fix: fix bypass email verification in apiKey.exchange

1 files changed, 10 insertions, 0 deletions

diff --git a/packages/trpc/routers/apiKeys.ts b/packages/trpc/routers/apiKeys.ts
index 93b7d9ec..763bc23a 100644
--- a/packages/trpc/routers/apiKeys.ts
+++ b/packages/trpc/routers/apiKeys.ts
@@ -131,6 +131,16 @@ export const apiKeysAppRouter = router({
       } catch {
         throw new TRPCError({ code: "UNAUTHORIZED" });
       }
+
+      // Check if email verification is required and if the user has verified their email
+      if (serverConfig.auth.emailVerificationRequired && !user.emailVerified) {
+        throw new TRPCError({
+          message:
+            "Please verify your email address before generating an API key",
+          code: "FORBIDDEN",
+        });
+      }
+
       return await generateApiKey(input.keyName, user.id, ctx.db);
     }),
   validate: publicProcedure