woof. killed useClient and use nextjs api

app/(app)/(builder)/builder/page.tsx

@@ -74,8 +74,7 @@ const isUuid = (v: string) =>
     v
   );
 
-const API_BASE_URL =
-  process.env.NEXT_PUBLIC_API_BASE_URL ?? "";
+// API routes now handled by Next.js /api routes (server-side)
 
 const STORAGE_KEY = "gunbuilder-build-state";
 
@@ -337,8 +336,8 @@ function GunbuilderPageContent() {
 
   const api = useApi();
 
-  // ✅ Auth: we need the token ready before calling /builds/me/*
-  const { token, loading: authLoading, getAuthHeaders } = useAuth();
+  // ✅ Auth: check if user is logged in
+  const { user, loading: authLoading } = useAuth();
 
   const [platform, setPlatform] = useState<(typeof PLATFORMS)[number]>("AR15");
 
@@ -616,7 +615,7 @@ function GunbuilderPageContent() {
 
       try {
         const res = await fetch(
-          `${API_BASE_URL}/api/v1/catalog/products/by-ids`,
+          `/api/catalog/products/by-ids`,
           {
             method: "POST",
             signal: controller.signal,
@@ -728,7 +727,7 @@ function GunbuilderPageContent() {
     if (authLoading) return;
 
     // If not logged in, don't spam the backend; show a helpful message instead.
-    if (!token) {
+    if (!user) {
       setShareStatus("Please log in to load builds from your Vault.");
       window.setTimeout(() => setShareStatus(null), 4500);
       return;
@@ -738,14 +737,12 @@ function GunbuilderPageContent() {
       try {
         setShareStatus("Loading build…");
 
-        // NOTE: using fetch here avoids any “stale api instance” issues and lets us
-        // explicitly attach JWT headers.
+        // NOTE: using fetch here goes through our Next.js API routes with HTTP-only cookies
         const res = await fetch(
-          `${API_BASE_URL}/api/v1/builds/me/${encodeURIComponent(uuidToLoad)}`,
+          `/api/builds/${encodeURIComponent(uuidToLoad)}`,
           {
             headers: {
               "Content-Type": "application/json",
-              ...getAuthHeaders(),
             },
           }
         );
@@ -787,9 +784,7 @@ function GunbuilderPageContent() {
     searchParams,
     router,
     authLoading,
-    token,
-    getAuthHeaders,
-    // API_BASE_URL is a module constant; no need to include
+    user,
   ]);
 
   // -----------------------------

app/(app)/vault/page.tsx

@@ -18,8 +18,7 @@ type BuildDto = {
   updatedAt?: string | null;
 };
 
-const API_BASE_URL =
-  process.env.NEXT_PUBLIC_API_BASE_URL ?? "";
+// API routes now handled by Next.js /api routes (server-side)
 
 // UUID validator (defensive)
 const isUuid = (v: string) =>
@@ -40,14 +39,14 @@ export default function VaultPage() {
 
   // NOTE:
   // - `loading` here is AuthContext hydration, not network.
-  // - `token` is the real gate for /me endpoints.
-  const { user, token, loading: authLoading } = useAuth();
+  // - Auth is handled by HTTP-only cookies automatically.
+  const { user, loading: authLoading } = useAuth();
 
   const [builds, setBuilds] = useState<BuildDto[]>([]);
   const [error, setError] = useState<string | null>(null);
   const [busy, setBusy] = useState(false);
 
-  const authed = !!user && !!token;
+  const authed = !!user;
 
   // Redirect if not logged in (after auth hydrates)
   useEffect(() => {
@@ -56,12 +55,12 @@ export default function VaultPage() {
     }
   }, [authLoading, authed, router]);
 
-  // When auth identity changes, clear stale list to avoid “ghost builds”
+  // When auth identity changes, clear stale list to avoid "ghost builds"
   useEffect(() => {
     if (authLoading) return;
     setBuilds([]);
     setError(null);
-  }, [authLoading, user?.uuid, token]);
+  }, [authLoading, user?.uuid]);
 
   // Fetch user builds
   useEffect(() => {
@@ -75,8 +74,8 @@ export default function VaultPage() {
 
       try {
         // IMPORTANT:
-        // Use api wrapper so Authorization: Bearer <token> is consistently applied.
-        const res = await api.get("/api/v1/builds/me");
+        // Use api wrapper which includes credentials (cookies) automatically.
+        const res = await api.get("/api/builds");
 
         if (!res.ok) {
           const text = await res.text().catch(() => "");

app/admin/merchants/page.tsx

@@ -2,8 +2,7 @@
 
 import { useEffect, useState } from "react";
 
-const API_BASE_URL =
-  process.env.NEXT_PUBLIC_API_BASE_URL ?? "";
+// API routes now handled by Next.js /api routes (server-side)
 
 type MerchantAdminDto = {
   id: number;
@@ -91,7 +90,7 @@ export default function MerchantsAdminPage() {
         setLoading(true);
         setError(null);
 
-        const url = `${API_BASE_URL}/api/admin/merchants`;
+        const url = `/api/admin/merchants`;
         console.log("Loading merchants from:", url);
 
         const res = await fetch(url, {
@@ -150,7 +149,7 @@ export default function MerchantsAdminPage() {
       setError(null);
       setBanner(null);
 
-      const res = await fetch(`${API_BASE_URL}/api/admin/merchants/${id}`, {
+      const res = await fetch(`/api/admin/merchants/${id}`, {
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
@@ -189,7 +188,7 @@ export default function MerchantsAdminPage() {
       setError(null);
       setBanner(null);
 
-      const res = await fetch(`${API_BASE_URL}/api/admin/imports/${id}`, {
+      const res = await fetch(`/api/admin/merchants/${id}/import`, {
         method: "POST",
       });
 
@@ -218,7 +217,7 @@ export default function MerchantsAdminPage() {
       setBanner(null);
 
       const res = await fetch(
-        `${API_BASE_URL}/api/admin/imports/${id}/offers-only`,
+        `/api/admin/merchants/${id}/offer-sync`,
         { method: "POST" }
       );
 
@@ -247,7 +246,7 @@ export default function MerchantsAdminPage() {
       setError(null);
       setBanner(null);
 
-      const res = await fetch(`${API_BASE_URL}/api/v1/admin/merchants`, {
+      const res = await fetch(`/api/admin/merchants`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({

app/api/admin/merchants/[id]/import/route.ts

@@ -0,0 +1,35 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+
+const API_BASE_URL = process.env.API_BASE_URL || process.env.NEXT_PUBLIC_API_BASE_URL;
+
+async function getAuthHeader() {
+  const token = cookies().get('session_token')?.value;
+  if (!token) throw new Error('Unauthorized');
+  return { Authorization: `Bearer ${token}` };
+}
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  try {
+    const headers = await getAuthHeader();
+
+    const res = await fetch(
+      `${API_BASE_URL}/api/v1/admin/merchants/${params.id}/import`,
+      { method: 'POST', headers }
+    );
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+}

app/api/admin/merchants/[id]/offer-sync/route.ts

@@ -0,0 +1,35 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+
+const API_BASE_URL = process.env.API_BASE_URL || process.env.NEXT_PUBLIC_API_BASE_URL;
+
+async function getAuthHeader() {
+  const token = cookies().get('session_token')?.value;
+  if (!token) throw new Error('Unauthorized');
+  return { Authorization: `Bearer ${token}` };
+}
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  try {
+    const headers = await getAuthHeader();
+
+    const res = await fetch(
+      `${API_BASE_URL}/api/v1/admin/merchants/${params.id}/offer-sync`,
+      { method: 'POST', headers }
+    );
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+}

app/api/admin/merchants/[id]/route.ts

@@ -0,0 +1,90 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+
+const API_BASE_URL = process.env.API_BASE_URL || process.env.NEXT_PUBLIC_API_BASE_URL;
+
+async function getAuthHeader() {
+  const token = cookies().get('session_token')?.value;
+  if (!token) throw new Error('Unauthorized');
+  return { Authorization: `Bearer ${token}` };
+}
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  try {
+    const headers = await getAuthHeader();
+
+    const res = await fetch(
+      `${API_BASE_URL}/api/v1/admin/merchants/${params.id}`,
+      { headers }
+    );
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+}
+
+export async function PUT(
+  request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  try {
+    const headers = await getAuthHeader();
+    const body = await request.json();
+
+    const res = await fetch(
+      `${API_BASE_URL}/api/v1/admin/merchants/${params.id}`,
+      {
+        method: 'PUT',
+        headers: { ...headers, 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      }
+    );
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+}
+
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  try {
+    const headers = await getAuthHeader();
+
+    const res = await fetch(
+      `${API_BASE_URL}/api/v1/admin/merchants/${params.id}`,
+      { method: 'DELETE', headers }
+    );
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+}

app/api/admin/merchants/route.ts

@@ -0,0 +1,54 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+
+const API_BASE_URL = process.env.API_BASE_URL || process.env.NEXT_PUBLIC_API_BASE_URL;
+
+async function getAuthHeader() {
+  const token = cookies().get('session_token')?.value;
+  if (!token) throw new Error('Unauthorized');
+  return { Authorization: `Bearer ${token}` };
+}
+
+export async function GET() {
+  try {
+    const headers = await getAuthHeader();
+    const res = await fetch(`${API_BASE_URL}/api/v1/admin/merchants`, {
+      headers,
+    });
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const headers = await getAuthHeader();
+    const body = await request.json();
+
+    const res = await fetch(`${API_BASE_URL}/api/v1/admin/merchants`, {
+      method: 'POST',
+      headers: { ...headers, 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    });
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+}

app/api/auth/login/route.ts

@@ -0,0 +1,46 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+
+const API_BASE_URL = process.env.API_BASE_URL || process.env.NEXT_PUBLIC_API_BASE_URL;
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json();
+
+    // Forward to backend API
+    const res = await fetch(`${API_BASE_URL}/api/auth/login`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    });
+
+    if (!res.ok) {
+      const text = await res.text().catch(() => '');
+      return NextResponse.json(
+        { error: text || 'Login failed' },
+        { status: res.status }
+      );
+    }
+
+    const data = await res.json();
+
+    // Set HTTP-only cookie instead of returning token
+    cookies().set('session_token', data.token, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === 'production',
+      sameSite: 'lax',
+      maxAge: 60 * 60 * 24 * 7, // 7 days
+      path: '/',
+    });
+
+    // Return user data without token
+    return NextResponse.json({
+      user: data.user,
+    });
+  } catch (err: any) {
+    return NextResponse.json(
+      { error: err?.message || 'Login failed' },
+      { status: 500 }
+    );
+  }
+}

app/api/auth/logout/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+
+export async function POST() {
+  cookies().delete('session_token');
+  return NextResponse.json({ success: true });
+}

app/api/auth/me/route.ts

@@ -0,0 +1,30 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+
+const API_BASE_URL = process.env.API_BASE_URL || process.env.NEXT_PUBLIC_API_BASE_URL;
+
+export async function GET(request: NextRequest) {
+  const token = cookies().get('session_token')?.value;
+
+  if (!token) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  try {
+    const res = await fetch(`${API_BASE_URL}/api/users/me`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+
+    if (!res.ok) {
+      cookies().delete('session_token');
+      return NextResponse.json({ error: 'Session expired' }, { status: 401 });
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json(
+      { error: err?.message || 'Failed to fetch user' },
+      { status: 500 }
+    );
+  }
+}

app/api/auth/register/route.ts

@@ -0,0 +1,48 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+
+const API_BASE_URL = process.env.API_BASE_URL || process.env.NEXT_PUBLIC_API_BASE_URL;
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json();
+
+    // Forward to backend API
+    const res = await fetch(`${API_BASE_URL}/api/auth/register`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    });
+
+    if (!res.ok) {
+      const text = await res.text().catch(() => '');
+      return NextResponse.json(
+        { error: text || 'Registration failed' },
+        { status: res.status }
+      );
+    }
+
+    const data = await res.json();
+
+    // Set HTTP-only cookie on successful registration
+    if (data.token) {
+      cookies().set('session_token', data.token, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        maxAge: 60 * 60 * 24 * 7, // 7 days
+        path: '/',
+      });
+    }
+
+    // Return user data without token
+    return NextResponse.json({
+      user: data.user,
+    });
+  } catch (err: any) {
+    return NextResponse.json(
+      { error: err?.message || 'Registration failed' },
+      { status: 500 }
+    );
+  }
+}

app/api/builds/[id]/route.ts

@@ -0,0 +1,90 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+
+const API_BASE_URL = process.env.API_BASE_URL || process.env.NEXT_PUBLIC_API_BASE_URL;
+
+async function getAuthHeader() {
+  const token = cookies().get('session_token')?.value;
+  if (!token) throw new Error('Unauthorized');
+  return { Authorization: `Bearer ${token}` };
+}
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  try {
+    const headers = await getAuthHeader();
+
+    const res = await fetch(
+      `${API_BASE_URL}/api/v1/gunbuilder/builds/${params.id}`,
+      { headers }
+    );
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+}
+
+export async function PUT(
+  request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  try {
+    const headers = await getAuthHeader();
+    const body = await request.json();
+
+    const res = await fetch(
+      `${API_BASE_URL}/api/v1/gunbuilder/builds/${params.id}`,
+      {
+        method: 'PUT',
+        headers: { ...headers, 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      }
+    );
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+}
+
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  try {
+    const headers = await getAuthHeader();
+
+    const res = await fetch(
+      `${API_BASE_URL}/api/v1/gunbuilder/builds/${params.id}`,
+      { method: 'DELETE', headers }
+    );
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+}

app/api/builds/route.ts

@@ -0,0 +1,57 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+
+const API_BASE_URL = process.env.API_BASE_URL || process.env.NEXT_PUBLIC_API_BASE_URL;
+
+async function getAuthHeader() {
+  const token = cookies().get('session_token')?.value;
+  if (!token) throw new Error('Unauthorized');
+  return { Authorization: `Bearer ${token}` };
+}
+
+export async function GET(request: NextRequest) {
+  try {
+    const headers = await getAuthHeader();
+    const { searchParams } = new URL(request.url);
+
+    const res = await fetch(
+      `${API_BASE_URL}/api/v1/gunbuilder/builds?${searchParams}`,
+      { headers }
+    );
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const headers = await getAuthHeader();
+    const body = await request.json();
+
+    const res = await fetch(`${API_BASE_URL}/api/v1/gunbuilder/builds`, {
+      method: 'POST',
+      headers: { ...headers, 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    });
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json(), { status: res.status });
+  } catch (err: any) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+}

app/api/catalog/options/route.ts

@@ -0,0 +1,28 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+const API_BASE_URL = process.env.API_BASE_URL || process.env.NEXT_PUBLIC_API_BASE_URL;
+
+export async function GET(request: NextRequest) {
+  try {
+    const { searchParams } = new URL(request.url);
+
+    // No auth required for public catalog
+    const res = await fetch(
+      `${API_BASE_URL}/api/v1/catalog/options?${searchParams}`
+    );
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json(
+      { error: err?.message || 'Failed to fetch catalog' },
+      { status: 500 }
+    );
+  }
+}

app/api/catalog/products/by-ids/route.ts

@@ -0,0 +1,33 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+const API_BASE_URL = process.env.API_BASE_URL || process.env.NEXT_PUBLIC_API_BASE_URL;
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json();
+
+    // No auth required for public catalog
+    const res = await fetch(
+      `${API_BASE_URL}/api/v1/catalog/products/by-ids`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      }
+    );
+
+    if (!res.ok) {
+      return NextResponse.json(
+        { error: await res.text() },
+        { status: res.status }
+      );
+    }
+
+    return NextResponse.json(await res.json());
+  } catch (err: any) {
+    return NextResponse.json(
+      { error: err?.message || 'Failed to fetch products' },
+      { status: 500 }
+    );
+  }
+}