@@ -12,6 +12,13 @@ export default async function handler(req: NextApiRequest, res: NextApiResponse)
1212
1313 const email = req . cookies ?. opCodeApplicantEmail ;
1414
15+ // The cookie is cleared on the final successful step (when all fields are filled).
16+ // Additional PATCH requests can still arrive after that (e.g. user double-clicking),
17+ // so we need to bail out early rather than querying Airtable with an undefined email.
18+ if ( ! email ) {
19+ return res . status ( 401 ) . json ( { message : 'Missing registration cookie' } ) ;
20+ }
21+
1522 try {
1623 // Search for a record with the relevant email
1724 const records = await base ( AIR_TABLE_TABLE_NAME )
@@ -96,10 +103,11 @@ export default async function handler(req: NextApiRequest, res: NextApiResponse)
96103 return res . status ( 200 ) . json ( { message : 'Success' } ) ;
97104 }
98105
99- // No record found, add a new row to the table
100- return res
101- . writeHead ( 404 , { Location : '/' } )
102- . json ( { message : `No record found for this email (${ email } )` } ) ;
106+ // No record found — clear the stale cookie so the page guard redirects to /
107+ res . setHeader ( 'Set-Cookie' , [
108+ `opCodeApplicantEmail=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT` ,
109+ ] ) ;
110+ return res . status ( 404 ) . json ( { message : `No record found for this email (${ email } )` } ) ;
103111 } catch ( error ) {
104112 console . error ( 'Error with /api/registration/update PATCH request:' , error ) ;
105113 return res . status ( 500 ) . json ( { message : 'Server Error' } ) ;
0 commit comments