 
   const profile = await getCustomerProfile(session.token);
   if (!profile) redirect("/konto/login");
 
+  const { verified } = await searchParams;
+
   return (
     <>
       <main className="flex flex-col flex-1 bg-bg-base">
         <div className="flex flex-col gap-10 items-start pt-10 pb-16 px-[var(--layout-padding-x)] w-full max-w-[40rem] mx-auto">
+          <VerificationBanner emailVerified={profile.emailVerified} justVerified={verified === "1" || verified === "0" ? verified : undefined} />
           <ProfileForm profile={profile} />
           <PasswordForm email={profile.email} />
+          <AccountDataSection />
         </div>
       </main>
       <Footer />

app/lib/alertAdmin.ts

@@ -0,0 +1,53 @@
+import nodemailer from "nodemailer";
+
+// Server-only. Deliberately its own SMTP transport, independent of
+// Payload's (which now also sends mail — see Customers.ts's verification
+// email) — the whole point of this module is alerting when something is
+// broken, and if Payload itself is what's broken, routing the alert
+// through it could mean the alert never arrives. Same Hostinger account
+// either way (already proven working via Diun's update notifications),
+// just a second, separate connection to it.
+const transport = nodemailer.createTransport({
+  host: "smtp.hostinger.com",
+  port: 587,
+  secure: false,
+  auth: {
+    user: process.env.SMTP_USER || "",
+    pass: process.env.SMTP_PASSWORD || "",
+  },
+});
+
+// Fire-and-forget by design — callers should not await this in a way that
+// blocks or fails the actual error response the customer sees. Wrap
+// everything in its own try/catch so a broken mail relay never becomes a
+// second, worse failure on top of the one being reported.
+export function sendCriticalAlert(subject: string, details: Record<string, unknown>): void {
+  transport
+    .sendMail({
+      from: '"einfach produktiv Alerts" <admin@mk360.de>',
+      to: "admin@mk360.de",
+      subject: `[einfach produktiv] ${subject}`,
+      text: JSON.stringify(details, null, 2),
+    })
+    .catch((err) => {
+      console.error("sendCriticalAlert: failed to send alert email", err);
+    });
+}
+
+// The *initial* verification email (on registration) is sent by Payload
+// itself, via Customers.ts's own afterChange hook — that one fires
+// automatically on create and needs no separate wiring. This one is only
+// for the "erneut senden" resend path (app/api/account/resend-verification/
+// route.ts), which updates the token via the customer's own session
+// (app/lib/customerAuth.ts's resendVerificationEmail) but has no Payload
+// hook to piggyback on for a plain update, so it sends directly instead —
+// same Hostinger transport as the alert above, just a different template.
+export async function sendVerificationEmail(to: string, firstName: string, token: string): Promise<void> {
+  const url = `https://einfach-produktiv.mk360.de/api/account/verify-email?token=${token}`;
+  await transport.sendMail({
+    from: '"einfach produktiv" <admin@mk360.de>',
+    to,
+    subject: "Bitte bestätige deine E-Mail-Adresse",
+    html: `<p>Hallo ${firstName},</p><p>bitte bestätige deine E-Mail-Adresse für dein Konto bei einfach produktiv:</p><p><a href="${url}">${url}</a></p><p>Der Link ist 24 Stunden gültig.</p>`,
+  });
+}

app/lib/customerAuth.ts

@@ -1,5 +1,7 @@
 import { cookies } from "next/headers";
+import { randomUUID } from "node:crypto";
 import type { CartItem } from "./cart";
+import { sendVerificationEmail } from "./alertAdmin";
 
 // Server-only — imported by app/api/account/*/route.ts, app/api/checkout/
 // route.ts, and the /checkout and /konto/* Server Components. Never touch
@@ -12,6 +14,13 @@ import type { CartItem } from "./cart";
 const PAYLOAD_URL = process.env.PAYLOAD_URL || "https://payload.mk360.de";
 const TENANT_SLUG = "einfach-produktiv";
 const SESSION_COOKIE = "ep_customer_token";
+// Reused from the order-creation service call (see orderServer.ts) for
+// the handful of customer-collection operations that legitimately have no
+// customer session of their own yet — the email-verification link click
+// (cold, from an email client) being the main one. Same trust level
+// ("this app's own backend acting on its own behalf"), so a third secret
+// felt like unnecessary sprawl rather than added security.
+const SERVICE_SECRET = process.env.ORDER_SERVICE_SECRET || "";
 
 async function resolveTenantId(): Promise<number | null> {
   const params = new URLSearchParams({ "where[slug][equals]": TENANT_SLUG, limit: "1" });
@@ -27,6 +36,7 @@ export type CustomerSummary = {
   firstName: string;
   lastName: string;
   email: string;
+  emailVerified: boolean;
 };
 
 export type AuthResult = { ok: true; token: string; customer: CustomerSummary } | { ok: false; reason: string };
@@ -62,8 +72,10 @@ export async function loginCustomer(input: { email: string; password: string }):
   });
   if (!res.ok) return { ok: false, reason: "E-Mail-Adresse oder Passwort ist falsch." };
 
-  const data: { token: string; user: { id: number; customerNumber: string; firstName: string; lastName: string; email: string } } =
-    await res.json();
+  const data: {
+    token: string;
+    user: { id: number; customerNumber: string; firstName: string; lastName: string; email: string; emailVerified: boolean };
+  } = await res.json();
   return {
     ok: true,
     token: data.token,
@@ -73,6 +85,7 @@ export async function loginCustomer(input: { email: string; password: string }):
       firstName: data.user.firstName,
       lastName: data.user.lastName,
       email: data.user.email,
+      emailVerified: data.user.emailVerified,
     },
   };
 }
@@ -83,8 +96,9 @@ export async function getCustomerFromToken(token: string): Promise<CustomerSumma
     cache: "no-store",
   });
   if (!res.ok) return null;
-  const data: { user: { id: number; customerNumber: string; firstName: string; lastName: string; email: string } | null } =
-    await res.json();
+  const data: {
+    user: { id: number; customerNumber: string; firstName: string; lastName: string; email: string; emailVerified: boolean } | null;
+  } = await res.json();
   if (!data.user) return null;
   return {
     id: data.user.id,
@@ -92,6 +106,7 @@ export async function getCustomerFromToken(token: string): Promise<CustomerSumma
     firstName: data.user.firstName,
     lastName: data.user.lastName,
     email: data.user.email,
+    emailVerified: data.user.emailVerified,
   };
 }
 
@@ -113,6 +128,7 @@ type PayloadCustomerMe = {
   firstName: string;
   lastName: string;
   email: string;
+  emailVerified: boolean;
   deliveryMethod: "address" | "packstation" | null;
   street: string | null;
   packstationNumber: string | null;
@@ -138,6 +154,7 @@ export async function getCustomerProfile(token: string): Promise<CustomerProfile
     firstName: u.firstName,
     lastName: u.lastName,
     email: u.email,
+    emailVerified: u.emailVerified,
     deliveryMethod: u.deliveryMethod,
     street: u.street,
     packstationNumber: u.packstationNumber,
@@ -193,6 +210,61 @@ export async function changeCustomerPassword(
   return { ok: true };
 }
 
+// Called from app/api/account/verify-email/route.ts — no customer session
+// exists at this point (cold click from an email client), so this
+// authenticates as the service instead (see SERVICE_SECRET above).
+export async function verifyEmailByToken(token: string): Promise<boolean> {
+  const params = new URLSearchParams({ "where[emailVerificationToken][equals]": token, limit: "1" });
+  const res = await fetch(`${PAYLOAD_URL}/api/customers?${params}`, {
+    headers: { "x-order-service-secret": SERVICE_SECRET },
+    cache: "no-store",
+  });
+  if (!res.ok) return false;
+  const data: { docs?: { id: number; emailVerificationExpires: string | null }[] } = await res.json();
+  const doc = data.docs?.[0];
+  if (!doc) return false;
+  if (doc.emailVerificationExpires && new Date(doc.emailVerificationExpires).getTime() < Date.now()) return false;
+
+  const patchRes = await fetch(`${PAYLOAD_URL}/api/customers/${doc.id}`, {
+    method: "PATCH",
+    headers: { "x-order-service-secret": SERVICE_SECRET, "Content-Type": "application/json" },
+    body: JSON.stringify({ emailVerified: true }),
+  });
+  return patchRes.ok;
+}
+
+// Called by an already-logged-in customer (app/api/account/resend-
+// verification/route.ts) — updates the token via their own session (self-
+// update access, see Customers.ts), then sends the mail directly (no
+// Payload afterChange hook to piggyback on for a plain update — that hook
+// only fires on create, see Customers.ts's own comment).
+export async function resendVerificationEmail(session: { token: string; customer: CustomerSummary }): Promise<boolean> {
+  const newToken = randomUUID();
+  const expires = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
+  const res = await fetch(`${PAYLOAD_URL}/api/customers/${session.customer.id}`, {
+    method: "PATCH",
+    headers: { Authorization: `JWT ${session.token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ emailVerificationToken: newToken, emailVerificationExpires: expires }),
+  });
+  if (!res.ok) return false;
+  await sendVerificationEmail(session.customer.email, session.customer.firstName, newToken);
+  return true;
+}
+
+// Self-service GDPR deletion (app/api/account/delete/route.ts) — password
+// re-verification happens there via loginCustomer() before this is ever
+// called. orders.customer is ON DELETE SET NULL (see the Payload
+// migration) — past orders keep their own name/address/items snapshot for
+// tax-retention purposes (§147 AO / GDPR Art. 17(3)(b)), only the account
+// itself disappears.
+export async function deleteCustomerAccount(token: string, customerId: number): Promise<boolean> {
+  const res = await fetch(`${PAYLOAD_URL}/api/customers/${customerId}`, {
+    method: "DELETE",
+    headers: { Authorization: `JWT ${token}` },
+  });
+  return res.ok;
+}
+
 export async function getServerCart(token: string): Promise<CartItem[]> {
   const res = await fetch(`${PAYLOAD_URL}/api/customers/me`, {
     headers: { Authorization: `JWT ${token}` },
@@ -223,8 +295,21 @@ export const ORDER_STATUS_LABEL: Record<string, string> = {
   processing: "In Bearbeitung",
   shipped: "Versandt",
   delivered: "Zugestellt",
+  cancelled: "Storniert",
+  return_requested: "Rücksendung angefragt",
+  returned: "Zurückgesendet",
 };
 
+// Which self-service action is available given the order's current
+// status — mirrors CUSTOMER_ALLOWED_TRANSITIONS in Orders.ts exactly
+// (that hook is the real security boundary; this is just so the UI can
+// decide which button, if any, to show).
+export function customerOrderAction(status: string): "cancel" | "request-return" | null {
+  if (status === "received") return "cancel";
+  if (status === "shipped" || status === "delivered") return "request-return";
+  return null;
+}
+
 export type CustomerOrder = {
   orderNumber: string;
   createdAt: string;
@@ -257,6 +342,7 @@ export async function getCustomerOrders(token: string, customerId: number): Prom
 }
 
 export type CustomerOrderDetail = CustomerOrder & {
+  id: number;
   customerFirstName: string;
   customerLastName: string;
   customerEmail: string;
@@ -298,6 +384,28 @@ export async function getCustomerOrderDetail(token: string, customerId: number,
   return { ...doc, itemCount: doc.items.length };
 }
 
+// Called from app/api/account/orders/[orderNumber]/route.ts. Security
+// lives in Orders.ts's beforeChange hook (only `status` can change, and
+// only via an allowed transition) — this is just the authenticated call;
+// a request the hook rejects comes back as a non-ok response here.
+export async function requestOrderStatusChange(
+  token: string,
+  orderId: number,
+  action: "cancel" | "request-return",
+): Promise<{ ok: true } | { ok: false; reason: string }> {
+  const status = action === "cancel" ? "cancelled" : "return_requested";
+  const res = await fetch(`${PAYLOAD_URL}/api/orders/${orderId}`, {
+    method: "PATCH",
+    headers: { Authorization: `JWT ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ status }),
+  });
+  if (!res.ok) {
+    const data = await res.json().catch(() => null);
+    return { ok: false, reason: data?.errors?.[0]?.message ?? "Aktion war nicht möglich." };
+  }
+  return { ok: true };
+}
+
 // Cookie helpers — Next.js's async cookies() API (Next 15+), usable in
 // Route Handlers (read/write) and Server Components (read-only).
 export async function setSessionCookie(token: string) {

app/lib/rateLimit.ts

@@ -0,0 +1,43 @@
+// Server-only, in-memory sliding-window limiter — deliberately no Redis:
+// this app runs as a single Coolify container, so a plain in-process Map
+// is sufficient and needs zero new infra. Counters reset on redeploy/
+// restart (acceptable — an attacker gets a few extra free attempts right
+// after a deploy, not a meaningful window) and won't share state if this
+// ever scales to multiple instances; revisit with a shared store then.
+//
+// Complements, doesn't replace, Payload's own built-in per-account login
+// lockout (Customers collection, maxLoginAttempts: 5 / lockTime: 10min,
+// Payload defaults) — that stops brute-forcing one account, this stops an
+// IP hammering registration or spraying attempts across many accounts.
+const attempts = new Map<string, number[]>();
+
+// Prevents unbounded growth from IPs that hit a route once and never
+// return — without this, `attempts` would grow forever on a low-traffic
+// site that nonetheless gets scanned/crawled periodically.
+const MAX_TRACKED_KEYS = 10_000;
+
+export function checkRateLimit(key: string, { limit, windowMs }: { limit: number; windowMs: number }): boolean {
+  const now = Date.now();
+  const windowStart = now - windowMs;
+  const timestamps = (attempts.get(key) ?? []).filter((t) => t > windowStart);
+
+  if (timestamps.length >= limit) {
+    attempts.set(key, timestamps);
+    return false;
+  }
+
+  timestamps.push(now);
+  if (attempts.size >= MAX_TRACKED_KEYS && !attempts.has(key)) {
+    attempts.clear();
+  }
+  attempts.set(key, timestamps);
+  return true;
+}
+
+// Caddy sits in front of this app and sets X-Forwarded-For — falls back to
+// a constant key (effectively a single shared bucket) if that's ever
+// missing, e.g. local dev, rather than disabling rate limiting outright.
+export function getClientIp(request: Request): string {
+  const forwarded = request.headers.get("x-forwarded-for");
+  return forwarded?.split(",")[0]?.trim() || "unknown";
+}