TCG Vault - Trading Card Game Collection Management with OCR Scanning
- New `lib/auth-secret.js` is the single source of truth for `JWT_SECRET`
and the canonical `JWT_TOKEN_TTL = '24h'`. Module throws at import time
if `process.env.JWT_SECRET` is unset — no silent fallback to the literal
`'your-secret-key-change-in-production'`.
- 7 callers refactored to import from the helper:
lib/permission-middleware.js
pages/api/auth-utils.js (also drops unused `'7d'` → JWT_TOKEN_TTL)
pages/api/auth/login.js (also routes via auth-utils.generateToken)
pages/api/auth/register.js (same)
pages/api/auth/verify.js (Brief 2 still owns the no-token admin branch)
pages/api/favorites.js
pages/api/users/search.js
- `process.env.JWT_SECRET` now appears exactly once in the JS source
(lib/auth-secret.js). `your-secret-key-change-in-production` is gone.
- TTL drift reconciled: auth-utils used `'7d'`, login/register used
inline `'24h'`. Both now route through imported `JWT_TOKEN_TTL` (24h).
Pre-deploy reminder: Vercel must have `JWT_SECRET` set before merge or
serverless functions refuse to boot. Existing tokens (signed against the
fallback literal) will be invalidated — users will need to log in again.
Resolves AGENTS.md gotcha #3. Brief 2/3/4/5 still pending in convoy.
Convoy: fix-auth-bypass / Brief 1
Co-authored-by: Cursor <cursoragent@cursor.com>
|
||
|---|---|---|
| .convoys | ||
| .cursor | ||
| .github | ||
| components | ||
| docs | ||
| lib | ||
| pages | ||
| public | ||
| scripts | ||
| styles | ||
| tests/smoke | ||
| .agent-context-manifest.yml | ||
| .gitignore | ||
| .npmrc | ||
| AGENTS.md | ||
| eslint.config.mjs | ||
| next.config.js | ||
| package-lock.json | ||
| package.json | ||
| postcss.config.js | ||
| README.md | ||
| tailwind.config.js | ||
| TESTING_GUIDE.md | ||
| vercel.json | ||
TCG Vault
A modern trading card game collection manager built with Next.js and Neon Database.
🚀 Features
- Card Management: Track your MTG, Pokémon, and Lorcana cards
- Collection Organization: Create and manage card collections
- Deck Building: Build and share decks
- Authentication: Secure user accounts with JWT
- Admin Panel: Manage cards and users
- Real-time Pricing: Track card values
🛠️ Tech Stack
- Frontend: Next.js 15, React 18, TypeScript
- Backend: Next.js API Routes
- Database: Neon PostgreSQL (serverless)
- Authentication: JWT with bcrypt
- Styling: Tailwind CSS
- Deployment: Vercel
📦 Installation
-
Clone the repository
git clone <repository-url> cd tcg-vault -
Install dependencies
npm install -
Set up environment variables
cp .env.example .env.localUpdate
.env.localwith your Neon database URL:POSTGRES_URL="postgresql://your-username:your-password@your-host/your-database" JWT_SECRET="your-super-secret-jwt-key" -
Set up the database
npm run setup-db -
Start development server
npm run dev
🗄️ Database Schema
The application uses the following tables:
users- User accounts and authenticationcards- Card information and metadatauser_cards- User's card collectionscollections- Named card collectionscollection_cards- Cards in collectionsdecks- Deck definitionsdeck_cards- Cards in decks
🔧 API Endpoints
Authentication
POST /api/auth/register- User registrationPOST /api/auth/login- User login
Admin
GET /api/admin- Admin panel data
Health Check
GET /api/health- Application health
🚀 Deployment
This app is configured for deployment on Vercel:
- Connect your repository to Vercel
- Set environment variables in Vercel dashboard
- Deploy automatically on push to main branch
📁 Project Structure
tcg-vault/
├── pages/ # Next.js pages and API routes
│ ├── api/ # API endpoints
│ │ ├── auth/ # Authentication routes
│ │ └── admin/ # Admin routes
│ ├── _app.js # App wrapper
│ └── index.js # Home page
├── lib/ # Utility libraries
│ └── database.js # Database adapter
├── scripts/ # Database setup scripts
├── public/ # Static assets
└── .env.local # Environment variables
🔐 Default Admin Account
After running the database setup:
- Email: admin@tcgvault.com
- Password: admin123
🤝 Contributing
- Fork the repository
- Create a feature branch
- Make your changes
- Submit a pull request
📄 License
MIT License - see LICENSE file for details