Harden authentication, tenant isolation and security boundaries

src/lib/alert-tokens.ts

@@ -0,0 +1,12 @@
+import { NotdienstAlertStatus } from "@prisma/client";
+import { hashToken } from "@/lib/tokens";
+export function activeAlertTokenWhere(token: string) {
+  const today = new Date(); today.setUTCHours(0, 0, 0, 0);
+  return {
+    confirmationToken: { in: [hashToken(token), ...(token.length === 36 ? [token] : [])] },
+    status: NotdienstAlertStatus.PENDING,
+    triggeredAt: { gt: new Date(Date.now() - 24 * 60 * 60_000) },
+    assignment: { date: { gte: today } },
+    parentUser: { disabledAt: null },
+  };
+}