TCG Vault - Trading Card Game Collection Management with OCR Scanning
Find a file
Randall Stillwell 258e479dc5 fix(auth): remove synthetic-admin bypass (Brief 2 of fix-auth-bypass)
Closes AGENTS.md gotcha #2: getUserFromRequest no longer returns a
hardcoded { userId: 1, email: 'admin@tcgvault.com', role: 'admin' }
when the Authorization header is missing or malformed.

lib/permission-middleware.js
  - getUserFromRequest now returns null for missing/malformed Bearer
    headers. No console.warn, no NODE_ENV gate — the fallback is gone,
    period.
  - Token-verify path and DB lookup unchanged.

pages/api/auth/verify.js
  - No-token branch now returns 401 instead of fetching the seed admin
    via `WHERE email = 'admin@tcgvault.com'`. Closes the admin-record-
    leak side of the same bypass.
  - JWT-verify branch unchanged.

Known follow-up (flagged but NOT addressed in this PR):
  pages/api/collections/[identifier]/cards.js POST/PUT/DELETE handlers
  dereference user.userId without a null guard. Previously masked by
  the synthetic admin (anonymous-write-as-admin on collections owned
  by user 1 was the security hole). Now degrades to NPE → 500 instead
  of a clean 401. Security is improved either way; cosmetic 500-vs-401
  fix lives in a separate one-line follow-up PR.

Convoy: fix-auth-bypass / Brief 2
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-23 10:57:23 -05:00
.convoys convoy(bump-next-js): plan + brief 1 (Decisions A-D) 2026-05-23 02:31:26 -05:00
.cursor bootstrap: agent pipeline v0.5.0 + ship-readiness review 2026-05-23 02:31:26 -05:00
.github fix(api): delete dev endpoints + CI guard (Brief 3 of fix-auth-bypass) 2026-05-23 10:40:44 -05:00
components 🚀 Implement Mobile-First Navigation System 2025-08-01 18:18:21 -05:00
docs bootstrap: agent pipeline v0.5.0 + ship-readiness review 2026-05-23 02:31:26 -05:00
lib fix(auth): remove synthetic-admin bypass (Brief 2 of fix-auth-bypass) 2026-05-23 10:57:23 -05:00
pages fix(auth): remove synthetic-admin bypass (Brief 2 of fix-auth-bypass) 2026-05-23 10:57:23 -05:00
public Major redesign: Enhanced card display with particle effects, improved filters, and search functionality 2025-07-23 21:26:54 -05:00
scripts bootstrap: agent pipeline v0.5.0 + ship-readiness review 2026-05-23 02:31:26 -05:00
styles 🚀 Implement Mobile-First Navigation System 2025-08-01 18:18:21 -05:00
tests/smoke bootstrap: agent pipeline v0.5.0 + ship-readiness review 2026-05-23 02:31:26 -05:00
.agent-context-manifest.yml bootstrap: agent pipeline v0.5.0 + ship-readiness review 2026-05-23 02:31:26 -05:00
.gitignore bootstrap: agent pipeline v0.5.0 + ship-readiness review 2026-05-23 02:31:26 -05:00
.npmrc Fix build compatibility issues 2025-07-22 10:32:15 -05:00
AGENTS.md docs(AGENTS): reflect bump-next-js outcome (Next 16, ESLint v9, typescript devDep) 2026-05-23 09:36:44 -05:00
eslint.config.mjs bump: next 15.4.3 -> 16.2.6, ESLint flat config (v9 fallback), typescript devDep 2026-05-23 02:31:26 -05:00
next.config.js bump: next 15.4.3 -> 16.2.6, ESLint flat config (v9 fallback), typescript devDep 2026-05-23 02:31:26 -05:00
package-lock.json bump: next 15.4.3 -> 16.2.6, ESLint flat config (v9 fallback), typescript devDep 2026-05-23 02:31:26 -05:00
package.json bump: next 15.4.3 -> 16.2.6, ESLint flat config (v9 fallback), typescript devDep 2026-05-23 02:31:26 -05:00
postcss.config.js Major redesign: Enhanced card display with particle effects, improved filters, and search functionality 2025-07-23 21:26:54 -05:00
README.md fix(api): delete dev endpoints + CI guard (Brief 3 of fix-auth-bypass) 2026-05-23 10:40:44 -05:00
tailwind.config.js Ultra-Smooth Hover System with Expanding Actions 2025-07-26 09:00:26 -05:00
TESTING_GUIDE.md 🎨 Restructured Layout System 2025-07-25 11:28:04 -05:00
vercel.json Simplify Vercel config to resolve API routing issues 2025-07-23 09:22:14 -05:00

TCG Vault

A modern trading card game collection manager built with Next.js and Neon Database.

🚀 Features

  • Card Management: Track your MTG, Pokémon, and Lorcana cards
  • Collection Organization: Create and manage card collections
  • Deck Building: Build and share decks
  • Authentication: Secure user accounts with JWT
  • Admin Panel: Manage cards and users
  • Real-time Pricing: Track card values

🛠️ Tech Stack

  • Frontend: Next.js 15, React 18, TypeScript
  • Backend: Next.js API Routes
  • Database: Neon PostgreSQL (serverless)
  • Authentication: JWT with bcrypt
  • Styling: Tailwind CSS
  • Deployment: Vercel

📦 Installation

  1. Clone the repository

    git clone <repository-url>
    cd tcg-vault
    
  2. Install dependencies

    npm install
    
  3. Set up environment variables

    cp .env.example .env.local
    

    Update .env.local with your Neon database URL:

    POSTGRES_URL="postgresql://your-username:your-password@your-host/your-database"
    JWT_SECRET="your-super-secret-jwt-key"
    
  4. Set up the database

    npm run setup-db
    
  5. Start development server

    npm run dev
    

🗄️ Database Schema

The application uses the following tables:

  • users - User accounts and authentication
  • cards - Card information and metadata
  • user_cards - User's card collections
  • collections - Named card collections
  • collection_cards - Cards in collections
  • decks - Deck definitions
  • deck_cards - Cards in decks

🔧 API Endpoints

Authentication

  • POST /api/auth/register - User registration
  • POST /api/auth/login - User login

Admin

  • GET /api/admin - Admin panel data

Health Check

  • GET /api/health - Application health

🚀 Deployment

This app is configured for deployment on Vercel:

  1. Connect your repository to Vercel
  2. Set environment variables in Vercel dashboard
  3. Deploy automatically on push to main branch

📁 Project Structure

tcg-vault/
├── pages/                 # Next.js pages and API routes
│   ├── api/              # API endpoints
│   │   ├── auth/         # Authentication routes
│   │   └── admin/        # Admin routes
│   ├── _app.js           # App wrapper
│   └── index.js          # Home page
├── lib/                  # Utility libraries
│   └── database.js       # Database adapter
├── scripts/              # Database setup scripts
├── public/               # Static assets
└── .env.local           # Environment variables

🔐 Default Admin Account

After running the database setup:

🤝 Contributing

  1. Fork the repository
  2. Create a feature branch
  3. Make your changes
  4. Submit a pull request

📄 License

MIT License - see LICENSE file for details