Merge pull request #10 from biranchikulesika/fix/auth

feat(auth): comprehensive admin security system with session expiry, passkey implementation, and proper security activity logging.

Author: biranchikulesika

frontend/app/admin/auth/callback/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server';
 import { createServerClient } from '@supabase/ssr';
 import { cookies } from 'next/headers';
+import { logSecurityEventDirect } from '../../security-actions';
 
 export async function GET(request: Request) {
   const requestUrl = new URL(request.url);
@@ -17,6 +18,14 @@ export async function GET(request: Request) {
   const { searchParams } = requestUrl;
   const code = searchParams.get('code');
   const next = searchParams.get('next') || '/admin';
+  const provider = searchParams.get('provider');
+
+  const forwardedFor = request.headers.get('x-forwarded-for');
+  const ip =
+    forwardedFor?.split(',')[0].trim() ||
+    request.headers.get('x-real-ip') ||
+    'unknown';
+  const ua = request.headers.get('user-agent');
 
   if (code) {
     const cookieStore = await cookies();
@@ -41,13 +50,33 @@ export async function GET(request: Request) {
       }
     );
 
-    const { error } = await supabase.auth.exchangeCodeForSession(code);
-    if (!error) {
+    const { data, error } = await supabase.auth.exchangeCodeForSession(code);
+    if (!error && data.user) {
+      logSecurityEventDirect(
+        process.env.NEXT_PUBLIC_SUPABASE_URL!,
+        process.env.SUPABASE_SERVICE_ROLE_KEY || '',
+        'oauth_login',
+        data.user.id,
+        ip,
+        ua,
+        { status: 'Success', metadata: { provider: provider || 'unknown' } }
+      ).catch(() => {});
+
       const redirectUrl = new URL(next, origin);
       return NextResponse.redirect(redirectUrl.toString());
     }
+
+    // Log failed OAuth exchange
+    logSecurityEventDirect(
+      process.env.NEXT_PUBLIC_SUPABASE_URL!,
+      process.env.SUPABASE_SERVICE_ROLE_KEY || '',
+      'login_failed',
+      '00000000-0000-0000-0000-000000000000',
+      ip,
+      ua,
+      { status: 'Failed', metadata: { method: 'oauth', provider: provider || 'unknown', reason: error?.message || 'code_exchange_failed' } }
+    ).catch(() => {});
   }
 
-  // Return the user to an error page with instructions
   return NextResponse.redirect(new URL('/admin/login?error=auth_failed', origin).toString());
 }

frontend/app/admin/login/actions.ts

@@ -2,6 +2,7 @@
 
 import { createServerClient } from '@supabase/ssr';
 import { cookies, headers } from 'next/headers';
+import { logSecurityEventDirect } from '../security-actions';
 
 // In-memory rate limiter.
 // NOTE: This is suitable for development but is not reliable on
@@ -17,6 +18,8 @@ export async function authenticateUser(email: string, password: string) {
     headersList.get('x-real-ip') ||
     'unknown';
 
+  const ua = headersList.get('user-agent');
+
   const now = Date.now();
 
   const record = rateLimitMap.get(ip);
@@ -40,8 +43,8 @@ export async function authenticateUser(email: string, password: string) {
 
   const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
   const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+  const serviceKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
 
-  // Authentication requires Supabase to be configured.
   if (!supabaseUrl || !supabaseAnonKey) {
     return {
       error: {
@@ -70,12 +73,17 @@ export async function authenticateUser(email: string, password: string) {
     },
   });
 
-  const { error } = await supabase.auth.signInWithPassword({
+  const { data, error } = await supabase.auth.signInWithPassword({
     email,
     password,
   });
 
   if (error) {
+    logSecurityEventDirect(supabaseUrl, serviceKey || '', 'login_failed', '00000000-0000-0000-0000-000000000000', ip, ua, {
+      status: 'Failed',
+      metadata: { method: 'email_password', email, reason: error.message },
+    }).catch(() => {});
+
     return {
       error: {
         message: 'Invalid login credentials',
@@ -86,7 +94,15 @@ export async function authenticateUser(email: string, password: string) {
   // Reset rate limit after successful authentication.
   rateLimitMap.delete(ip);
 
+  // Log successful login
+  if (data.user) {
+    logSecurityEventDirect(supabaseUrl, serviceKey || '', 'login', data.user.id, ip, ua, {
+      status: 'Success',
+      metadata: { method: 'email_password' },
+    }).catch(() => {});
+  }
+
   return {
     error: null,
   };
-}
+}

frontend/app/admin/login/page.tsx

@@ -11,6 +11,7 @@ import { Logo } from '@/components/ui/logo';
 import { useFakeTyping } from '@/hooks/use-fake-typing';
 import { useAuthSequence } from '@/hooks/use-auth-sequence';
 import { authenticateUser } from './actions';
+import { logSecurityEvent } from '../security-actions';
 
 
 
@@ -169,6 +170,7 @@ function LoginContent() {
       setFailedAttempts(prev => prev + 1);
       setInvalidCredentials(true);
       setLoading(false);
+      logSecurityEvent('login_failed', { metadata: { method: 'oauth', provider, reason: signInError.message } }).catch(() => {});
       return;
     }
   };
@@ -177,12 +179,38 @@ function LoginContent() {
     setLoading(true);
     clearStatus();
 
-    // Standard passkey entry or authentication bypass
-    const texts = ["I'm Biranchi", "Yes, I'm Biranchi", "I love Biranchi"];
-    setFailedAttemptText(texts[Math.floor(Math.random() * texts.length)]);
-    setFailedAttempts(prev => prev + 1);
-    setInvalidCredentials(true);
-    setLoading(false);
+    if (!supabase) {
+      setEmailError("Supabase authentication is not configured in this environment.");
+      setLoading(false);
+      return;
+    }
+
+    try {
+      const { error: passkeyError } = await supabase.auth.signInWithPasskey();
+
+      if (passkeyError) {
+        showFailureMessage();
+        setInvalidCredentials(true);
+        setLoading(false);
+        logSecurityEvent('login_failed', { metadata: { method: 'passkey', reason: passkeyError.message } }).catch(() => {});
+        return;
+      }
+
+      logSecurityEvent('passkey_login', { metadata: { method: 'passkey' } }).catch(() => {});
+      await runSuccessSequence();
+      router.push('/admin');
+      router.refresh();
+    } catch (e: unknown) {
+      setLoading(false);
+      if (e instanceof Error && e.name === 'NotAllowedError') {
+        return;
+      }
+      if (e instanceof Error && e.message.includes('does not support WebAuthn')) {
+        setEmailError('Your browser does not support passkeys.');
+        return;
+      }
+      setInvalidCredentials(true);
+    }
   };
 
   return (