9f912aed24
Added comprehensive authentication and authorization system: Authentication System: - Better Auth integration with session management - Login/logout pages and API routes - Middleware for route protection - Auth utilities and client libraries User Management: - User list, detail, and invite pages - User API endpoints (CRUD operations) - Session management for users - Profile settings page Role-Based Access Control: - Role management pages (list, create, edit) - Permission system with granular controls - Role assignment to users - Role API endpoints Admin Features: - Audit log page for tracking system events - Admin settings page - Audit service for logging user actions Additional Features: - Quotes management pages and components - SalesBldr API integration - Email service for notifications Configuration & Documentation: - Updated docker-compose.yml - MCP server configuration (mcp.json) - CVE-2025-55182 security review documentation - Standards guide and PRD documents - Re-enabling authentication documentation Database Migrations: - 012: Auth tables (users, sessions, accounts, verifications) - 013: Role tables (roles, permissions, role_permissions, user_roles) - 014: Admin settings table UI Updates: - Updated dashboard layout - Enhanced app layout with auth integration
70 lines
2.1 KiB
TypeScript
70 lines
2.1 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import type { NextRequest } from "next/server";
|
|
import { getSessionCookie } from "better-auth/cookies";
|
|
|
|
// Routes that don't require authentication
|
|
const publicRoutes = [
|
|
"/auth/sign-in",
|
|
"/auth/verify",
|
|
"/auth/2fa",
|
|
"/auth/setup",
|
|
"/api/auth",
|
|
];
|
|
|
|
// Routes that require admin or super-admin role
|
|
const adminRoutes = ["/admin"];
|
|
|
|
export async function middleware(request: NextRequest) {
|
|
const { pathname } = request.nextUrl;
|
|
|
|
// TEMPORARY: Authentication bypassed for private site access
|
|
// TODO: Re-enable authentication when site has public access
|
|
return NextResponse.next();
|
|
|
|
// Allow public routes
|
|
// if (publicRoutes.some((route) => pathname.startsWith(route))) {
|
|
// return NextResponse.next();
|
|
// }
|
|
|
|
// // Allow static files and API routes (except admin API)
|
|
// if (
|
|
// pathname.startsWith("/_next") ||
|
|
// pathname.startsWith("/favicon") ||
|
|
// pathname.includes(".")
|
|
// ) {
|
|
// return NextResponse.next();
|
|
// }
|
|
|
|
// // Check for session cookie
|
|
// const sessionCookie = getSessionCookie(request);
|
|
|
|
// if (!sessionCookie) {
|
|
// // Redirect to sign-in if no session
|
|
// const signInUrl = new URL("/auth/sign-in", request.url);
|
|
// signInUrl.searchParams.set("callbackUrl", pathname);
|
|
// return NextResponse.redirect(signInUrl);
|
|
// }
|
|
|
|
// // For admin routes, we need to verify the role
|
|
// // This is a basic check - the actual role verification happens in the API routes
|
|
// if (adminRoutes.some((route) => pathname.startsWith(route))) {
|
|
// // The session cookie exists, but we can't decode it here without the secret
|
|
// // Role-based access control is enforced at the API level
|
|
// // This middleware just ensures there's a session
|
|
// return NextResponse.next();
|
|
// }
|
|
|
|
// return NextResponse.next();
|
|
}
|
|
|
|
export const config = {
|
|
matcher: [
|
|
/*
|
|
* Match all request paths except for the ones starting with:
|
|
* - _next/static (static files)
|
|
* - _next/image (image optimization files)
|
|
* - favicon.ico (favicon file)
|
|
*/
|
|
"/((?!_next/static|_next/image|favicon.ico).*)",
|
|
],
|
|
};
|