5d72277355
- New `lib/auth-secret.js` is the single source of truth for `JWT_SECRET`
and the canonical `JWT_TOKEN_TTL = '24h'`. Module throws at import time
if `process.env.JWT_SECRET` is unset — no silent fallback to the literal
`'your-secret-key-change-in-production'`.
- 7 callers refactored to import from the helper:
lib/permission-middleware.js
pages/api/auth-utils.js (also drops unused `'7d'` → JWT_TOKEN_TTL)
pages/api/auth/login.js (also routes via auth-utils.generateToken)
pages/api/auth/register.js (same)
pages/api/auth/verify.js (Brief 2 still owns the no-token admin branch)
pages/api/favorites.js
pages/api/users/search.js
- `process.env.JWT_SECRET` now appears exactly once in the JS source
(lib/auth-secret.js). `your-secret-key-change-in-production` is gone.
- TTL drift reconciled: auth-utils used `'7d'`, login/register used
inline `'24h'`. Both now route through imported `JWT_TOKEN_TTL` (24h).
Pre-deploy reminder: Vercel must have `JWT_SECRET` set before merge or
serverless functions refuse to boot. Existing tokens (signed against the
fallback literal) will be invalidated — users will need to log in again.
Resolves AGENTS.md gotcha #3. Brief 2/3/4/5 still pending in convoy.
Convoy: fix-auth-bypass / Brief 1
Co-authored-by: Cursor <cursoragent@cursor.com>
68 lines
No EOL
1.9 KiB
JavaScript
68 lines
No EOL
1.9 KiB
JavaScript
import { sql } from '@vercel/postgres';
|
|
import jwt from 'jsonwebtoken';
|
|
import { JWT_SECRET } from '../../../lib/auth-secret.js';
|
|
|
|
export default async function handler(req, res) {
|
|
// Set CORS headers
|
|
res.setHeader('Access-Control-Allow-Origin', '*');
|
|
res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
|
|
res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
|
|
|
|
// Handle preflight requests
|
|
if (req.method === 'OPTIONS') {
|
|
res.status(200).end();
|
|
return;
|
|
}
|
|
|
|
if (req.method !== 'GET') {
|
|
return res.status(405).json({ error: 'Method not allowed' });
|
|
}
|
|
|
|
try {
|
|
const authHeader = req.headers.authorization;
|
|
|
|
if (!authHeader || !authHeader.startsWith('Bearer ')) {
|
|
// For development, return admin user if no token provided
|
|
// In production, this should return 401
|
|
const result = await sql`
|
|
SELECT id, email, role, created_at
|
|
FROM users
|
|
WHERE email = 'admin@tcgvault.com'
|
|
`;
|
|
|
|
if (result.rows.length > 0) {
|
|
return res.status(200).json(result.rows[0]);
|
|
} else {
|
|
return res.status(401).json({ error: 'No admin user found' });
|
|
}
|
|
}
|
|
|
|
const token = authHeader.substring(7);
|
|
|
|
try {
|
|
const decoded = jwt.verify(token, JWT_SECRET);
|
|
|
|
// Get user data from database
|
|
const result = await sql`
|
|
SELECT id, email, role, created_at
|
|
FROM users
|
|
WHERE id = ${decoded.userId}
|
|
`;
|
|
|
|
if (result.rows.length === 0) {
|
|
return res.status(401).json({ error: 'User not found' });
|
|
}
|
|
|
|
const user = result.rows[0];
|
|
res.status(200).json(user);
|
|
|
|
} catch (jwtError) {
|
|
console.error('JWT verification error:', jwtError);
|
|
return res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
|
|
} catch (error) {
|
|
console.error('Auth verification error:', error);
|
|
res.status(500).json({ error: 'Internal server error' });
|
|
}
|
|
}
|