valknarandClaude Sonnet 5
9e0380ec75
Every app/api route handler now goes through withRouteLogging, which logs a correlated reqId/method/path/status/duration for each request and turns any uncaught error into a logged stack trace plus a clean JSON 500 instead of Next's default opaque failure. proxy.ts logs rejected auth attempts, and instrumentation.ts's onRequestError catches anything that still escapes a route handler. Also adds a minimal not-found page matching the app's card styling. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
29 lines
1.1 KiB
TypeScript
29 lines
1.1 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { z } from "zod";
|
|
import { getEnv } from "@/lib/env";
|
|
import { timingSafeStringEqual } from "@/lib/auth/timing-safe-compare";
|
|
import { createSessionToken, sessionCookieOptions } from "@/lib/auth/session";
|
|
import { withRouteLogging } from "@/lib/api/with-route-logging";
|
|
import { createLogger } from "@/lib/logger";
|
|
|
|
const log = createLogger("auth");
|
|
const bodySchema = z.object({ secret: z.string().min(1) });
|
|
|
|
export const POST = withRouteLogging("auth.login", async (req: Request) => {
|
|
const parsed = bodySchema.safeParse(await req.json().catch(() => null));
|
|
if (!parsed.success) {
|
|
return NextResponse.json({ error: "secret is required" }, { status: 400 });
|
|
}
|
|
|
|
if (!timingSafeStringEqual(parsed.data.secret, getEnv().ACCESS_PASSWORD)) {
|
|
log.warn("login attempt with invalid secret");
|
|
return NextResponse.json({ error: "invalid secret" }, { status: 401 });
|
|
}
|
|
|
|
log.info("login succeeded");
|
|
const token = await createSessionToken();
|
|
const res = NextResponse.json({ ok: true });
|
|
res.cookies.set({ ...sessionCookieOptions, value: token });
|
|
return res;
|
|
});
|