makearmy/makearmy-app
1
0
Fork 0
Code Issues 11 Pull requests Projects Releases Packages Wiki Activity Actions

account auth fix for account management

Browse source
This commit is contained in:
makearmy 2025-09-30 01:05:03 -04:00
parent 787de00274
commit b835529b77
3 changed files with 81 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

40
app/api/auth/login/route.ts
View file

@ -1,6 +1,6 @@
// app/api/auth/login/route.ts
import { NextRequest, NextResponse } from "next/server";
import { emailForUsername, loginDirectus } from "@/lib/directus";
import { loginDirectus } from "@/lib/directus";
export const runtime = "nodejs";
@ -8,7 +8,7 @@ const secure = process.env.NODE_ENV === "production";
/**
* Accepts any of:
* - { identifier: string, password: string } // email or username in `identifier`
* - { identifier: string, password: string } // email OR username in `identifier`
* - { email: string, password: string }
* - { username: string, password: string }
*
@ -17,26 +17,17 @@ const secure = process.env.NODE_ENV === "production";
export async function POST(req: NextRequest) {
try {
const body = await req.json().catch(() => ({} as any));
const { password } = body as { identifier?: string; email?: string; username?: string; password?: string };
const password = String(body?.password ?? "").trim();
const identifier = String(
body?.identifier ?? body?.email ?? body?.username ?? ""
).trim();
let identifier = (body?.identifier ?? body?.email ?? body?.username ?? "").trim();
if (!identifier || !password) {
return NextResponse.json({ error: "Missing credentials" }, { status: 400 });
}
// Resolve to an email for Directus login:
// - If identifier looks like an email, use it directly.
// - Otherwise treat it as a username and look up the email.
let email = identifier.includes("@") ? identifier : null;
if (!email) {
email = await emailForUsername(identifier);
if (!email) {
return NextResponse.json({ error: "User not found" }, { status: 404 });
}
}
// Login against Directus; helper returns { access_token, refresh_token?, expires? } in .data or root
const data = await loginDirectus(email, password);
// Directus accepts username in the "email" field for /auth/login
const data = await loginDirectus(identifier, password);
const access =
data?.access_token ?? data?.data?.access_token ?? null;
@ -44,17 +35,17 @@ export async function POST(req: NextRequest) {
data?.expires ?? data?.data?.expires ?? null;
if (!access) {
return NextResponse.json({ error: "Invalid response from auth provider" }, { status: 502 });
return NextResponse.json(
{ error: "Invalid response from auth provider" },
{ status: 502 }
);
}
const res = NextResponse.json({ ok: true });
// Set access token cookie
// - HttpOnly so JS can't read it
// - SameSite=Lax to allow normal navigation
// - Secure in production
// - Max-Age from Directus if provided; else fallback to 8h
const maxAge = typeof expiresSec === "number" ? Math.max(0, Math.floor(expiresSec)) : 60 * 60 * 8;
// Max-Age from Directus if provided; else fallback to 8h
const maxAge =
typeof expiresSec === "number" ? Math.max(0, Math.floor(expiresSec)) : 60 * 60 * 8;
res.cookies.set({
name: "ma_at",
@ -72,7 +63,6 @@ export async function POST(req: NextRequest) {
err?.response?.data?.error ||
err?.message ||
"Login failed";
// Return 401 for auth problems; 400 for others
const status = /unauth|invalid|credentials/i.test(message) ? 401 : 400;
return NextResponse.json({ error: message }, { status });
}