Replace entire repo content with code from /root/shahikitchen-google/

app/api/admin/login/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import { isValidAdminCredentials } from '@/application/admin/validate-credentials';
+import {
+  ADMIN_SESSION_COOKIE,
+  createAdminSessionToken,
+  getAdminSessionCookieOptions,
+} from '@/infrastructure/auth/admin-session';
+
+export async function POST(request: Request) {
+  const body = (await request.json()) as { username?: string; password?: string };
+  const username = body.username?.trim() ?? '';
+  const password = body.password ?? '';
+
+  if (!isValidAdminCredentials(username, password)) {
+    return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 });
+  }
+
+  const cookieStore = await cookies();
+  cookieStore.set(ADMIN_SESSION_COOKIE, createAdminSessionToken(), getAdminSessionCookieOptions());
+
+  return NextResponse.json({ ok: true });
+}

app/api/admin/logout/route.ts

@@ -0,0 +1,9 @@
+import { NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import { ADMIN_SESSION_COOKIE } from '@/infrastructure/auth/admin-session';
+
+export async function POST() {
+  const cookieStore = await cookies();
+  cookieStore.delete(ADMIN_SESSION_COOKIE);
+  return NextResponse.json({ ok: true });
+}

app/api/admin/menu/route.ts

@@ -0,0 +1,208 @@
+import { NextResponse } from 'next/server';
+import type { MenuCategory, MenuItem } from '@/domain/menu/entities';
+import { requireAdmin } from '@/infrastructure/auth/require-admin';
+import {
+  addMenuCategory,
+  addMenuItem,
+  readMenuCategories,
+  removeMenuCategory,
+  removeMenuItem,
+  updateMenuItem,
+} from '@/infrastructure/menu/menu-persistence';
+
+export async function GET() {
+  const unauthorized = await requireAdmin();
+  if (unauthorized) return unauthorized;
+
+  const categories = await readMenuCategories();
+  return NextResponse.json({ categories });
+}
+
+interface MenuItemUpdateBody {
+  categoryId?: string;
+  itemId?: string;
+  updates?: Partial<MenuItem>;
+}
+
+export async function PATCH(request: Request) {
+  const unauthorized = await requireAdmin();
+  if (unauthorized) return unauthorized;
+
+  const body = (await request.json()) as MenuItemUpdateBody;
+  const { categoryId, itemId, updates } = body;
+
+  if (!categoryId || !itemId || !updates || typeof updates !== 'object') {
+    return NextResponse.json({ error: 'categoryId, itemId and updates are required' }, { status: 400 });
+  }
+
+  const sanitizedUpdates: Partial<MenuItem> = {};
+
+  if (typeof updates.name === 'string') sanitizedUpdates.name = updates.name.trim();
+  if (typeof updates.description === 'string') sanitizedUpdates.description = updates.description.trim();
+  if (typeof updates.image === 'string') sanitizedUpdates.image = updates.image.trim() || undefined;
+  if (typeof updates.video === 'string') sanitizedUpdates.video = updates.video.trim() || undefined;
+  if (typeof updates.isVegetarian === 'boolean') sanitizedUpdates.isVegetarian = updates.isVegetarian;
+  if (updates.pricing === 'weight') {
+    sanitizedUpdates.pricing = 'weight';
+  } else if (updates.pricing === 'standard') {
+    sanitizedUpdates.pricing = 'standard';
+    sanitizedUpdates.pricePerHalfKg = undefined;
+    sanitizedUpdates.pricePerKg = undefined;
+  }
+
+  if (typeof updates.price === 'number' && Number.isFinite(updates.price)) {
+    sanitizedUpdates.price = Math.max(0, Math.round(updates.price));
+  }
+  if (typeof updates.pricePerHalfKg === 'number' && Number.isFinite(updates.pricePerHalfKg)) {
+    sanitizedUpdates.pricePerHalfKg = Math.max(0, Math.round(updates.pricePerHalfKg));
+  }
+  if (typeof updates.pricePerKg === 'number' && Number.isFinite(updates.pricePerKg)) {
+    sanitizedUpdates.pricePerKg = Math.max(0, Math.round(updates.pricePerKg));
+  }
+
+  const updatedItem = await updateMenuItem(categoryId, itemId, sanitizedUpdates);
+  if (!updatedItem) {
+    return NextResponse.json({ error: 'Menu item not found' }, { status: 404 });
+  }
+
+  return NextResponse.json({ item: updatedItem });
+}
+
+interface AddItemBody {
+  action: 'addItem';
+  categoryId: string;
+  item: MenuItem;
+}
+
+interface AddCategoryBody {
+  action: 'addCategory';
+  category: Pick<MenuCategory, 'name' | 'id'>;
+}
+
+type PostBody = AddItemBody | AddCategoryBody;
+
+function sanitizeMenuItem(item: MenuItem): MenuItem | null {
+  const name = item.name?.trim();
+  if (!name) return null;
+
+  const sanitized: MenuItem = {
+    id: item.id?.trim() || name,
+    name,
+    price: Math.max(0, Math.round(Number(item.price) || 0)),
+  };
+
+  if (typeof item.description === 'string') {
+    sanitized.description = item.description.trim() || undefined;
+  }
+  if (typeof item.image === 'string') {
+    sanitized.image = item.image.trim() || undefined;
+  }
+  if (typeof item.video === 'string') {
+    sanitized.video = item.video.trim() || undefined;
+  }
+  if (item.isVegetarian === true) sanitized.isVegetarian = true;
+  if (item.pricing === 'weight') {
+    sanitized.pricing = 'weight';
+    sanitized.pricePerHalfKg = Math.max(0, Math.round(Number(item.pricePerHalfKg) || 0));
+    sanitized.pricePerKg = Math.max(0, Math.round(Number(item.pricePerKg) || 0));
+  }
+
+  return sanitized;
+}
+
+export async function POST(request: Request) {
+  const unauthorized = await requireAdmin();
+  if (unauthorized) return unauthorized;
+
+  const body = (await request.json()) as PostBody;
+
+  if (body.action === 'addItem') {
+    const { categoryId, item } = body;
+    if (!categoryId || !item) {
+      return NextResponse.json({ error: 'categoryId and item are required' }, { status: 400 });
+    }
+
+    const sanitized = sanitizeMenuItem(item);
+    if (!sanitized) {
+      return NextResponse.json({ error: 'A valid dish name is required' }, { status: 400 });
+    }
+
+    const created = await addMenuItem(categoryId, sanitized);
+    if (!created) {
+      return NextResponse.json({ error: 'Category not found or item could not be created' }, { status: 404 });
+    }
+
+    return NextResponse.json({ item: created }, { status: 201 });
+  }
+
+  if (body.action === 'addCategory') {
+    const { category } = body;
+    if (!category?.name?.trim()) {
+      return NextResponse.json({ error: 'Category name is required' }, { status: 400 });
+    }
+
+    const created = await addMenuCategory({
+      id: category.id?.trim() || category.name,
+      name: category.name.trim(),
+      items: [],
+    });
+
+    if (!created) {
+      return NextResponse.json({ error: 'Category already exists or could not be created' }, { status: 409 });
+    }
+
+    return NextResponse.json({ category: created }, { status: 201 });
+  }
+
+  return NextResponse.json({ error: 'Unknown action' }, { status: 400 });
+}
+
+interface DeleteItemBody {
+  action: 'deleteItem';
+  categoryId: string;
+  itemId: string;
+}
+
+interface DeleteCategoryBody {
+  action: 'deleteCategory';
+  categoryId: string;
+}
+
+type DeleteBody = DeleteItemBody | DeleteCategoryBody;
+
+export async function DELETE(request: Request) {
+  const unauthorized = await requireAdmin();
+  if (unauthorized) return unauthorized;
+
+  const body = (await request.json()) as DeleteBody;
+
+  if (body.action === 'deleteItem') {
+    const { categoryId, itemId } = body;
+    if (!categoryId || !itemId) {
+      return NextResponse.json({ error: 'categoryId and itemId are required' }, { status: 400 });
+    }
+
+    const removed = await removeMenuItem(categoryId, itemId);
+    if (!removed) {
+      return NextResponse.json({ error: 'Menu item not found' }, { status: 404 });
+    }
+
+    return NextResponse.json({ ok: true });
+  }
+
+  if (body.action === 'deleteCategory') {
+    const { categoryId } = body;
+    if (!categoryId) {
+      return NextResponse.json({ error: 'categoryId is required' }, { status: 400 });
+    }
+
+    const removed = await removeMenuCategory(categoryId);
+    if (!removed) {
+      return NextResponse.json({ error: 'Category not found' }, { status: 404 });
+    }
+
+    return NextResponse.json({ ok: true });
+  }
+
+  return NextResponse.json({ error: 'Unknown action' }, { status: 400 });
+}

app/api/admin/menu/versions/[id]/route.ts

@@ -0,0 +1,29 @@
+import { NextResponse } from 'next/server';
+import { requireAdmin } from '@/infrastructure/auth/require-admin';
+import { readMenuCategories } from '@/infrastructure/menu/menu-persistence';
+import { deleteMenuVersion, listMenuVersions } from '@/infrastructure/menu/menu-versioning';
+
+interface RouteContext {
+  params: Promise<{ id: string }>;
+}
+
+export async function DELETE(_request: Request, context: RouteContext) {
+  const unauthorized = await requireAdmin();
+  if (unauthorized) return unauthorized;
+
+  const { id } = await context.params;
+
+  try {
+    const removed = await deleteMenuVersion(id);
+    if (!removed) {
+      return NextResponse.json({ error: 'Version not found' }, { status: 404 });
+    }
+
+    const categories = await readMenuCategories();
+    const versions = await listMenuVersions(categories);
+    return NextResponse.json({ ok: true, versions });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'Delete failed';
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}

app/api/admin/menu/versions/route.ts

@@ -0,0 +1,75 @@
+import { NextResponse } from 'next/server';
+import { requireAdmin } from '@/infrastructure/auth/require-admin';
+import {
+  clearMenuCache,
+  persistMenuCategories,
+  readMenuCategories,
+} from '@/infrastructure/menu/menu-persistence';
+import {
+  createMenuSnapshot,
+  listMenuVersions,
+  resetMenuVersionHistory,
+  restoreMenuVersion,
+} from '@/infrastructure/menu/menu-versioning';
+
+export async function GET() {
+  const unauthorized = await requireAdmin();
+  if (unauthorized) return unauthorized;
+
+  const categories = await readMenuCategories();
+  const versions = await listMenuVersions(categories);
+  return NextResponse.json({ versions });
+}
+
+interface CreateCheckpointBody {
+  label?: string;
+}
+
+export async function POST(request: Request) {
+  const unauthorized = await requireAdmin();
+  if (unauthorized) return unauthorized;
+
+  const body = (await request.json()) as CreateCheckpointBody & { action?: string; versionId?: string };
+
+  if (body.action === 'reset-baseline') {
+    try {
+      const categories = await readMenuCategories();
+      const baseline = await resetMenuVersionHistory(categories);
+      const versions = await listMenuVersions(categories);
+      return NextResponse.json({ baseline, categories, versions });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Reset failed';
+      return NextResponse.json({ error: message }, { status: 400 });
+    }
+  }
+
+  if (body.action === 'restore') {
+    const versionId = body.versionId?.trim();
+    if (!versionId) {
+      return NextResponse.json({ error: 'versionId is required' }, { status: 400 });
+    }
+
+    try {
+      const restored = await restoreMenuVersion(
+        versionId,
+        persistMenuCategories,
+        readMenuCategories,
+      );
+      clearMenuCache();
+      const categories = await readMenuCategories();
+      const versions = await listMenuVersions(categories);
+      return NextResponse.json({ restored, categories, versions });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Restore failed';
+      const status = message === 'Version not found.' ? 404 : 400;
+      return NextResponse.json({ error: message }, { status });
+    }
+  }
+
+  const label = body.label?.trim() || 'Manual checkpoint';
+  const categories = await readMenuCategories();
+  const snapshot = await createMenuSnapshot(categories, label, 'manual');
+  const versions = await listMenuVersions(categories);
+
+  return NextResponse.json({ snapshot, versions }, { status: 201 });
+}

app/api/admin/session/route.ts

@@ -0,0 +1,15 @@
+import { NextResponse } from 'next/server';
+import { isMenuManagerEmail } from '@/domain/auth/menu-managers';
+import { getCustomerSession } from '@/infrastructure/auth/customer-session';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET() {
+  const session = await getCustomerSession();
+  const authenticated = session !== null && isMenuManagerEmail(session.email);
+
+  return NextResponse.json({
+    authenticated,
+    email: authenticated ? session!.email : null,
+  });
+}

app/api/admin/upload/route.ts

@@ -0,0 +1,46 @@
+import { NextResponse } from 'next/server';
+import { mkdir, writeFile } from 'fs/promises';
+import path from 'path';
+import { requireAdmin } from '@/infrastructure/auth/require-admin';
+
+const DISHES_DIR = path.join(process.cwd(), 'public', 'images', 'dishes');
+const MAX_FILE_SIZE = 5 * 1024 * 1024;
+
+function sanitizeFilename(filename: string): string {
+  return filename
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '');
+}
+
+export async function POST(request: Request) {
+  const unauthorized = await requireAdmin();
+  if (unauthorized) return unauthorized;
+
+  const formData = await request.formData();
+  const file = formData.get('file');
+
+  if (!(file instanceof File)) {
+    return NextResponse.json({ error: 'No file uploaded' }, { status: 400 });
+  }
+
+  if (!file.type.startsWith('image/')) {
+    return NextResponse.json({ error: 'Only image files are allowed' }, { status: 400 });
+  }
+
+  if (file.size > MAX_FILE_SIZE) {
+    return NextResponse.json({ error: 'File must be 5 MB or smaller' }, { status: 400 });
+  }
+
+  const originalName = file.name || 'dish-image.jpg';
+  const extension = path.extname(originalName).toLowerCase() || '.jpg';
+  const baseName = sanitizeFilename(path.basename(originalName, extension)) || 'dish-image';
+  const filename = `${baseName}${extension}`;
+
+  await mkdir(DISHES_DIR, { recursive: true });
+  const bytes = Buffer.from(await file.arrayBuffer());
+  await writeFile(path.join(DISHES_DIR, filename), bytes);
+
+  return NextResponse.json({ filename });
+}

app/api/auth/callback/google/route.ts

@@ -0,0 +1,79 @@
+import { NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import {
+  createCustomerSessionToken,
+  CUSTOMER_SESSION_COOKIE,
+  getCustomerSessionCookieOptions,
+} from '@/infrastructure/auth/customer-session';
+import {
+  fetchGoogleUserFromCode,
+  isGoogleOAuthConfigured,
+  verifyOAuthState,
+} from '@/infrastructure/auth/google-oauth';
+import {
+  getOAuthReturnCookieName,
+  sanitizeOAuthReturnPath,
+} from '@/infrastructure/auth/oauth-return';
+
+export const dynamic = 'force-dynamic';
+
+const OAUTH_STATE_COOKIE = 'shahi_google_oauth_state';
+
+function redirectToLogin(error: string, returnTo?: string) {
+  const loginUrl = new URL('/login', getOrigin());
+  loginUrl.searchParams.set('tab', 'customer');
+  loginUrl.searchParams.set('error', error);
+  if (returnTo && returnTo !== '/account') {
+    loginUrl.searchParams.set('returnTo', returnTo);
+  }
+  return NextResponse.redirect(loginUrl);
+}
+
+function getOrigin(): string {
+  return process.env.NEXT_PUBLIC_SITE_URL ?? 'http://localhost:3000';
+}
+
+export async function GET(request: Request) {
+  if (!isGoogleOAuthConfigured()) {
+    return redirectToLogin('google_not_configured');
+  }
+
+  const url = new URL(request.url);
+  const code = url.searchParams.get('code');
+  const state = url.searchParams.get('state');
+  const oauthError = url.searchParams.get('error');
+
+  const cookieStore = await cookies();
+  const returnTo = sanitizeOAuthReturnPath(cookieStore.get(getOAuthReturnCookieName())?.value);
+  cookieStore.delete(getOAuthReturnCookieName());
+
+  if (oauthError) {
+    return redirectToLogin('google_denied', returnTo);
+  }
+
+  const storedState = cookieStore.get(OAUTH_STATE_COOKIE)?.value;
+  cookieStore.delete(OAUTH_STATE_COOKIE);
+
+  if (!verifyOAuthState(state) || state !== storedState) {
+    return redirectToLogin('invalid_state', returnTo);
+  }
+
+  if (!code) {
+    return redirectToLogin('missing_code', returnTo);
+  }
+
+  const user = await fetchGoogleUserFromCode(code);
+  if (!user) {
+    return redirectToLogin('google_failed', returnTo);
+  }
+
+  cookieStore.set(
+    CUSTOMER_SESSION_COOKIE,
+    createCustomerSessionToken(user),
+    getCustomerSessionCookieOptions(),
+  );
+
+  const response = NextResponse.redirect(new URL(returnTo, getOrigin()));
+  response.headers.set('Cache-Control', 'no-store');
+  return response;
+}

app/api/auth/customer/logout/route.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import {
+  CUSTOMER_SESSION_COOKIE,
+  getClearedCustomerSessionCookieOptions,
+} from '@/infrastructure/auth/customer-session';
+import {
+  ADMIN_SESSION_COOKIE,
+  getAdminSessionCookieOptions,
+} from '@/infrastructure/auth/admin-session';
+
+export async function POST() {
+  const cookieStore = await cookies();
+  const clearedCustomer = getClearedCustomerSessionCookieOptions();
+  const clearedAdmin = { ...getAdminSessionCookieOptions(), maxAge: 0, expires: new Date(0) };
+
+  cookieStore.set(CUSTOMER_SESSION_COOKIE, '', clearedCustomer);
+  cookieStore.delete({ name: CUSTOMER_SESSION_COOKIE, path: '/' });
+
+  cookieStore.set(ADMIN_SESSION_COOKIE, '', clearedAdmin);
+  cookieStore.delete({ name: ADMIN_SESSION_COOKIE, path: '/' });
+
+  const response = NextResponse.json({ ok: true });
+  response.cookies.set(CUSTOMER_SESSION_COOKIE, '', clearedCustomer);
+  response.cookies.set(ADMIN_SESSION_COOKIE, '', clearedAdmin);
+  response.headers.set('Cache-Control', 'no-store');
+  return response;
+}

app/api/auth/customer/session/route.ts

@@ -0,0 +1,16 @@
+import { NextResponse } from 'next/server';
+import { isMenuManagerEmail } from '@/domain/auth/menu-managers';
+import { getCustomerSession } from '@/infrastructure/auth/customer-session';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET() {
+  const session = await getCustomerSession();
+  const email = session?.email ?? null;
+  return NextResponse.json({
+    authenticated: Boolean(session),
+    email,
+    name: session?.name ?? null,
+    isMenuManager: isMenuManagerEmail(email),
+  });
+}

app/api/auth/google/route.ts

@@ -0,0 +1,47 @@
+import { NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import {
+  buildGoogleAuthUrl,
+  createOAuthState,
+  isGoogleOAuthConfigured,
+} from '@/infrastructure/auth/google-oauth';
+import {
+  getOAuthReturnCookieName,
+  sanitizeOAuthReturnPath,
+} from '@/infrastructure/auth/oauth-return';
+
+export const dynamic = 'force-dynamic';
+
+const OAUTH_STATE_COOKIE = 'shahi_google_oauth_state';
+
+export async function GET(request: Request) {
+  if (!isGoogleOAuthConfigured()) {
+    return NextResponse.redirect(new URL('/login?tab=customer&error=google_not_configured', getOrigin()));
+  }
+
+  const url = new URL(request.url);
+  const returnTo = sanitizeOAuthReturnPath(url.searchParams.get('returnTo'));
+
+  const state = createOAuthState();
+  const cookieStore = await cookies();
+  cookieStore.set(OAUTH_STATE_COOKIE, state, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+    path: '/',
+    maxAge: 600,
+  });
+  cookieStore.set(getOAuthReturnCookieName(), returnTo, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+    path: '/',
+    maxAge: 600,
+  });
+
+  return NextResponse.redirect(buildGoogleAuthUrl(state));
+}
+
+function getOrigin(): string {
+  return process.env.NEXT_PUBLIC_SITE_URL ?? 'http://localhost:3000';
+}

app/api/menu/route.ts

@@ -0,0 +1,9 @@
+import { NextResponse } from 'next/server';
+import { readMenuCategories } from '@/infrastructure/menu/menu-persistence';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET() {
+  const categories = await readMenuCategories();
+  return NextResponse.json({ categories });
+}