Current state

src/app/api/auth/jwt/route.ts

@@ -0,0 +1,11 @@
+import { NextResponse } from "next/server"
+import { cookies } from "next/headers"
+
+export async function GET() {
+  const cookieStore = await cookies()
+  const token = cookieStore.get("session")?.value
+  if (!token) {
+    return NextResponse.json({ error: "No session" }, { status: 401 })
+  }
+  return NextResponse.json({ token })
+}

src/app/api/auth/login/route.ts

@@ -0,0 +1,120 @@
+import { NextRequest, NextResponse } from "next/server"
+import {
+  comparePassword,
+  getUserByEmail,
+  getUserByUsername,
+  mapDbUserToSessionUser,
+  recordLoginAttempt,
+  incrementFailedAttempts,
+  resetFailedAttempts,
+  isAccountLocked,
+  createSession,
+} from "@/lib/auth"
+
+export async function POST(request: NextRequest) {
+  try {
+    const { email, username, password } = await request.json()
+
+    const credential = email || username
+
+    if (!credential || !password) {
+      return NextResponse.json(
+        { error: "Email/Username and password are required." },
+        { status: 400 }
+      )
+    }
+
+    if (credential.trim().length === 0 || password.trim().length === 0) {
+      return NextResponse.json(
+        { error: "Credentials cannot be empty." },
+        { status: 400 }
+      )
+    }
+
+    const ipAddress =
+      request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
+      request.headers.get("x-real-ip") ||
+      "127.0.0.1"
+
+    const userAgent = request.headers.get("user-agent") || null
+
+    // Try to find user by email first, then by username
+    let dbUser =
+      email || credential.includes("@")
+        ? await getUserByEmail(credential)
+        : null
+
+    if (!dbUser) {
+      dbUser = await getUserByUsername(credential)
+    }
+
+    if (!dbUser) {
+      await recordLoginAttempt(
+        null,
+        credential,
+        ipAddress,
+        userAgent,
+        false,
+        "User not found"
+      )
+      return NextResponse.json(
+        { error: "Invalid email/username or password." },
+        { status: 401 }
+      )
+    }
+
+    const lockStatus = await isAccountLocked(dbUser)
+    if (lockStatus.locked) {
+      await recordLoginAttempt(
+        dbUser.id,
+        credential,
+        ipAddress,
+        userAgent,
+        false,
+        lockStatus.reason
+      )
+      return NextResponse.json(
+        { error: lockStatus.reason },
+        { status: 423 }
+      )
+    }
+
+    const valid = await comparePassword(password, dbUser.password_hash)
+    if (!valid) {
+      await incrementFailedAttempts(dbUser.id)
+      await recordLoginAttempt(
+        dbUser.id,
+        credential,
+        ipAddress,
+        userAgent,
+        false,
+        "Invalid password"
+      )
+      return NextResponse.json(
+        { error: "Invalid email/username or password." },
+        { status: 401 }
+      )
+    }
+
+    await resetFailedAttempts(dbUser.id)
+    await recordLoginAttempt(
+      dbUser.id,
+      credential,
+      ipAddress,
+      userAgent,
+      true
+    )
+
+    await createSession(dbUser.id, dbUser.role_name)
+
+    const user = mapDbUserToSessionUser(dbUser)
+
+    return NextResponse.json({ user }, { status: 200 })
+  } catch (error) {
+    console.error("Login error:", error)
+    return NextResponse.json(
+      { error: "Authentication service unavailable." },
+      { status: 503 }
+    )
+  }
+}

src/app/api/auth/logout/route.ts

@@ -0,0 +1,15 @@
+import { NextResponse } from "next/server"
+import { destroySession } from "@/lib/auth"
+
+export async function POST() {
+  try {
+    await destroySession()
+    return NextResponse.json({ success: true }, { status: 200 })
+  } catch (error) {
+    console.error("Logout error:", error)
+    return NextResponse.json(
+      { error: "Logout failed." },
+      { status: 500 }
+    )
+  }
+}

src/app/api/auth/me/route.ts

@@ -0,0 +1,18 @@
+import { NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+
+export async function GET() {
+  try {
+    const user = await getSessionUser()
+    if (!user) {
+      return NextResponse.json({ error: "Not authenticated." }, { status: 401 })
+    }
+    return NextResponse.json({ user }, { status: 200 })
+  } catch (error) {
+    console.error("Auth me error:", error)
+    return NextResponse.json(
+      { error: "Authentication service unavailable." },
+      { status: 503 }
+    )
+  }
+}

src/app/api/auth/recover/route.ts

@@ -0,0 +1,64 @@
+import { NextRequest, NextResponse } from "next/server"
+import {
+  getSessionUser,
+  decryptPassword,
+  setSessionContext,
+} from "@/lib/auth"
+import { query } from "@/lib/db"
+
+export async function POST(request: NextRequest) {
+  try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) {
+      return NextResponse.json({ error: "Not authenticated." }, { status: 401 })
+    }
+    if (sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Only SUPER_ADMIN can recover passwords." }, { status: 403 })
+    }
+
+    const { userId } = await request.json()
+    if (!userId) {
+      return NextResponse.json({ error: "userId is required." }, { status: 400 })
+    }
+
+    const ipAddress =
+      request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
+      request.headers.get("x-real-ip") ||
+      "127.0.0.1"
+
+    await setSessionContext(sessionUser.id, ipAddress)
+
+    const result = await query(
+      `SELECT id, username, email, first_name, last_name, password_encrypted
+       FROM users WHERE id = $1 AND deleted_at IS NULL`,
+      [userId]
+    )
+
+    const user = result.rows[0]
+    if (!user) {
+      return NextResponse.json({ error: "User not found." }, { status: 404 })
+    }
+
+    if (!user.password_encrypted) {
+      return NextResponse.json({ error: "No encrypted password stored for this user." }, { status: 404 })
+    }
+
+    const plaintextPassword = await decryptPassword(user.password_encrypted)
+    if (!plaintextPassword) {
+      return NextResponse.json({ error: "Failed to decrypt password. Master key may have changed." }, { status: 500 })
+    }
+
+    return NextResponse.json({
+      user: {
+        id: user.id,
+        username: user.username,
+        email: user.email,
+        name: `${user.first_name} ${user.last_name}`,
+      },
+      password: plaintextPassword,
+    }, { status: 200 })
+  } catch (error) {
+    console.error("Password recovery error:", error)
+    return NextResponse.json({ error: "Recovery service unavailable." }, { status: 503 })
+  }
+}