-
- Status
-
+
Status
Import engine: online
@@ -140,4 +104,4 @@ export default function AdminLeftNavigation({
)}
);
-}
+}
\ No newline at end of file
diff --git a/context/AuthContext.tsx b/context/AuthContext.tsx
index f048b81..96f4628 100644
--- a/context/AuthContext.tsx
+++ b/context/AuthContext.tsx
@@ -49,6 +49,9 @@ export function AuthProvider({ children }: { children: ReactNode }) {
const [user, setUser] = useState
(null);
const [loading, setLoading] = useState(true);
+ /**
+ * Persist auth to localStorage
+ */
const persistAuth = useCallback(
(nextToken: string | null, nextUser: AuthUser) => {
if (typeof window === "undefined") return;
@@ -68,19 +71,34 @@ export function AuthProvider({ children }: { children: ReactNode }) {
[]
);
- // Hydrate from localStorage on first load
+ /**
+ * ✅ Hydrate from localStorage ONCE
+ * IMPORTANT: loading only flips false AFTER user/token are set (if present)
+ */
useEffect(() => {
if (typeof window === "undefined") return;
const storedToken = window.localStorage.getItem(TOKEN_KEY);
const storedUser = window.localStorage.getItem(USER_KEY);
- if (storedToken) setToken(storedToken);
-
- if (storedUser) {
+ if (storedToken && storedUser) {
try {
- setUser(JSON.parse(storedUser));
+ const parsedUser = JSON.parse(storedUser);
+
+ setToken(storedToken);
+ setUser(parsedUser);
+
+ // ✅ Re-sync cookie so middleware can allow /admin on hard refresh / direct nav
+ fetch("/api/auth/session", {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify({
+ token: storedToken,
+ role: parsedUser?.role,
+ }),
+ }).catch(() => {});
} catch {
+ window.localStorage.removeItem(TOKEN_KEY);
window.localStorage.removeItem(USER_KEY);
}
}
@@ -88,11 +106,24 @@ export function AuthProvider({ children }: { children: ReactNode }) {
setLoading(false);
}, []);
+ /**
+ * Used by login/register/magic-link
+ */
const setSession = useCallback(
(nextToken: string, nextUser: NonNullable) => {
setToken(nextToken);
setUser(nextUser);
persistAuth(nextToken, nextUser);
+
+ // ✅ Make middleware / server aware of the session
+ fetch("/api/auth/session", {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify({
+ token: nextToken,
+ role: nextUser.role,
+ }),
+ }).catch(() => {});
},
[persistAuth]
);
@@ -118,6 +149,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
const nextUser: AuthUser =
data.user ??
({
+ uuid: data.uuid,
email: data.email ?? email,
displayName: data.displayName ?? null,
role: data.role ?? "USER",
@@ -160,6 +192,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
const nextUser: AuthUser =
data.user ??
({
+ uuid: data.uuid,
email: data.email ?? email,
displayName: data.displayName ?? displayName ?? null,
role: data.role ?? "USER",
@@ -177,6 +210,9 @@ export function AuthProvider({ children }: { children: ReactNode }) {
setToken(null);
setUser(null);
persistAuth(null, null);
+
+ // Clear server session cookies
+ fetch("/api/auth/session", { method: "DELETE" }).catch(() => {});
}, [persistAuth]);
const getAuthHeaders = useCallback((): HeadersInit => {
@@ -191,7 +227,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
register,
logout,
getAuthHeaders,
- setSession, // ✅ important
+ setSession,
};
return {children};
@@ -203,4 +239,4 @@ export function useAuth(): AuthContextValue {
throw new Error("useAuth must be used within an AuthProvider");
}
return ctx;
-}
\ No newline at end of file
+}
diff --git a/middleware.ts b/middleware.ts
index c1032d0..a78fdc1 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -12,15 +12,37 @@ const ALWAYS_ALLOW = new Set([
"/sitemap.xml",
]);
-// Match common public/static file extensions so middleware never blocks them
-const PUBLIC_FILE = /\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|json|woff|woff2|ttf|eot)$/i;
+const PUBLIC_FILE =
+ /\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|json|woff|woff2|ttf|eot)$/i;
export function middleware(req: NextRequest) {
- if (!LAUNCH_ONLY_ROOT) return NextResponse.next();
-
const { pathname } = req.nextUrl;
- // ✅ Always allow Next internals + static assets (public/ and _next/)
+// =========================
+// 1) Admin gate (always on)
+// =========================
+if (pathname.startsWith("/admin")) {
+ const token = req.cookies.get("bb_access_token")?.value;
+ const role = req.cookies.get("bb_role")?.value; // optional
+
+ const ok = !!token && (!role || role === "ADMIN");
+
+ if (!ok) {
+ const url = req.nextUrl.clone();
+ url.pathname = "/login";
+ url.searchParams.set("next", pathname);
+ return NextResponse.redirect(url);
+ }
+
+ return NextResponse.next();
+}
+
+ // =====================================
+ // 2) Launch-only gate (your existing one)
+ // =====================================
+ if (!LAUNCH_ONLY_ROOT) return NextResponse.next();
+
+ // ✅ Always allow Next internals + static assets
if (
pathname.startsWith("/_next") ||
pathname.startsWith("/favicon") ||
@@ -31,17 +53,17 @@ export function middleware(req: NextRequest) {
return NextResponse.next();
}
- // ✅ Allow the root + a few public files
if (ALWAYS_ALLOW.has(pathname)) return NextResponse.next();
- // 🚫 Everything else: hide it
return NextResponse.rewrite(new URL("/404", req.url));
}
+
+` 1`
export const config = {
- // Run middleware on everything *except* Next internals and obvious static files.
- // This keeps launch gating from ever breaking your logo/images/fonts/etc.
matcher: [
+ // run on everything except Next internals + obvious static files
"/((?!_next/static|_next/image|favicon.ico|robots.txt|sitemap.xml|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|json|woff|woff2|ttf|eot)).*)",
],
+
};
\ No newline at end of file