Replace entire repo content with code from /root/shahikitchen-google/

app/api/auth/callback/google/route.ts

@@ -0,0 +1,79 @@
+import { NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import {
+  createCustomerSessionToken,
+  CUSTOMER_SESSION_COOKIE,
+  getCustomerSessionCookieOptions,
+} from '@/infrastructure/auth/customer-session';
+import {
+  fetchGoogleUserFromCode,
+  isGoogleOAuthConfigured,
+  verifyOAuthState,
+} from '@/infrastructure/auth/google-oauth';
+import {
+  getOAuthReturnCookieName,
+  sanitizeOAuthReturnPath,
+} from '@/infrastructure/auth/oauth-return';
+
+export const dynamic = 'force-dynamic';
+
+const OAUTH_STATE_COOKIE = 'shahi_google_oauth_state';
+
+function redirectToLogin(error: string, returnTo?: string) {
+  const loginUrl = new URL('/login', getOrigin());
+  loginUrl.searchParams.set('tab', 'customer');
+  loginUrl.searchParams.set('error', error);
+  if (returnTo && returnTo !== '/account') {
+    loginUrl.searchParams.set('returnTo', returnTo);
+  }
+  return NextResponse.redirect(loginUrl);
+}
+
+function getOrigin(): string {
+  return process.env.NEXT_PUBLIC_SITE_URL ?? 'http://localhost:3000';
+}
+
+export async function GET(request: Request) {
+  if (!isGoogleOAuthConfigured()) {
+    return redirectToLogin('google_not_configured');
+  }
+
+  const url = new URL(request.url);
+  const code = url.searchParams.get('code');
+  const state = url.searchParams.get('state');
+  const oauthError = url.searchParams.get('error');
+
+  const cookieStore = await cookies();
+  const returnTo = sanitizeOAuthReturnPath(cookieStore.get(getOAuthReturnCookieName())?.value);
+  cookieStore.delete(getOAuthReturnCookieName());
+
+  if (oauthError) {
+    return redirectToLogin('google_denied', returnTo);
+  }
+
+  const storedState = cookieStore.get(OAUTH_STATE_COOKIE)?.value;
+  cookieStore.delete(OAUTH_STATE_COOKIE);
+
+  if (!verifyOAuthState(state) || state !== storedState) {
+    return redirectToLogin('invalid_state', returnTo);
+  }
+
+  if (!code) {
+    return redirectToLogin('missing_code', returnTo);
+  }
+
+  const user = await fetchGoogleUserFromCode(code);
+  if (!user) {
+    return redirectToLogin('google_failed', returnTo);
+  }
+
+  cookieStore.set(
+    CUSTOMER_SESSION_COOKIE,
+    createCustomerSessionToken(user),
+    getCustomerSessionCookieOptions(),
+  );
+
+  const response = NextResponse.redirect(new URL(returnTo, getOrigin()));
+  response.headers.set('Cache-Control', 'no-store');
+  return response;
+}

app/api/auth/customer/logout/route.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import {
+  CUSTOMER_SESSION_COOKIE,
+  getClearedCustomerSessionCookieOptions,
+} from '@/infrastructure/auth/customer-session';
+import {
+  ADMIN_SESSION_COOKIE,
+  getAdminSessionCookieOptions,
+} from '@/infrastructure/auth/admin-session';
+
+export async function POST() {
+  const cookieStore = await cookies();
+  const clearedCustomer = getClearedCustomerSessionCookieOptions();
+  const clearedAdmin = { ...getAdminSessionCookieOptions(), maxAge: 0, expires: new Date(0) };
+
+  cookieStore.set(CUSTOMER_SESSION_COOKIE, '', clearedCustomer);
+  cookieStore.delete({ name: CUSTOMER_SESSION_COOKIE, path: '/' });
+
+  cookieStore.set(ADMIN_SESSION_COOKIE, '', clearedAdmin);
+  cookieStore.delete({ name: ADMIN_SESSION_COOKIE, path: '/' });
+
+  const response = NextResponse.json({ ok: true });
+  response.cookies.set(CUSTOMER_SESSION_COOKIE, '', clearedCustomer);
+  response.cookies.set(ADMIN_SESSION_COOKIE, '', clearedAdmin);
+  response.headers.set('Cache-Control', 'no-store');
+  return response;
+}

app/api/auth/customer/session/route.ts

@@ -0,0 +1,16 @@
+import { NextResponse } from 'next/server';
+import { isMenuManagerEmail } from '@/domain/auth/menu-managers';
+import { getCustomerSession } from '@/infrastructure/auth/customer-session';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET() {
+  const session = await getCustomerSession();
+  const email = session?.email ?? null;
+  return NextResponse.json({
+    authenticated: Boolean(session),
+    email,
+    name: session?.name ?? null,
+    isMenuManager: isMenuManagerEmail(email),
+  });
+}

app/api/auth/google/route.ts

@@ -0,0 +1,47 @@
+import { NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+import {
+  buildGoogleAuthUrl,
+  createOAuthState,
+  isGoogleOAuthConfigured,
+} from '@/infrastructure/auth/google-oauth';
+import {
+  getOAuthReturnCookieName,
+  sanitizeOAuthReturnPath,
+} from '@/infrastructure/auth/oauth-return';
+
+export const dynamic = 'force-dynamic';
+
+const OAUTH_STATE_COOKIE = 'shahi_google_oauth_state';
+
+export async function GET(request: Request) {
+  if (!isGoogleOAuthConfigured()) {
+    return NextResponse.redirect(new URL('/login?tab=customer&error=google_not_configured', getOrigin()));
+  }
+
+  const url = new URL(request.url);
+  const returnTo = sanitizeOAuthReturnPath(url.searchParams.get('returnTo'));
+
+  const state = createOAuthState();
+  const cookieStore = await cookies();
+  cookieStore.set(OAUTH_STATE_COOKIE, state, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+    path: '/',
+    maxAge: 600,
+  });
+  cookieStore.set(getOAuthReturnCookieName(), returnTo, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+    path: '/',
+    maxAge: 600,
+  });
+
+  return NextResponse.redirect(buildGoogleAuthUrl(state));
+}
+
+function getOrigin(): string {
+  return process.env.NEXT_PUBLIC_SITE_URL ?? 'http://localhost:3000';
+}