| import { NextRequest, NextResponse } from 'next/server'; |
| import { db } from '@/lib/db'; |
| import { loginSchema, getClientIp } from '@/lib/validation'; |
| import { |
| verifyPassword, |
| createSession, |
| SESSION_COOKIE_NAME, |
| } from '@/lib/auth'; |
| import { authRateLimit } from '@/lib/rate-limit'; |
| import { logActivity } from '@/lib/activity'; |
|
|
| export async function POST(request: NextRequest) { |
| try { |
| |
| const ip = getClientIp(request); |
| const { allowed, retryAfterMs } = await authRateLimit(`auth:${ip}`); |
| if (!allowed) { |
| return NextResponse.json( |
| { error: 'Too many login attempts. Please try again later.' }, |
| { |
| status: 429, |
| headers: { 'Retry-After': String(Math.ceil(retryAfterMs / 1000)) }, |
| } |
| ); |
| } |
|
|
| |
| const body = await request.json(); |
| const parsed = loginSchema.safeParse(body); |
| if (!parsed.success) { |
| return NextResponse.json( |
| { error: parsed.error.issues[0].message }, |
| { status: 400 } |
| ); |
| } |
|
|
| const { email, password } = parsed.data; |
|
|
| |
| const user = await db.user.findUnique({ where: { email } }); |
| if (!user) { |
| return NextResponse.json( |
| { error: 'Invalid email or password' }, |
| { status: 401 } |
| ); |
| } |
|
|
| |
| const valid = await verifyPassword(password, user.password); |
| if (!valid) { |
| return NextResponse.json( |
| { error: 'Invalid email or password' }, |
| { status: 401 } |
| ); |
| } |
|
|
| |
| const token = await createSession(user.id); |
|
|
| |
| const response = NextResponse.json({ |
| user: { |
| id: user.id, |
| email: user.email, |
| name: user.name, |
| plan: user.plan, |
| createdAt: user.createdAt, |
| }, |
| }); |
|
|
| response.cookies.set(SESSION_COOKIE_NAME, token, { |
| httpOnly: true, |
| secure: true, |
| sameSite: 'lax', |
| path: '/', |
| maxAge: 7 * 24 * 60 * 60, |
| }); |
|
|
| logActivity(user.id, 'login', 'Logged in', 'Signed in successfully'); |
|
|
| return response; |
| } catch (error) { |
| console.error('[LOGIN_ERROR]', error); |
| return NextResponse.json( |
| { error: 'Internal server error' }, |
| { status: 500 } |
| ); |
| } |
| } |
