TCG Vault - Trading Card Game Collection Management with OCR Scanning
Adds rate limiting to /api/auth/login and /api/auth/register and removes
their wide-open CORS allowlist.
Rate limiting (@upstash/ratelimit + @upstash/redis):
- 5 attempts per 15-minute sliding window per IP, prefix "tcgvault:auth"
- new lib/rate-limit.js, lazy singleton, single source of truth
- reads KV_REST_API_URL / KV_REST_API_TOKEN (Vercel Upstash Marketplace
convention — auto-provisioned, no manual env-var setup needed)
- fail-closed in production if env vars are missing (better to error
one login than silently disable brute-force protection on live)
- fail-open in dev/test if env vars are missing (single console.warn)
- fail-open on Upstash backend outage (defense-in-depth — don't lock
the entire userbase out if Upstash is down)
- IP extracted from x-forwarded-for first hop, with socket fallback;
NOT req.body.email (rotates) or Authorization header (absent on
unauthenticated login)
CORS:
- Removed Access-Control-Allow-Origin: * + companion headers + OPTIONS
preflight from login.js and register.js
- These are first-party endpoints called from the same-origin SPA; the
"*" allowlist was a development convenience that shipped to prod
- verify.js is OUT OF SCOPE per architect's "cors-tighten" deferral
(see convoy plan § Architect's calls)
Other handler ordering preserved verbatim per brief: method gate first,
then rate-limit check (returns 429 with Retry-After header), then the
existing try/catch + body parsing + DB work.
Pre-merge requirements: KV_REST_API_URL + KV_REST_API_TOKEN must be set
in Vercel Production (already done — Upstash marketplace integration
auto-provisioned both, confirmed by maintainer 2026-05-23).
Convoy: fix-auth-bypass / Brief 4
Co-authored-by: Cursor <cursoragent@cursor.com>
|
||
|---|---|---|
| .convoys | ||
| .cursor | ||
| .github | ||
| components | ||
| docs | ||
| lib | ||
| pages | ||
| public | ||
| scripts | ||
| styles | ||
| tests/smoke | ||
| .agent-context-manifest.yml | ||
| .gitignore | ||
| .npmrc | ||
| AGENTS.md | ||
| eslint.config.mjs | ||
| next.config.js | ||
| package-lock.json | ||
| package.json | ||
| postcss.config.js | ||
| README.md | ||
| tailwind.config.js | ||
| TESTING_GUIDE.md | ||
| vercel.json | ||
TCG Vault
A modern trading card game collection manager built with Next.js and Neon Database.
🚀 Features
- Card Management: Track your MTG, Pokémon, and Lorcana cards
- Collection Organization: Create and manage card collections
- Deck Building: Build and share decks
- Authentication: Secure user accounts with JWT
- Admin Panel: Manage cards and users
- Real-time Pricing: Track card values
🛠️ Tech Stack
- Frontend: Next.js 15, React 18, TypeScript
- Backend: Next.js API Routes
- Database: Neon PostgreSQL (serverless)
- Authentication: JWT with bcrypt
- Styling: Tailwind CSS
- Deployment: Vercel
📦 Installation
-
Clone the repository
git clone <repository-url> cd tcg-vault -
Install dependencies
npm install -
Set up environment variables
cp .env.example .env.localUpdate
.env.localwith your Neon database URL:POSTGRES_URL="postgresql://your-username:your-password@your-host/your-database" JWT_SECRET="your-super-secret-jwt-key" -
Set up the database
npm run setup-db -
Start development server
npm run dev
🗄️ Database Schema
The application uses the following tables:
users- User accounts and authenticationcards- Card information and metadatauser_cards- User's card collectionscollections- Named card collectionscollection_cards- Cards in collectionsdecks- Deck definitionsdeck_cards- Cards in decks
🔧 API Endpoints
Authentication
POST /api/auth/register- User registrationPOST /api/auth/login- User login
Admin
GET /api/admin- Admin panel data
Health Check
GET /api/health- Application health
🚀 Deployment
This app is configured for deployment on Vercel:
- Connect your repository to Vercel
- Set environment variables in Vercel dashboard
- Deploy automatically on push to main branch
📁 Project Structure
tcg-vault/
├── pages/ # Next.js pages and API routes
│ ├── api/ # API endpoints
│ │ ├── auth/ # Authentication routes
│ │ └── admin/ # Admin routes
│ ├── _app.js # App wrapper
│ └── index.js # Home page
├── lib/ # Utility libraries
│ └── database.js # Database adapter
├── scripts/ # Database setup scripts
├── public/ # Static assets
└── .env.local # Environment variables
🔐 Default Admin Account
After running the database setup:
- Email: admin@tcgvault.com
- Password: admin123
🤝 Contributing
- Fork the repository
- Create a feature branch
- Make your changes
- Submit a pull request
📄 License
MIT License - see LICENSE file for details