MVP

src/app/api/auth/google/route.ts

@@ -0,0 +1,90 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+export async function GET(request: NextRequest) {
+  const { searchParams } = new URL(request.url);
+  const code = searchParams.get('code');
+
+  // If no code, redirect to Google OAuth
+  if (!code) {
+    const googleClientId = process.env.GOOGLE_CLIENT_ID;
+
+    if (!googleClientId) {
+      return NextResponse.json(
+        { error: 'Google Client ID not configured' },
+        { status: 500 }
+      );
+    }
+
+    const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/google`;
+    const scope = 'openid email profile';
+
+    const googleAuthUrl = `https://accounts.google.com/o/oauth2/v2/auth?client_id=${googleClientId}&redirect_uri=${redirectUri}&response_type=code&scope=${scope}`;
+
+    return NextResponse.redirect(googleAuthUrl);
+  }
+
+  // Handle callback with code
+  try {
+    const googleClientId = process.env.GOOGLE_CLIENT_ID;
+    const googleClientSecret = process.env.GOOGLE_CLIENT_SECRET;
+
+    if (!googleClientId || !googleClientSecret) {
+      return NextResponse.json(
+        { error: 'Google OAuth not configured' },
+        { status: 500 }
+      );
+    }
+
+    const redirectUri = `${process.env.NEXT_PUBLIC_APP_URL}/api/auth/google`;
+
+    // Exchange code for tokens
+    const tokenResponse = await fetch('https://oauth2.googleapis.com/token', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+      },
+      body: new URLSearchParams({
+        code,
+        client_id: googleClientId,
+        client_secret: googleClientSecret,
+        redirect_uri: redirectUri,
+        grant_type: 'authorization_code',
+      }),
+    });
+
+    if (!tokenResponse.ok) {
+      throw new Error('Failed to exchange code for tokens');
+    }
+
+    const tokens = await tokenResponse.json();
+
+    // Get user info from Google
+    const userInfoResponse = await fetch('https://www.googleapis.com/oauth2/v2/userinfo', {
+      headers: {
+        Authorization: `Bearer ${tokens.access_token}`,
+      },
+    });
+
+    if (!userInfoResponse.ok) {
+      throw new Error('Failed to get user info');
+    }
+
+    const userInfo = await userInfoResponse.json();
+
+    // Here you would:
+    // 1. Check if user exists in database
+    // 2. Create user if they don't exist
+    // 3. Create session cookie
+    // 4. Redirect to dashboard
+
+    // For now, just redirect to login with error message
+    return NextResponse.redirect(
+      `${process.env.NEXT_PUBLIC_APP_URL}/login?error=google-not-fully-configured`
+    );
+  } catch (error) {
+    console.error('Google OAuth error:', error);
+    return NextResponse.redirect(
+      `${process.env.NEXT_PUBLIC_APP_URL}/login?error=google-signin-failed`
+    );
+  }
+}

src/app/api/auth/signup/route.ts

@@ -1,7 +1,11 @@
 import { NextRequest, NextResponse } from 'next/server';
 import bcrypt from 'bcryptjs';
+import { cookies } from 'next/headers';
 import { db } from '@/lib/db';
 import { z } from 'zod';
+import { csrfProtection } from '@/lib/csrf';
+import { rateLimit, getClientIdentifier, RateLimits } from '@/lib/rateLimit';
+import { getAuthCookieOptions } from '@/lib/cookieConfig';
 
 const signupSchema = z.object({
   name: z.string().min(2),
@@ -11,6 +15,36 @@ const signupSchema = z.object({
 
 export async function POST(request: NextRequest) {
   try {
+    // CSRF Protection
+    const csrfCheck = csrfProtection(request);
+    if (!csrfCheck.valid) {
+      return NextResponse.json(
+        { error: csrfCheck.error },
+        { status: 403 }
+      );
+    }
+
+    // Rate Limiting
+    const clientId = getClientIdentifier(request);
+    const rateLimitResult = rateLimit(clientId, RateLimits.SIGNUP);
+
+    if (!rateLimitResult.success) {
+      return NextResponse.json(
+        {
+          error: 'Too many signup attempts. Please try again later.',
+          retryAfter: Math.ceil((rateLimitResult.reset - Date.now()) / 1000)
+        },
+        {
+          status: 429,
+          headers: {
+            'X-RateLimit-Limit': rateLimitResult.limit.toString(),
+            'X-RateLimit-Remaining': rateLimitResult.remaining.toString(),
+            'X-RateLimit-Reset': rateLimitResult.reset.toString(),
+          }
+        }
+      );
+    }
+
     const body = await request.json();
     const { name, email, password } = signupSchema.parse(body);
 
@@ -38,10 +72,16 @@ export async function POST(request: NextRequest) {
       },
     });
 
+    // Set cookie for auto-login after signup
+    cookies().set('userId', user.id, getAuthCookieOptions());
+
     return NextResponse.json({
-      id: user.id,
-      name: user.name,
-      email: user.email,
+      success: true,
+      user: {
+        id: user.id,
+        name: user.name,
+        email: user.email,
+      },
     });
   } catch (error) {
     if (error instanceof z.ZodError) {

src/app/api/auth/simple-login/route.ts

@@ -2,9 +2,42 @@ import { NextRequest, NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import bcrypt from 'bcryptjs';
 import { cookies } from 'next/headers';
+import { csrfProtection } from '@/lib/csrf';
+import { rateLimit, getClientIdentifier, RateLimits } from '@/lib/rateLimit';
+import { getAuthCookieOptions } from '@/lib/cookieConfig';
 
 export async function POST(request: NextRequest) {
   try {
+    // CSRF Protection
+    const csrfCheck = csrfProtection(request);
+    if (!csrfCheck.valid) {
+      return NextResponse.json(
+        { error: csrfCheck.error },
+        { status: 403 }
+      );
+    }
+
+    // Rate Limiting
+    const clientId = getClientIdentifier(request);
+    const rateLimitResult = rateLimit(clientId, RateLimits.LOGIN);
+
+    if (!rateLimitResult.success) {
+      return NextResponse.json(
+        {
+          error: 'Too many login attempts. Please try again later.',
+          retryAfter: Math.ceil((rateLimitResult.reset - Date.now()) / 1000)
+        },
+        {
+          status: 429,
+          headers: {
+            'X-RateLimit-Limit': rateLimitResult.limit.toString(),
+            'X-RateLimit-Remaining': rateLimitResult.remaining.toString(),
+            'X-RateLimit-Reset': rateLimitResult.reset.toString(),
+          }
+        }
+      );
+    }
+
     const { email, password } = await request.json();
 
     // Find user
@@ -13,45 +46,28 @@ export async function POST(request: NextRequest) {
     });
 
     if (!user) {
-      // Create user if doesn't exist (for demo)
-      const hashedPassword = await bcrypt.hash(password, 12);
-      const newUser = await db.user.create({
-        data: {
-          email,
-          name: email.split('@')[0],
-          password: hashedPassword,
-        },
-      });
-
-      // Set cookie
-      cookies().set('userId', newUser.id, {
-        httpOnly: true,
-        secure: false,
-        sameSite: 'lax',
-        maxAge: 60 * 60 * 24 * 7, // 7 days
-      });
-
-      return NextResponse.json({ 
-        success: true, 
-        user: { id: newUser.id, email: newUser.email, name: newUser.name } 
-      });
+      return NextResponse.json(
+        { error: 'Invalid email or password' },
+        { status: 401 }
+      );
     }
 
-    // For demo/development: Accept any password for existing users
-    // In production, you would check: const isValid = await bcrypt.compare(password, user.password || '');
-    const isValid = true; // DEMO MODE - accepts any password
+    // Verify password
+    const isValid = await bcrypt.compare(password, user.password || '');
+
+    if (!isValid) {
+      return NextResponse.json(
+        { error: 'Invalid email or password' },
+        { status: 401 }
+      );
+    }
 
     // Set cookie
-    cookies().set('userId', user.id, {
-      httpOnly: true,
-      secure: false,
-      sameSite: 'lax',
-      maxAge: 60 * 60 * 24 * 7, // 7 days
-    });
+    cookies().set('userId', user.id, getAuthCookieOptions());
 
-    return NextResponse.json({ 
-      success: true, 
-      user: { id: user.id, email: user.email, name: user.name } 
+    return NextResponse.json({
+      success: true,
+      user: { id: user.id, email: user.email, name: user.name }
     });
   } catch (error) {
     console.error('Login error:', error);