setia/ims
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): phase 3 — replace Supabase GoTrue with bcryptjs+jose

Browse Source 
Custom auth stack: bcryptjs password hashing (cost 10, GoTrue-compatible),
jose JWT session cookies (edge-safe, 8hr TTL), new API routes for
login/logout/reset/change-password, middleware rewritten to JWT-only
verification with no DB access. All 38 protected pages and API routes
migrated from supabase.auth.getUser() to getSession(). Supabase .from()
queries retained for Phase 4. lib/db/index.ts refactored to lazy Proxy
singleton to avoid module-level throw during Next.js build.

tsc: clean, build: clean, tests: 4/4 passed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
admin
2026-07-23 16:20:04 +08:00
co-authored by Claude Sonnet 4.6
parent a95273b182
commit d18d29168a
67 changed files with 966 additions and 591 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/incidents/[id]/addenda/route.ts
+13 -17
View File
@@ -2,21 +2,20 @@ export const dynamic = 'force-dynamic'
import { NextRequest, NextResponse } from 'next/server'
import { createClient } from '@/lib/supabase/server'
import { getSession } from '@/lib/auth/get-session'
export async function GET(
_request: NextRequest,
{ params }: { params: Promise<{ id: string }> }
) {
const { id } = await params
const supabase = await createClient()
const { data: { user }, error: authError } = await supabase.auth.getUser()
if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
if (!profile || !['hse', 'admin', 'supervisor'].includes(profile.role))
const session = await getSession()
if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
if (!['hse', 'admin', 'supervisor'].includes(session.role))
return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
const supabase = await createClient()
const { data, error } = await supabase
.from('incident_addenda')
.select('id, body, created_at, author:users!author (name)')
@@ -32,16 +31,13 @@ export async function POST(
{ params }: { params: Promise<{ id: string }> }
) {
const { id } = await params
const supabase = await createClient()
const { data: { user }, error: authError } = await supabase.auth.getUser()
if (authError || !user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
const { data: profile } = await supabase
.from('users').select('role').eq('id', user.id).single()
if (!profile || !['hse', 'admin', 'supervisor'].includes(profile.role))
const session = await getSession()
if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
if (!['hse', 'admin', 'supervisor'].includes(session.role))
return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
const supabase = await createClient()
const body: { body?: string } = await request.json().catch(() => ({}))
const text = (body.body ?? '').trim()
if (!text) return NextResponse.json({ error: 'body required' }, { status: 422 })
@@ -50,7 +46,7 @@ export async function POST(
const { data: addendum, error } = await supabase
.from('incident_addenda')
.insert({ incident_id: id, author: user.id, body: text })
.insert({ incident_id: id, author: session.sub, body: text })
.select('id')
.single()
@@ -60,7 +56,7 @@ export async function POST(
p_table_name: 'incident_addenda',
p_record_id: addendum.id,
p_action: 'INSERT',
p_new_value: { incident_id: id, author: user.id, body: text },
p_new_value: { incident_id: id, author: session.sub, body: text },
})
return NextResponse.json({ id: addendum.id }, { status: 201 })