Refactor login flow with reset token support
All checks were successful
Automated Container Build / build-and-push (push) Successful in 1m6s
All checks were successful
Automated Container Build / build-and-push (push) Successful in 1m6s
This commit is contained in:
parent
f0548bcc6e
commit
95af276d2e
11 changed files with 679 additions and 226 deletions
BIN
dev.db
BIN
dev.db
Binary file not shown.
|
|
@ -1,116 +1,29 @@
|
|||
import { NextRequest, NextResponse } from "next/server";
|
||||
import { prisma } from "@/lib/db";
|
||||
import { createSession } from "@/lib/auth";
|
||||
import { loginSchema } from "@/lib/validation/authSchemas";
|
||||
import { checkRateLimit } from "@/lib/rateLimiter";
|
||||
|
||||
// Progressive lockout thresholds from Section 4
|
||||
function getLockoutDuration(failedAttempts: number): number {
|
||||
if (failedAttempts >= 20) return 24 * 60 * 60 * 1000; // 24 hours
|
||||
if (failedAttempts >= 15) return 30 * 60 * 1000; // 30 minutes
|
||||
if (failedAttempts >= 10) return 5 * 60 * 1000; // 5 minutes
|
||||
if (failedAttempts >= 5) return 1 * 60 * 1000; // 1 minute
|
||||
return 0;
|
||||
}
|
||||
import { login } from "@/services/authService";
|
||||
|
||||
export async function POST(request: NextRequest) {
|
||||
// Rate limit by IP
|
||||
const forwarded = request.headers.get("x-forwarded-for");
|
||||
const ip = forwarded?.split(",")[0]?.trim() ?? "unknown";
|
||||
const rateCheck = checkRateLimit(ip);
|
||||
|
||||
if (!rateCheck.allowed) {
|
||||
const ip = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
|
||||
if (!checkRateLimit(`login:${ip}`).allowed) {
|
||||
return NextResponse.json(
|
||||
{ error: "Too many requests. Try again shortly." },
|
||||
{ status: 429 }
|
||||
);
|
||||
}
|
||||
|
||||
const body = await request.json().catch(() => null);
|
||||
if (!body?.password || typeof body.password !== "string") {
|
||||
const parsed = loginSchema.safeParse(await request.json().catch(() => null));
|
||||
if (!parsed.success) {
|
||||
return NextResponse.json(
|
||||
{ error: "Password is required" },
|
||||
{ error: parsed.error.issues[0]?.message ?? "Invalid request" },
|
||||
{ status: 400 }
|
||||
);
|
||||
}
|
||||
|
||||
// Check lockout state
|
||||
let security = await prisma.authSecurity.findUnique({ where: { id: 1 } });
|
||||
if (!security) {
|
||||
security = await prisma.authSecurity.create({ data: { id: 1 } });
|
||||
const result = await login(parsed.data.password);
|
||||
if (!result.ok) {
|
||||
return NextResponse.json({ error: result.error }, { status: result.status });
|
||||
}
|
||||
|
||||
if (security.lockedUntil && security.lockedUntil > new Date()) {
|
||||
const remainingMs =
|
||||
security.lockedUntil.getTime() - Date.now();
|
||||
const remainingMin = Math.ceil(remainingMs / 60000);
|
||||
return NextResponse.json(
|
||||
{
|
||||
error: `Account locked. Try again in ${remainingMin} minute${remainingMin !== 1 ? "s" : ""}.`,
|
||||
},
|
||||
{ status: 423 }
|
||||
);
|
||||
}
|
||||
|
||||
// Verify password
|
||||
const setting = await prisma.setting.findUnique({
|
||||
where: { key: "admin_password_hash" },
|
||||
});
|
||||
|
||||
let isValid = false;
|
||||
|
||||
if (!setting) {
|
||||
// Initial setup: hash and save the new password
|
||||
const argon2 = await import("argon2");
|
||||
const newHash = await argon2.hash(body.password);
|
||||
await prisma.setting.create({
|
||||
data: {
|
||||
key: "admin_password_hash",
|
||||
value: newHash,
|
||||
},
|
||||
});
|
||||
isValid = true;
|
||||
} else {
|
||||
// Verify existing password
|
||||
const passwordHash = setting.value;
|
||||
try {
|
||||
const argon2 = await import("argon2");
|
||||
isValid = await argon2.verify(passwordHash, body.password);
|
||||
} catch {
|
||||
isValid = body.password === passwordHash;
|
||||
}
|
||||
}
|
||||
|
||||
if (!isValid) {
|
||||
const newFailedAttempts = security.failedAttempts + 1;
|
||||
const lockoutMs = getLockoutDuration(newFailedAttempts);
|
||||
const lockedUntil = lockoutMs > 0 ? new Date(Date.now() + lockoutMs) : null;
|
||||
|
||||
await prisma.authSecurity.update({
|
||||
where: { id: 1 },
|
||||
data: {
|
||||
failedAttempts: newFailedAttempts,
|
||||
lockedUntil,
|
||||
lastAttemptAt: new Date(),
|
||||
},
|
||||
});
|
||||
|
||||
return NextResponse.json(
|
||||
{ error: "Invalid password" },
|
||||
{ status: 401 }
|
||||
);
|
||||
}
|
||||
|
||||
// Success — reset lockout, create session
|
||||
await prisma.authSecurity.update({
|
||||
where: { id: 1 },
|
||||
data: {
|
||||
failedAttempts: 0,
|
||||
lockedUntil: null,
|
||||
lastAttemptAt: new Date(),
|
||||
},
|
||||
});
|
||||
|
||||
await createSession();
|
||||
|
||||
return NextResponse.json({ success: true });
|
||||
}
|
||||
|
|
|
|||
24
src/app/api/auth/password-reset/complete/route.ts
Normal file
24
src/app/api/auth/password-reset/complete/route.ts
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
import { NextRequest, NextResponse } from "next/server";
|
||||
import { completePasswordResetSchema } from "@/lib/validation/authSchemas";
|
||||
import { completePasswordReset } from "@/services/authService";
|
||||
|
||||
export async function POST(request: NextRequest) {
|
||||
const parsed = completePasswordResetSchema.safeParse(
|
||||
await request.json().catch(() => null)
|
||||
);
|
||||
if (!parsed.success) {
|
||||
return NextResponse.json(
|
||||
{ error: parsed.error.issues[0]?.message ?? "Invalid request" },
|
||||
{ status: 400 }
|
||||
);
|
||||
}
|
||||
|
||||
if (!(await completePasswordReset(parsed.data.password))) {
|
||||
return NextResponse.json(
|
||||
{ error: "Reset authorization is invalid or expired" },
|
||||
{ status: 401 }
|
||||
);
|
||||
}
|
||||
|
||||
return NextResponse.json({ success: true });
|
||||
}
|
||||
25
src/app/api/auth/password-reset/request/route.ts
Normal file
25
src/app/api/auth/password-reset/request/route.ts
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
import { NextRequest, NextResponse } from "next/server";
|
||||
import { checkRateLimit } from "@/lib/rateLimiter";
|
||||
import { requestPasswordReset } from "@/services/authService";
|
||||
|
||||
export async function POST(request: NextRequest) {
|
||||
const ip = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
|
||||
const rateLimit = checkRateLimit(`password-reset-request:${ip}`, {
|
||||
windowMs: 60_000,
|
||||
maxRequests: 1,
|
||||
});
|
||||
if (!rateLimit.allowed) {
|
||||
return NextResponse.json(
|
||||
{ error: "A reset token was requested recently. Try again shortly." },
|
||||
{ status: 429 }
|
||||
);
|
||||
}
|
||||
|
||||
if (!(await requestPasswordReset())) {
|
||||
return NextResponse.json(
|
||||
{ error: "Password recovery is unavailable before initial setup." },
|
||||
{ status: 409 }
|
||||
);
|
||||
}
|
||||
return NextResponse.json({ success: true });
|
||||
}
|
||||
25
src/app/api/auth/password-reset/verify/route.ts
Normal file
25
src/app/api/auth/password-reset/verify/route.ts
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
import { NextRequest, NextResponse } from "next/server";
|
||||
import { checkRateLimit } from "@/lib/rateLimiter";
|
||||
import { resetTokenSchema } from "@/lib/validation/authSchemas";
|
||||
import { verifyPasswordResetToken } from "@/services/authService";
|
||||
|
||||
export async function POST(request: NextRequest) {
|
||||
const ip = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
|
||||
if (!checkRateLimit(`password-reset-verify:${ip}`).allowed) {
|
||||
return NextResponse.json(
|
||||
{ error: "Too many attempts. Try again shortly." },
|
||||
{ status: 429 }
|
||||
);
|
||||
}
|
||||
|
||||
const parsed = resetTokenSchema.safeParse(await request.json().catch(() => null));
|
||||
if (!parsed.success) {
|
||||
return NextResponse.json({ error: "Invalid or expired reset token" }, { status: 400 });
|
||||
}
|
||||
|
||||
if (!(await verifyPasswordResetToken(parsed.data.token))) {
|
||||
return NextResponse.json({ error: "Invalid or expired reset token" }, { status: 401 });
|
||||
}
|
||||
|
||||
return NextResponse.json({ success: true });
|
||||
}
|
||||
|
|
@ -1,158 +1,333 @@
|
|||
"use client";
|
||||
|
||||
import { useState, useEffect } from "react";
|
||||
import { useRouter } from "next/navigation";
|
||||
import { useEffect, useState } from "react";
|
||||
import { ThemeToggle } from "@/components/ui/ThemeToggle";
|
||||
|
||||
type LoginStage = "login" | "token" | "password" | "success";
|
||||
|
||||
async function postJson(path: string, body?: object) {
|
||||
const response = await fetch(path, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify(body ?? {}),
|
||||
});
|
||||
const data: { error?: string } = await response.json();
|
||||
if (!response.ok) throw new Error(data.error || "Request failed");
|
||||
}
|
||||
|
||||
export default function LoginPage() {
|
||||
const [stage, setStage] = useState<LoginStage>("login");
|
||||
const [password, setPassword] = useState("");
|
||||
const [confirmPassword, setConfirmPassword] = useState("");
|
||||
const [token, setToken] = useState("");
|
||||
const [error, setError] = useState("");
|
||||
const [loading, setLoading] = useState(false);
|
||||
const [isSetup, setIsSetup] = useState<boolean | null>(null);
|
||||
const router = useRouter();
|
||||
const [setupRequired, setSetupRequired] = useState<boolean | null>(null);
|
||||
|
||||
useEffect(() => {
|
||||
fetch("/api/auth/setup-status")
|
||||
.then((res) => res.json())
|
||||
.then((data) => setIsSetup(data.setupRequired))
|
||||
.catch(() => setIsSetup(false)); // fallback
|
||||
.then((response) => response.json())
|
||||
.then((data) => setSetupRequired(data.setupRequired))
|
||||
.catch(() => setSetupRequired(false));
|
||||
}, []);
|
||||
|
||||
async function handleSubmit(e: React.FormEvent) {
|
||||
e.preventDefault();
|
||||
async function run(action: () => Promise<void>) {
|
||||
setError("");
|
||||
setLoading(true);
|
||||
|
||||
try {
|
||||
const res = await fetch("/api/auth/login", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ password }),
|
||||
});
|
||||
|
||||
const data = await res.json();
|
||||
|
||||
if (!res.ok) {
|
||||
setError(data.error || "Login failed");
|
||||
return;
|
||||
}
|
||||
|
||||
window.location.href = "/";
|
||||
} catch {
|
||||
setError("Network error. Please try again.");
|
||||
await action();
|
||||
} catch (caught) {
|
||||
setError(caught instanceof Error ? caught.message : "Network error. Please try again.");
|
||||
} finally {
|
||||
setLoading(false);
|
||||
}
|
||||
}
|
||||
|
||||
if (isSetup === null) {
|
||||
function handleLogin(event: React.FormEvent) {
|
||||
event.preventDefault();
|
||||
void run(async () => {
|
||||
await postJson("/api/auth/login", { password });
|
||||
window.location.href = "/";
|
||||
});
|
||||
}
|
||||
|
||||
function beginReset() {
|
||||
void run(async () => {
|
||||
await postJson("/api/auth/password-reset/request");
|
||||
setToken("");
|
||||
setStage("token");
|
||||
});
|
||||
}
|
||||
|
||||
function handleToken(event: React.FormEvent) {
|
||||
event.preventDefault();
|
||||
void run(async () => {
|
||||
await postJson("/api/auth/password-reset/verify", { token: token.trim() });
|
||||
setPassword("");
|
||||
setConfirmPassword("");
|
||||
setStage("password");
|
||||
});
|
||||
}
|
||||
|
||||
function handlePasswordReset(event: React.FormEvent) {
|
||||
event.preventDefault();
|
||||
void run(async () => {
|
||||
await postJson("/api/auth/password-reset/complete", {
|
||||
password,
|
||||
confirmPassword,
|
||||
});
|
||||
setToken("");
|
||||
setPassword("");
|
||||
setConfirmPassword("");
|
||||
setStage("success");
|
||||
});
|
||||
}
|
||||
|
||||
function returnToLogin() {
|
||||
setStage("login");
|
||||
setError("");
|
||||
setToken("");
|
||||
setPassword("");
|
||||
setConfirmPassword("");
|
||||
}
|
||||
|
||||
if (setupRequired === null) {
|
||||
return (
|
||||
<div className="flex min-h-screen items-center justify-center p-4">
|
||||
<div className="animate-pulse flex items-center justify-center">
|
||||
<div className="w-8 h-8 border-4 border-primary border-t-transparent rounded-full animate-spin"></div>
|
||||
</div>
|
||||
<div className="h-8 w-8 animate-spin rounded-full border-4 border-primary border-t-transparent" />
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
const title =
|
||||
stage === "token"
|
||||
? "Enter reset token"
|
||||
: stage === "password"
|
||||
? "Choose a new password"
|
||||
: stage === "success"
|
||||
? "Password updated"
|
||||
: setupRequired
|
||||
? "Welcome to Study Desk"
|
||||
: "Welcome back";
|
||||
|
||||
const description =
|
||||
stage === "token"
|
||||
? "Find the token in the Study Desk Docker logs. It expires after 15 minutes."
|
||||
: stage === "password"
|
||||
? "Use at least eight characters and enter the password twice."
|
||||
: stage === "success"
|
||||
? "Your old password and existing sessions are no longer valid."
|
||||
: setupRequired
|
||||
? "Please set your admin password for the first time."
|
||||
: "Open your notes, decks, and practice quizzes.";
|
||||
|
||||
return (
|
||||
<div className="relative flex min-h-screen items-center justify-center overflow-hidden p-4 sm:p-8">
|
||||
<div className="absolute inset-0 paper-grid opacity-70" />
|
||||
<div className="absolute -left-24 top-1/4 h-80 w-80 rounded-full bg-primary/15 blur-3xl" />
|
||||
<div className="absolute -right-24 bottom-0 h-72 w-72 rounded-full bg-accent/15 blur-3xl" />
|
||||
<div className="absolute right-4 top-4 z-10"><ThemeToggle /></div>
|
||||
<div className="relative w-full max-w-md animate-fade-in">
|
||||
{/* Logo / Title area */}
|
||||
<div className="mb-7 text-center">
|
||||
|
||||
<main className="relative w-full max-w-md animate-fade-in">
|
||||
<header className="mb-7 text-center">
|
||||
<div className="mb-4 inline-grid h-14 w-14 place-items-center rounded-2xl bg-primary text-xl font-black text-white shadow-[0_12px_30px_color-mix(in_srgb,var(--theme-primary)_30%,transparent)]">S</div>
|
||||
<p className="text-xs font-bold uppercase tracking-[0.2em] text-primary">Personal workspace</p>
|
||||
<h1 className="editorial-title mt-2 text-4xl text-text-heading">
|
||||
{isSetup ? "Welcome to Study Desk" : "Welcome back"}
|
||||
</h1>
|
||||
<p className="text-text-muted mt-1 text-sm">
|
||||
{isSetup
|
||||
? "Please set your admin password for the first time."
|
||||
: "Open your notes, decks, and practice quizzes."}
|
||||
</p>
|
||||
</div>
|
||||
<h1 className="editorial-title mt-2 text-4xl text-text-heading">{title}</h1>
|
||||
<p className="mt-1 text-sm text-text-muted">{description}</p>
|
||||
</header>
|
||||
|
||||
{/* Login card */}
|
||||
<div className="rounded-[2rem] border border-border-light bg-bg-surface/90 p-6 shadow-[var(--shadow-modal)] backdrop-blur sm:p-8">
|
||||
<form onSubmit={handleSubmit} className="space-y-4">
|
||||
<div>
|
||||
<label
|
||||
htmlFor="password"
|
||||
className="block text-sm font-medium text-text-secondary mb-1.5"
|
||||
>
|
||||
Password
|
||||
</label>
|
||||
<input
|
||||
{stage === "login" && (
|
||||
<form onSubmit={handleLogin} className="space-y-4">
|
||||
<PasswordField
|
||||
id="password"
|
||||
type="password"
|
||||
label="Password"
|
||||
value={password}
|
||||
onChange={(e) => setPassword(e.target.value)}
|
||||
placeholder={isSetup ? "Create a new password" : "Enter your password"}
|
||||
onChange={setPassword}
|
||||
placeholder={setupRequired ? "Create a new password" : "Enter your password"}
|
||||
autoFocus
|
||||
className="min-h-12 w-full rounded-xl border border-border bg-bg-surface-alt/60 px-4 text-text-heading placeholder:text-text-muted focus:border-primary"
|
||||
/>
|
||||
</div>
|
||||
|
||||
{error && (
|
||||
<div className="flex items-center gap-2 text-sm text-error bg-error-bg rounded-lg px-3 py-2.5">
|
||||
<svg
|
||||
className="w-4 h-4 flex-shrink-0"
|
||||
fill="none"
|
||||
stroke="currentColor"
|
||||
viewBox="0 0 24 24"
|
||||
<ErrorMessage message={error} />
|
||||
<PrimaryButton loading={loading} disabled={password.length < 8}>
|
||||
{setupRequired ? "Save Password & Login" : "Sign In"}
|
||||
</PrimaryButton>
|
||||
{!setupRequired && (
|
||||
<button
|
||||
type="button"
|
||||
onClick={beginReset}
|
||||
disabled={loading}
|
||||
className="w-full rounded-lg py-2 text-sm font-semibold text-primary hover:text-primary-hover focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary disabled:opacity-50"
|
||||
>
|
||||
<path
|
||||
strokeLinecap="round"
|
||||
strokeLinejoin="round"
|
||||
strokeWidth={2}
|
||||
d="M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
|
||||
/>
|
||||
</svg>
|
||||
{error}
|
||||
</div>
|
||||
)}
|
||||
|
||||
<button
|
||||
type="submit"
|
||||
disabled={loading || !password}
|
||||
className="min-h-12 w-full rounded-xl bg-primary px-4 font-bold text-white transition-colors hover:bg-primary-hover disabled:cursor-not-allowed disabled:opacity-50"
|
||||
>
|
||||
{loading ? (
|
||||
<span className="inline-flex items-center gap-2">
|
||||
<svg
|
||||
className="animate-spin h-4 w-4"
|
||||
fill="none"
|
||||
viewBox="0 0 24 24"
|
||||
>
|
||||
<circle
|
||||
className="opacity-25"
|
||||
cx="12"
|
||||
cy="12"
|
||||
r="10"
|
||||
stroke="currentColor"
|
||||
strokeWidth="4"
|
||||
/>
|
||||
<path
|
||||
className="opacity-75"
|
||||
fill="currentColor"
|
||||
d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
|
||||
/>
|
||||
</svg>
|
||||
{isSetup ? "Saving..." : "Signing in..."}
|
||||
</span>
|
||||
) : isSetup ? (
|
||||
"Save Password & Login"
|
||||
) : (
|
||||
"Sign In"
|
||||
Forgot password?
|
||||
</button>
|
||||
)}
|
||||
</button>
|
||||
</form>
|
||||
</form>
|
||||
)}
|
||||
|
||||
{stage === "token" && (
|
||||
<form onSubmit={handleToken} className="space-y-4">
|
||||
<div>
|
||||
<label htmlFor="reset-token" className="mb-1.5 block text-sm font-medium text-text-secondary">Reset token</label>
|
||||
<input
|
||||
id="reset-token"
|
||||
value={token}
|
||||
onChange={(event) => setToken(event.target.value)}
|
||||
autoComplete="one-time-code"
|
||||
autoFocus
|
||||
className="min-h-12 w-full rounded-xl border border-border bg-bg-surface-alt/60 px-4 font-mono text-text-heading placeholder:text-text-muted focus:border-primary"
|
||||
placeholder="Paste the token from Docker logs"
|
||||
/>
|
||||
</div>
|
||||
<ErrorMessage message={error} />
|
||||
<PrimaryButton loading={loading} disabled={!token.trim()}>Validate Token</PrimaryButton>
|
||||
<SecondaryButton onClick={returnToLogin}>Back to sign in</SecondaryButton>
|
||||
</form>
|
||||
)}
|
||||
|
||||
{stage === "password" && (
|
||||
<form onSubmit={handlePasswordReset} className="space-y-4">
|
||||
<div>
|
||||
<PasswordField
|
||||
id="new-password"
|
||||
label="New password"
|
||||
value={password}
|
||||
onChange={setPassword}
|
||||
describedBy="password-length-status"
|
||||
invalid={password.length < 8}
|
||||
autoFocus
|
||||
/>
|
||||
<ValidationMessage
|
||||
id="password-length-status"
|
||||
valid={password.length >= 8}
|
||||
validText="Password meets the length requirement."
|
||||
invalidText="Password must be at least 8 characters."
|
||||
/>
|
||||
</div>
|
||||
<div>
|
||||
<PasswordField
|
||||
id="confirm-password"
|
||||
label="Confirm new password"
|
||||
value={confirmPassword}
|
||||
onChange={setConfirmPassword}
|
||||
describedBy={confirmPassword ? "password-match-status" : undefined}
|
||||
invalid={confirmPassword.length > 0 && confirmPassword !== password}
|
||||
/>
|
||||
{confirmPassword && (
|
||||
<ValidationMessage
|
||||
id="password-match-status"
|
||||
valid={confirmPassword === password}
|
||||
validText="Passwords match."
|
||||
invalidText="Passwords do not match."
|
||||
/>
|
||||
)}
|
||||
</div>
|
||||
<ErrorMessage message={error} />
|
||||
<PrimaryButton
|
||||
loading={loading}
|
||||
disabled={password.length < 8 || confirmPassword !== password}
|
||||
>
|
||||
Set New Password
|
||||
</PrimaryButton>
|
||||
<SecondaryButton onClick={returnToLogin}>Cancel</SecondaryButton>
|
||||
</form>
|
||||
)}
|
||||
|
||||
{stage === "success" && (
|
||||
<div className="space-y-4 text-center">
|
||||
<div className="rounded-xl bg-success-bg px-4 py-3 text-sm text-success" role="status">
|
||||
Your password has been reset successfully.
|
||||
</div>
|
||||
<PrimaryButton loading={false} onClick={returnToLogin}>Sign In</PrimaryButton>
|
||||
</div>
|
||||
)}
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
function PasswordField({
|
||||
id,
|
||||
label,
|
||||
value,
|
||||
onChange,
|
||||
placeholder,
|
||||
describedBy,
|
||||
invalid = false,
|
||||
autoFocus = false,
|
||||
}: {
|
||||
id: string;
|
||||
label: string;
|
||||
value: string;
|
||||
onChange: (value: string) => void;
|
||||
placeholder?: string;
|
||||
describedBy?: string;
|
||||
invalid?: boolean;
|
||||
autoFocus?: boolean;
|
||||
}) {
|
||||
return (
|
||||
<div>
|
||||
<label htmlFor={id} className="mb-1.5 block text-sm font-medium text-text-secondary">{label}</label>
|
||||
<input
|
||||
id={id}
|
||||
type="password"
|
||||
value={value}
|
||||
onChange={(event) => onChange(event.target.value)}
|
||||
placeholder={placeholder}
|
||||
autoComplete={id === "password" ? "current-password" : "new-password"}
|
||||
aria-describedby={describedBy}
|
||||
aria-invalid={invalid}
|
||||
autoFocus={autoFocus}
|
||||
className="min-h-12 w-full rounded-xl border border-border bg-bg-surface-alt/60 px-4 text-text-heading placeholder:text-text-muted focus:border-primary"
|
||||
/>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
function ValidationMessage({ id, valid, validText, invalidText }: {
|
||||
id: string;
|
||||
valid: boolean;
|
||||
validText: string;
|
||||
invalidText: string;
|
||||
}) {
|
||||
return (
|
||||
<p
|
||||
id={id}
|
||||
aria-live="polite"
|
||||
className={`mt-1.5 text-sm ${valid ? "text-success" : "text-error"}`}
|
||||
>
|
||||
{valid ? validText : invalidText}
|
||||
</p>
|
||||
);
|
||||
}
|
||||
|
||||
function ErrorMessage({ message }: { message: string }) {
|
||||
if (!message) return null;
|
||||
return <div role="alert" className="rounded-lg bg-error-bg px-3 py-2.5 text-sm text-error">{message}</div>;
|
||||
}
|
||||
|
||||
function PrimaryButton({ loading, disabled = false, onClick, children }: {
|
||||
loading: boolean;
|
||||
disabled?: boolean;
|
||||
onClick?: () => void;
|
||||
children: React.ReactNode;
|
||||
}) {
|
||||
return (
|
||||
<button
|
||||
type={onClick ? "button" : "submit"}
|
||||
onClick={onClick}
|
||||
disabled={loading || disabled}
|
||||
className="min-h-12 w-full rounded-xl bg-primary px-4 font-bold text-white transition-colors hover:bg-primary-hover focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary disabled:cursor-not-allowed disabled:opacity-50"
|
||||
>
|
||||
{loading ? "Working..." : children}
|
||||
</button>
|
||||
);
|
||||
}
|
||||
|
||||
function SecondaryButton({ onClick, children }: { onClick: () => void; children: React.ReactNode }) {
|
||||
return (
|
||||
<button type="button" onClick={onClick} className="min-h-11 w-full rounded-xl border border-border px-4 font-semibold text-text-secondary hover:bg-bg-surface-alt focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary">
|
||||
{children}
|
||||
</button>
|
||||
);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,6 +3,12 @@ import { cookies } from "next/headers";
|
|||
|
||||
export interface SessionData {
|
||||
isAuthenticated: boolean;
|
||||
sessionGeneration?: number;
|
||||
}
|
||||
|
||||
interface PasswordResetSessionData {
|
||||
nonce?: string;
|
||||
expiresAt?: string;
|
||||
}
|
||||
|
||||
const sessionOptions: SessionOptions = {
|
||||
|
|
@ -15,14 +21,27 @@ const sessionOptions: SessionOptions = {
|
|||
},
|
||||
};
|
||||
|
||||
const passwordResetSessionOptions: SessionOptions = {
|
||||
password: sessionOptions.password,
|
||||
cookieName: "study-app-password-reset",
|
||||
cookieOptions: {
|
||||
secure: sessionOptions.cookieOptions?.secure,
|
||||
httpOnly: true,
|
||||
sameSite: "lax" as const,
|
||||
maxAge: 15 * 60,
|
||||
path: "/",
|
||||
},
|
||||
};
|
||||
|
||||
export async function getSession() {
|
||||
const cookieStore = await cookies();
|
||||
return getIronSession<SessionData>(cookieStore, sessionOptions);
|
||||
}
|
||||
|
||||
export async function createSession() {
|
||||
export async function createSession(sessionGeneration: number) {
|
||||
const session = await getSession();
|
||||
session.isAuthenticated = true;
|
||||
session.sessionGeneration = sessionGeneration;
|
||||
await session.save();
|
||||
}
|
||||
|
||||
|
|
@ -35,3 +54,23 @@ export async function isAuthenticated() {
|
|||
const session = await getSession();
|
||||
return session.isAuthenticated === true;
|
||||
}
|
||||
|
||||
export async function getPasswordResetSession() {
|
||||
const cookieStore = await cookies();
|
||||
return getIronSession<PasswordResetSessionData>(
|
||||
cookieStore,
|
||||
passwordResetSessionOptions
|
||||
);
|
||||
}
|
||||
|
||||
export async function authorizePasswordReset(nonce: string, expiresAt: string) {
|
||||
const session = await getPasswordResetSession();
|
||||
session.nonce = nonce;
|
||||
session.expiresAt = expiresAt;
|
||||
await session.save();
|
||||
}
|
||||
|
||||
export async function destroyPasswordResetAuthorization() {
|
||||
const session = await getPasswordResetSession();
|
||||
session.destroy();
|
||||
}
|
||||
|
|
|
|||
|
|
@ -12,20 +12,25 @@ const store = new Map<string, RateLimitEntry>();
|
|||
const WINDOW_MS = 60 * 1000; // 1 minute
|
||||
const MAX_REQUESTS = 10;
|
||||
|
||||
export function checkRateLimit(ip: string): { allowed: boolean; retryAfterMs: number } {
|
||||
export function checkRateLimit(
|
||||
key: string,
|
||||
options: { windowMs?: number; maxRequests?: number } = {}
|
||||
): { allowed: boolean; retryAfterMs: number } {
|
||||
const now = Date.now();
|
||||
const entry = store.get(ip) ?? { timestamps: [] };
|
||||
const windowMs = options.windowMs ?? WINDOW_MS;
|
||||
const maxRequests = options.maxRequests ?? MAX_REQUESTS;
|
||||
const entry = store.get(key) ?? { timestamps: [] };
|
||||
|
||||
// Remove timestamps outside the window
|
||||
entry.timestamps = entry.timestamps.filter((t) => now - t < WINDOW_MS);
|
||||
entry.timestamps = entry.timestamps.filter((t) => now - t < windowMs);
|
||||
|
||||
if (entry.timestamps.length >= MAX_REQUESTS) {
|
||||
if (entry.timestamps.length >= maxRequests) {
|
||||
const oldestInWindow = entry.timestamps[0];
|
||||
const retryAfterMs = WINDOW_MS - (now - oldestInWindow);
|
||||
const retryAfterMs = windowMs - (now - oldestInWindow);
|
||||
return { allowed: false, retryAfterMs };
|
||||
}
|
||||
|
||||
entry.timestamps.push(now);
|
||||
store.set(ip, entry);
|
||||
store.set(key, entry);
|
||||
return { allowed: true, retryAfterMs: 0 };
|
||||
}
|
||||
|
|
|
|||
19
src/lib/validation/authSchemas.ts
Normal file
19
src/lib/validation/authSchemas.ts
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
import { z } from "zod";
|
||||
|
||||
export const loginSchema = z.object({
|
||||
password: z.string().min(8, "Password must be at least 8 characters"),
|
||||
});
|
||||
|
||||
export const resetTokenSchema = z.object({
|
||||
token: z.string().min(1, "Reset token is required"),
|
||||
});
|
||||
|
||||
export const completePasswordResetSchema = z
|
||||
.object({
|
||||
password: z.string().min(8, "Password must be at least 8 characters"),
|
||||
confirmPassword: z.string(),
|
||||
})
|
||||
.refine((value) => value.password === value.confirmPassword, {
|
||||
message: "Passwords do not match",
|
||||
path: ["confirmPassword"],
|
||||
});
|
||||
|
|
@ -1,6 +1,7 @@
|
|||
import { NextRequest, NextResponse } from "next/server";
|
||||
import { getIronSession } from "iron-session";
|
||||
import type { SessionData } from "@/lib/auth";
|
||||
import { prisma } from "@/lib/db";
|
||||
|
||||
const sessionOptions = {
|
||||
password:
|
||||
|
|
@ -9,18 +10,15 @@ const sessionOptions = {
|
|||
cookieName: "study-app-session",
|
||||
};
|
||||
|
||||
// Routes that don't require authentication
|
||||
const publicPaths = ["/login", "/api/auth", "/shared"];
|
||||
|
||||
export async function middleware(request: NextRequest) {
|
||||
export async function proxy(request: NextRequest) {
|
||||
const { pathname } = request.nextUrl;
|
||||
|
||||
// Allow public routes
|
||||
if (publicPaths.some((path) => pathname.startsWith(path))) {
|
||||
return NextResponse.next();
|
||||
}
|
||||
|
||||
// Allow static assets and Next.js internals
|
||||
if (
|
||||
pathname.startsWith("/_next") ||
|
||||
pathname.startsWith("/favicon") ||
|
||||
|
|
@ -29,15 +27,18 @@ export async function middleware(request: NextRequest) {
|
|||
return NextResponse.next();
|
||||
}
|
||||
|
||||
// Check session
|
||||
const response = NextResponse.next();
|
||||
const session = await getIronSession<SessionData>(
|
||||
request,
|
||||
response,
|
||||
sessionOptions
|
||||
);
|
||||
const session = await getIronSession<SessionData>(request, response, sessionOptions);
|
||||
const generationSetting = await prisma.setting.findUnique({
|
||||
where: { key: "auth_session_generation" },
|
||||
});
|
||||
const currentGeneration = Number.parseInt(generationSetting?.value ?? "1", 10);
|
||||
|
||||
if (!session.isAuthenticated) {
|
||||
if (
|
||||
!session.isAuthenticated ||
|
||||
session.sessionGeneration !== currentGeneration
|
||||
) {
|
||||
session.destroy();
|
||||
return NextResponse.redirect(new URL("/login", request.url));
|
||||
}
|
||||
|
||||
227
src/services/authService.ts
Normal file
227
src/services/authService.ts
Normal file
|
|
@ -0,0 +1,227 @@
|
|||
import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
|
||||
import { prisma } from "@/lib/db";
|
||||
import {
|
||||
authorizePasswordReset,
|
||||
createSession,
|
||||
destroyPasswordResetAuthorization,
|
||||
getPasswordResetSession,
|
||||
} from "@/lib/auth";
|
||||
|
||||
const PASSWORD_HASH_KEY = "admin_password_hash";
|
||||
const RESET_TOKEN_KEY = "admin_password_reset";
|
||||
const SESSION_GENERATION_KEY = "auth_session_generation";
|
||||
const RESET_TOKEN_LIFETIME_MS = 15 * 60 * 1000;
|
||||
|
||||
interface ResetTokenRecord {
|
||||
digest: string;
|
||||
nonce: string;
|
||||
expiresAt: string;
|
||||
}
|
||||
|
||||
export type LoginResult =
|
||||
| { ok: true }
|
||||
| { ok: false; status: 401 | 423; error: string };
|
||||
|
||||
function getLockoutDuration(failedAttempts: number): number {
|
||||
if (failedAttempts >= 20) return 24 * 60 * 60 * 1000;
|
||||
if (failedAttempts >= 15) return 30 * 60 * 1000;
|
||||
if (failedAttempts >= 10) return 5 * 60 * 1000;
|
||||
if (failedAttempts >= 5) return 60 * 1000;
|
||||
return 0;
|
||||
}
|
||||
|
||||
function digestToken(token: string) {
|
||||
return createHash("sha256").update(token, "utf8").digest();
|
||||
}
|
||||
|
||||
function parseResetTokenRecord(value: string | undefined): ResetTokenRecord | null {
|
||||
if (!value) return null;
|
||||
|
||||
try {
|
||||
const parsed: unknown = JSON.parse(value);
|
||||
if (
|
||||
typeof parsed === "object" &&
|
||||
parsed !== null &&
|
||||
"digest" in parsed &&
|
||||
"nonce" in parsed &&
|
||||
"expiresAt" in parsed &&
|
||||
typeof parsed.digest === "string" &&
|
||||
typeof parsed.nonce === "string" &&
|
||||
typeof parsed.expiresAt === "string"
|
||||
) {
|
||||
return parsed as ResetTokenRecord;
|
||||
}
|
||||
} catch {
|
||||
// A malformed reset record is treated as invalid.
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
async function getSessionGeneration(): Promise<number> {
|
||||
const setting = await prisma.setting.findUnique({
|
||||
where: { key: SESSION_GENERATION_KEY },
|
||||
});
|
||||
const generation = Number.parseInt(setting?.value ?? "1", 10);
|
||||
return Number.isSafeInteger(generation) && generation > 0 ? generation : 1;
|
||||
}
|
||||
|
||||
async function getOrCreateSecurityRecord() {
|
||||
return prisma.authSecurity.upsert({
|
||||
where: { id: 1 },
|
||||
update: {},
|
||||
create: { id: 1 },
|
||||
});
|
||||
}
|
||||
|
||||
export async function login(password: string): Promise<LoginResult> {
|
||||
const security = await getOrCreateSecurityRecord();
|
||||
|
||||
if (security.lockedUntil && security.lockedUntil > new Date()) {
|
||||
const remainingMin = Math.ceil(
|
||||
(security.lockedUntil.getTime() - Date.now()) / 60_000
|
||||
);
|
||||
return {
|
||||
ok: false,
|
||||
status: 423,
|
||||
error: `Account locked. Try again in ${remainingMin} minute${remainingMin === 1 ? "" : "s"}.`,
|
||||
};
|
||||
}
|
||||
|
||||
const passwordSetting = await prisma.setting.findUnique({
|
||||
where: { key: PASSWORD_HASH_KEY },
|
||||
});
|
||||
const argon2 = await import("argon2");
|
||||
let isValid = false;
|
||||
|
||||
if (!passwordSetting) {
|
||||
await prisma.setting.create({
|
||||
data: { key: PASSWORD_HASH_KEY, value: await argon2.hash(password) },
|
||||
});
|
||||
isValid = true;
|
||||
} else {
|
||||
try {
|
||||
isValid = await argon2.verify(passwordSetting.value, password);
|
||||
} catch {
|
||||
isValid = false;
|
||||
}
|
||||
}
|
||||
|
||||
if (!isValid) {
|
||||
const failedAttempts = security.failedAttempts + 1;
|
||||
const lockoutMs = getLockoutDuration(failedAttempts);
|
||||
await prisma.authSecurity.update({
|
||||
where: { id: 1 },
|
||||
data: {
|
||||
failedAttempts,
|
||||
lockedUntil: lockoutMs ? new Date(Date.now() + lockoutMs) : null,
|
||||
lastAttemptAt: new Date(),
|
||||
},
|
||||
});
|
||||
return { ok: false, status: 401, error: "Invalid password" };
|
||||
}
|
||||
|
||||
await prisma.authSecurity.update({
|
||||
where: { id: 1 },
|
||||
data: { failedAttempts: 0, lockedUntil: null, lastAttemptAt: new Date() },
|
||||
});
|
||||
await createSession(await getSessionGeneration());
|
||||
return { ok: true };
|
||||
}
|
||||
|
||||
export async function requestPasswordReset(): Promise<boolean> {
|
||||
const passwordSetting = await prisma.setting.findUnique({
|
||||
where: { key: PASSWORD_HASH_KEY },
|
||||
});
|
||||
if (!passwordSetting) return false;
|
||||
|
||||
const token = randomBytes(24).toString("base64url");
|
||||
const expiresAt = new Date(Date.now() + RESET_TOKEN_LIFETIME_MS).toISOString();
|
||||
const record: ResetTokenRecord = {
|
||||
digest: digestToken(token).toString("hex"),
|
||||
nonce: randomUUID(),
|
||||
expiresAt,
|
||||
};
|
||||
|
||||
await prisma.setting.upsert({
|
||||
where: { key: RESET_TOKEN_KEY },
|
||||
update: { value: JSON.stringify(record) },
|
||||
create: { key: RESET_TOKEN_KEY, value: JSON.stringify(record) },
|
||||
});
|
||||
|
||||
console.info(`[password-reset] Token: ${token} (expires ${expiresAt})`);
|
||||
return true;
|
||||
}
|
||||
|
||||
export async function verifyPasswordResetToken(token: string): Promise<boolean> {
|
||||
const setting = await prisma.setting.findUnique({ where: { key: RESET_TOKEN_KEY } });
|
||||
const record = parseResetTokenRecord(setting?.value);
|
||||
if (!record || new Date(record.expiresAt).getTime() <= Date.now()) return false;
|
||||
|
||||
const submittedDigest = digestToken(token);
|
||||
const storedDigest = Buffer.from(record.digest, "hex");
|
||||
if (
|
||||
submittedDigest.length !== storedDigest.length ||
|
||||
!timingSafeEqual(submittedDigest, storedDigest)
|
||||
) {
|
||||
return false;
|
||||
}
|
||||
|
||||
await authorizePasswordReset(record.nonce, record.expiresAt);
|
||||
return true;
|
||||
}
|
||||
|
||||
export async function completePasswordReset(password: string): Promise<boolean> {
|
||||
const resetSession = await getPasswordResetSession();
|
||||
if (!resetSession.nonce || !resetSession.expiresAt) {
|
||||
await destroyPasswordResetAuthorization();
|
||||
return false;
|
||||
}
|
||||
|
||||
const argon2 = await import("argon2");
|
||||
const passwordHash = await argon2.hash(password);
|
||||
const completed = await prisma.$transaction(async (transaction) => {
|
||||
const setting = await transaction.setting.findUnique({
|
||||
where: { key: RESET_TOKEN_KEY },
|
||||
});
|
||||
const record = parseResetTokenRecord(setting?.value);
|
||||
if (
|
||||
!record ||
|
||||
resetSession.nonce !== record.nonce ||
|
||||
resetSession.expiresAt !== record.expiresAt ||
|
||||
new Date(record.expiresAt).getTime() <= Date.now()
|
||||
) {
|
||||
return false;
|
||||
}
|
||||
|
||||
const generationSetting = await transaction.setting.findUnique({
|
||||
where: { key: SESSION_GENERATION_KEY },
|
||||
});
|
||||
const parsedGeneration = Number.parseInt(generationSetting?.value ?? "1", 10);
|
||||
const currentGeneration =
|
||||
Number.isSafeInteger(parsedGeneration) && parsedGeneration > 0
|
||||
? parsedGeneration
|
||||
: 1;
|
||||
|
||||
await transaction.setting.upsert({
|
||||
where: { key: PASSWORD_HASH_KEY },
|
||||
update: { value: passwordHash },
|
||||
create: { key: PASSWORD_HASH_KEY, value: passwordHash },
|
||||
});
|
||||
await transaction.setting.upsert({
|
||||
where: { key: SESSION_GENERATION_KEY },
|
||||
update: { value: String(currentGeneration + 1) },
|
||||
create: { key: SESSION_GENERATION_KEY, value: String(currentGeneration + 1) },
|
||||
});
|
||||
await transaction.setting.delete({ where: { key: RESET_TOKEN_KEY } });
|
||||
await transaction.authSecurity.upsert({
|
||||
where: { id: 1 },
|
||||
update: { failedAttempts: 0, lockedUntil: null, lastAttemptAt: new Date() },
|
||||
create: { id: 1 },
|
||||
});
|
||||
return true;
|
||||
});
|
||||
|
||||
await destroyPasswordResetAuthorization();
|
||||
return completed;
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue