`src/app/api/auth/route.ts`

73 lines
import { NextRequest, NextResponse } from 'next/server'
import { query } from '@/lib/db'
import { cookies } from 'next/headers'

export async function POST(request: NextRequest) {
  const body = await request.json()
  const { action, email, password } = body

  if (action === 'login') {
    if (!email || !password) {
      return NextResponse.json({ error: 'Email and password required' }, { status: 400 })
    }

    const result = await query(
      `SELECT id, email, display_name, role
       FROM users
       WHERE email = $1 AND password_hash = crypt($2, password_hash)`,
      [email, password]
    )

    if (result.rows.length === 0) {
      return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 })
    }

    const user = result.rows[0]

    // Create session
    const session = await query(
      `INSERT INTO sessions (user_id) VALUES ($1) RETURNING token, expires_at`,
      [user.id]
    )

    const cookieStore = await cookies()
    cookieStore.set('iwascute-session', session.rows[0].token, {
      httpOnly: true,
      sameSite: 'lax',
      path: '/',
      maxAge: 60 * 60 * 24 * 7, // 7 days
    })

    return NextResponse.json({ user })
  }

  if (action === 'logout') {
    const cookieStore = await cookies()
    const token = cookieStore.get('iwascute-session')?.value
    if (token) {
      await query('DELETE FROM sessions WHERE token = $1', [token])
      cookieStore.delete('iwascute-session')
    }
    return NextResponse.json({ success: true })
  }

  return NextResponse.json({ error: 'Unknown action' }, { status: 400 })
}

export async function GET() {
  const cookieStore = await cookies()
  const token = cookieStore.get('iwascute-session')?.value
  if (!token) {
    return NextResponse.json({ user: null })
  }

  const result = await query(
    `SELECT u.id, u.email, u.display_name, u.role
     FROM sessions s JOIN users u ON s.user_id = u.id
     WHERE s.token = $1 AND s.expires_at > NOW()`,
    [token]
  )

  return NextResponse.json({ user: result.rows[0] || null })
}