deckhearth/pages/login.js

import { useState } from 'react';
import { useRouter } from 'next/router';
import Link from 'next/link';
import AuthLayout from '../components/AuthLayout';
import AnimatedFireLogo from '../components/AnimatedFireLogo';
import { Button, Input } from '../components/ui';
import { VOCAB } from '../lib/collection-vocabulary.js';

export function isSafeAppReturnUrl(returnUrl, origin = '') {
  if (typeof returnUrl !== 'string') return false;
  if (!returnUrl.startsWith('/') || returnUrl.startsWith('//')) return false;
  if (!origin) return false;

  try {
    const resolved = new URL(returnUrl, origin);
    return resolved.origin === origin;
  } catch {
    return false;
  }
}

export default function Login() {
  const router = useRouter();
  const [formData, setFormData] = useState({
    email: '',
    password: ''
  });
  const [loading, setLoading] = useState(false);
  const [error, setError] = useState('');

  const handleInputChange = (field, value) => {
    setFormData(prev => ({
      ...prev,
      [field]: value
    }));
    // Clear error when user starts typing
    if (error) setError('');
  };

  const handleSubmit = async (e) => {
    e.preventDefault();
    setLoading(true);
    setError('');

    try {
      const response = await fetch('/api/auth/login', {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
        },
        body: JSON.stringify(formData)
      });

      const data = await response.json();

      if (response.ok) {
        // Store the JWT token in localStorage
        localStorage.setItem('auth_token', data.token);

        const returnUrl =
          typeof router.query.returnUrl === 'string' ? router.query.returnUrl : null;
        const origin = typeof window !== 'undefined' ? window.location.origin : '';
        if (isSafeAppReturnUrl(returnUrl, origin)) {
          router.push(returnUrl);
          return;
        }

        // Redirect to admin panel or dashboard
        if (data.user.role === 'admin') {
          router.push('/admin/card-editor');
        } else {
          router.push('/dashboard');
        }
      } else {
        setError(data.error || 'Login failed');
      }
    } catch (error) {
      console.error('Login error:', error);
      setError('Network error. Please try again.');
    } finally {
      setLoading(false);
    }
  };

  return (
    <AuthLayout>
      <div className="min-h-screen flex items-center justify-center py-12 px-4 sm:px-6 lg:px-8">
        <div className="max-w-md w-full space-y-8">
          <div>
            <div className="text-center">
              <div className="mb-6 flex justify-center">
                <AnimatedFireLogo size={100} />
              </div>
              <h2 className="text-3xl font-bold gradient-text-flame mb-2">
                Welcome to Deck Hearth
              </h2>
              <p className="mt-2 text-sm" style={{ color: 'var(--text-secondary)' }}>
                Sign in to access {VOCAB.MY_COLLECTION}
              </p>
            </div>
          </div>

          <div className="glass-panel-strong rounded-2xl p-8">
            <form onSubmit={handleSubmit} className="space-y-6">
              {error && (
                <div className="p-4 rounded-lg bg-red-500 bg-opacity-10 border border-red-500 border-opacity-20 backdrop-blur-sm">
                  <p className="text-red-400 text-sm">{error}</p>
                </div>
              )}

              <Input
                id="email"
                name="email"
                type="email"
                label="Email Address"
                autoComplete="email"
                required
                value={formData.email}
                onChange={(e) => handleInputChange('email', e.target.value)}
                placeholder="Enter your email"
              />

              <Input
                id="password"
                name="password"
                type="password"
                label="Password"
                autoComplete="current-password"
                required
                value={formData.password}
                onChange={(e) => handleInputChange('password', e.target.value)}
                placeholder="Enter your password"
              />

              <Button
                type="submit"
                variant="primary"
                size="lg"
                loading={loading}
                className="w-full"
              >
                {loading ? 'Signing in...' : 'Sign in to Deck Hearth'}
              </Button>

              <div className="text-center">
                <p className="text-sm" style={{ color: 'var(--text-secondary)' }}>
                  Don&apos;t have an account?{' '}
                  <Link href="/signup" className="font-medium gradient-text-flame hover:underline">
                    Sign up here
                  </Link>
                </p>
              </div>
            </form>
          </div>
        </div>
      </div>
    </AuthLayout>
  );
}