50 lines
1.9 KiB
TypeScript
50 lines
1.9 KiB
TypeScript
import { NextResponse } from 'next/server';
|
|
import { UserStatus } from '@prisma/client';
|
|
import { prisma } from '../../../../lib/prisma';
|
|
import { verifyPassword } from '../../../../lib/auth';
|
|
import { signAccessToken, buildSessionCookie, clearSessionCookie } from '../../../../lib/jwt';
|
|
|
|
export async function POST(req: Request) {
|
|
try {
|
|
const body = await req.json();
|
|
const email = String(body.email ?? '').trim().toLowerCase();
|
|
const password = String(body.password ?? '');
|
|
|
|
if (!email || !password) {
|
|
return NextResponse.json({ error: 'Email and password are required' }, { status: 400 });
|
|
}
|
|
|
|
const user = await prisma.user.findUnique({ where: { email } });
|
|
if (!user) {
|
|
return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 });
|
|
}
|
|
|
|
const valid = await verifyPassword(password, user.passwordHash);
|
|
if (!valid) {
|
|
return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 });
|
|
}
|
|
|
|
if (!user.emailVerifiedAt) {
|
|
return NextResponse.json({ error: 'Email not verified yet' }, { status: 403 });
|
|
}
|
|
if (!user.approvedAt || user.status !== UserStatus.ACTIVE) {
|
|
const statusMessage =
|
|
user.status === UserStatus.REJECTED
|
|
? 'User access was rejected'
|
|
: user.status === UserStatus.REMOVED
|
|
? 'User has been removed'
|
|
: 'User is not approved yet';
|
|
return NextResponse.json({ error: statusMessage }, { status: 403 });
|
|
}
|
|
|
|
const token = await signAccessToken({ userId: user.id, role: user.role });
|
|
const res = NextResponse.json({ token, user: { id: user.id, role: user.role, email: user.email } });
|
|
res.headers.append('Set-Cookie', buildSessionCookie(token));
|
|
return res;
|
|
} catch (error) {
|
|
console.error('Login error', error);
|
|
const res = NextResponse.json({ error: 'Login failed' }, { status: 500 });
|
|
res.headers.append('Set-Cookie', clearSessionCookie());
|
|
return res;
|
|
}
|
|
}
|