TCG Vault - Trading Card Game Collection Management with OCR Scanning
Find a file
Randall Stillwell 6dae7adc77 fix(auth): tighten public auth surface — CORS + rate limit (Brief 4 of fix-auth-bypass)
Adds rate limiting to /api/auth/login and /api/auth/register and removes
their wide-open CORS allowlist.

Rate limiting (@upstash/ratelimit + @upstash/redis):
  - 5 attempts per 15-minute sliding window per IP, prefix "tcgvault:auth"
  - new lib/rate-limit.js, lazy singleton, single source of truth
  - reads KV_REST_API_URL / KV_REST_API_TOKEN (Vercel Upstash Marketplace
    convention — auto-provisioned, no manual env-var setup needed)
  - fail-closed in production if env vars are missing (better to error
    one login than silently disable brute-force protection on live)
  - fail-open in dev/test if env vars are missing (single console.warn)
  - fail-open on Upstash backend outage (defense-in-depth — don't lock
    the entire userbase out if Upstash is down)
  - IP extracted from x-forwarded-for first hop, with socket fallback;
    NOT req.body.email (rotates) or Authorization header (absent on
    unauthenticated login)

CORS:
  - Removed Access-Control-Allow-Origin: * + companion headers + OPTIONS
    preflight from login.js and register.js
  - These are first-party endpoints called from the same-origin SPA; the
    "*" allowlist was a development convenience that shipped to prod
  - verify.js is OUT OF SCOPE per architect's "cors-tighten" deferral
    (see convoy plan § Architect's calls)

Other handler ordering preserved verbatim per brief: method gate first,
then rate-limit check (returns 429 with Retry-After header), then the
existing try/catch + body parsing + DB work.

Pre-merge requirements: KV_REST_API_URL + KV_REST_API_TOKEN must be set
in Vercel Production (already done — Upstash marketplace integration
auto-provisioned both, confirmed by maintainer 2026-05-23).

Convoy: fix-auth-bypass / Brief 4
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-23 10:51:33 -05:00
.convoys convoy(bump-next-js): plan + brief 1 (Decisions A-D) 2026-05-23 02:31:26 -05:00
.cursor bootstrap: agent pipeline v0.5.0 + ship-readiness review 2026-05-23 02:31:26 -05:00
.github fix(api): delete dev endpoints + CI guard (Brief 3 of fix-auth-bypass) 2026-05-23 10:40:44 -05:00
components 🚀 Implement Mobile-First Navigation System 2025-08-01 18:18:21 -05:00
docs bootstrap: agent pipeline v0.5.0 + ship-readiness review 2026-05-23 02:31:26 -05:00
lib fix(auth): tighten public auth surface — CORS + rate limit (Brief 4 of fix-auth-bypass) 2026-05-23 10:51:33 -05:00
pages fix(auth): tighten public auth surface — CORS + rate limit (Brief 4 of fix-auth-bypass) 2026-05-23 10:51:33 -05:00
public Major redesign: Enhanced card display with particle effects, improved filters, and search functionality 2025-07-23 21:26:54 -05:00
scripts bootstrap: agent pipeline v0.5.0 + ship-readiness review 2026-05-23 02:31:26 -05:00
styles 🚀 Implement Mobile-First Navigation System 2025-08-01 18:18:21 -05:00
tests/smoke bootstrap: agent pipeline v0.5.0 + ship-readiness review 2026-05-23 02:31:26 -05:00
.agent-context-manifest.yml bootstrap: agent pipeline v0.5.0 + ship-readiness review 2026-05-23 02:31:26 -05:00
.gitignore bootstrap: agent pipeline v0.5.0 + ship-readiness review 2026-05-23 02:31:26 -05:00
.npmrc Fix build compatibility issues 2025-07-22 10:32:15 -05:00
AGENTS.md docs(AGENTS): reflect bump-next-js outcome (Next 16, ESLint v9, typescript devDep) 2026-05-23 09:36:44 -05:00
eslint.config.mjs bump: next 15.4.3 -> 16.2.6, ESLint flat config (v9 fallback), typescript devDep 2026-05-23 02:31:26 -05:00
next.config.js bump: next 15.4.3 -> 16.2.6, ESLint flat config (v9 fallback), typescript devDep 2026-05-23 02:31:26 -05:00
package-lock.json fix(auth): tighten public auth surface — CORS + rate limit (Brief 4 of fix-auth-bypass) 2026-05-23 10:51:33 -05:00
package.json fix(auth): tighten public auth surface — CORS + rate limit (Brief 4 of fix-auth-bypass) 2026-05-23 10:51:33 -05:00
postcss.config.js Major redesign: Enhanced card display with particle effects, improved filters, and search functionality 2025-07-23 21:26:54 -05:00
README.md fix(api): delete dev endpoints + CI guard (Brief 3 of fix-auth-bypass) 2026-05-23 10:40:44 -05:00
tailwind.config.js Ultra-Smooth Hover System with Expanding Actions 2025-07-26 09:00:26 -05:00
TESTING_GUIDE.md 🎨 Restructured Layout System 2025-07-25 11:28:04 -05:00
vercel.json Simplify Vercel config to resolve API routing issues 2025-07-23 09:22:14 -05:00

TCG Vault

A modern trading card game collection manager built with Next.js and Neon Database.

🚀 Features

  • Card Management: Track your MTG, Pokémon, and Lorcana cards
  • Collection Organization: Create and manage card collections
  • Deck Building: Build and share decks
  • Authentication: Secure user accounts with JWT
  • Admin Panel: Manage cards and users
  • Real-time Pricing: Track card values

🛠️ Tech Stack

  • Frontend: Next.js 15, React 18, TypeScript
  • Backend: Next.js API Routes
  • Database: Neon PostgreSQL (serverless)
  • Authentication: JWT with bcrypt
  • Styling: Tailwind CSS
  • Deployment: Vercel

📦 Installation

  1. Clone the repository

    git clone <repository-url>
    cd tcg-vault
    
  2. Install dependencies

    npm install
    
  3. Set up environment variables

    cp .env.example .env.local
    

    Update .env.local with your Neon database URL:

    POSTGRES_URL="postgresql://your-username:your-password@your-host/your-database"
    JWT_SECRET="your-super-secret-jwt-key"
    
  4. Set up the database

    npm run setup-db
    
  5. Start development server

    npm run dev
    

🗄️ Database Schema

The application uses the following tables:

  • users - User accounts and authentication
  • cards - Card information and metadata
  • user_cards - User's card collections
  • collections - Named card collections
  • collection_cards - Cards in collections
  • decks - Deck definitions
  • deck_cards - Cards in decks

🔧 API Endpoints

Authentication

  • POST /api/auth/register - User registration
  • POST /api/auth/login - User login

Admin

  • GET /api/admin - Admin panel data

Health Check

  • GET /api/health - Application health

🚀 Deployment

This app is configured for deployment on Vercel:

  1. Connect your repository to Vercel
  2. Set environment variables in Vercel dashboard
  3. Deploy automatically on push to main branch

📁 Project Structure

tcg-vault/
├── pages/                 # Next.js pages and API routes
│   ├── api/              # API endpoints
│   │   ├── auth/         # Authentication routes
│   │   └── admin/        # Admin routes
│   ├── _app.js           # App wrapper
│   └── index.js          # Home page
├── lib/                  # Utility libraries
│   └── database.js       # Database adapter
├── scripts/              # Database setup scripts
├── public/               # Static assets
└── .env.local           # Environment variables

🔐 Default Admin Account

After running the database setup:

🤝 Contributing

  1. Fork the repository
  2. Create a feature branch
  3. Make your changes
  4. Submit a pull request

📄 License

MIT License - see LICENSE file for details