test

Author: Sparths

app/api/auth/csrf/route.tsx

@@ -0,0 +1,40 @@
+// =================================
+// app/api/auth/csrf/route.tsx
+// =================================
+
+import { NextResponse } from 'next/server';
+import { generateCSRFToken } from '@/lib/security/csrf-protection';
+import { rateLimit, createRateLimitHeaders } from "@/lib/security/rate-limiter-config";
+
+// GET: Get CSRF token
+export async function GET(request: Request) {
+  try {
+    // Apply rate limiting
+    const rateLimitResult = await rateLimit(request, 'default');
+    if (!rateLimitResult.success) {
+      return new NextResponse(
+        JSON.stringify({ error: 'Too many requests. Please try again later.' }),
+        {
+          status: 429,
+          headers: {
+            'Content-Type': 'application/json',
+            ...createRateLimitHeaders(rateLimitResult),
+          }
+        }
+      );
+    }
+
+    const token = generateCSRFToken();
+    
+    return NextResponse.json(
+      { token },
+      { headers: createRateLimitHeaders(rateLimitResult) }
+    );
+  } catch (error) {
+    console.error("Error generating CSRF token:", error);
+    return NextResponse.json(
+      { error: "Failed to generate CSRF token" },
+      { status: 500 }
+    );
+  }
+}

app/api/auth/session/route.tsx

@@ -0,0 +1,117 @@
+// =================================
+// app/api/auth/session/route.tsx
+// =================================
+
+import { NextResponse } from 'next/server';
+import { rateLimit, createRateLimitHeaders } from "@/lib/security/rate-limiter-config";
+import supabase from '@/lib/supabase';
+
+// GET: Get current session information
+export async function GET(request: Request) {
+  try {
+    // Apply rate limiting
+    const rateLimitResult = await rateLimit(request, 'default');
+    if (!rateLimitResult.success) {
+      return new NextResponse(
+        JSON.stringify({ error: 'Too many requests. Please try again later.' }),
+        {
+          status: 429,
+          headers: {
+            'Content-Type': 'application/json',
+            ...createRateLimitHeaders(rateLimitResult),
+          }
+        }
+      );
+    }
+
+    // Get session from Supabase Auth
+    const authHeader = request.headers.get('authorization');
+    if (!authHeader) {
+      return NextResponse.json(
+        { session: null },
+        { headers: createRateLimitHeaders(rateLimitResult) }
+      );
+    }
+
+    // For now, return a basic response
+    // In a full implementation, you would verify the session token
+    return NextResponse.json(
+      { session: null },
+      { headers: createRateLimitHeaders(rateLimitResult) }
+    );
+  } catch (error) {
+    console.error("Error getting session:", error);
+    return NextResponse.json(
+      { error: "Failed to get session" },
+      { status: 500 }
+    );
+  }
+}
+
+// POST: Create a new session (login)
+export async function POST(request: Request) {
+  try {
+    // Apply rate limiting
+    const rateLimitResult = await rateLimit(request, 'users_login');
+    if (!rateLimitResult.success) {
+      return new NextResponse(
+        JSON.stringify({ error: 'Too many login attempts. Please try again later.' }),
+        {
+          status: 429,
+          headers: {
+            'Content-Type': 'application/json',
+            ...createRateLimitHeaders(rateLimitResult),
+          }
+        }
+      );
+    }
+
+    // This would handle session creation
+    // For now, redirect to the main users login endpoint
+    return NextResponse.json(
+      { message: "Use /api/users?action=login for authentication" },
+      { 
+        status: 400,
+        headers: createRateLimitHeaders(rateLimitResult)
+      }
+    );
+  } catch (error) {
+    console.error("Error creating session:", error);
+    return NextResponse.json(
+      { error: "Failed to create session" },
+      { status: 500 }
+    );
+  }
+}
+
+// DELETE: Logout/destroy session
+export async function DELETE(request: Request) {
+  try {
+    // Apply rate limiting
+    const rateLimitResult = await rateLimit(request, 'default');
+    if (!rateLimitResult.success) {
+      return new NextResponse(
+        JSON.stringify({ error: 'Too many requests. Please try again later.' }),
+        {
+          status: 429,
+          headers: {
+            'Content-Type': 'application/json',
+            ...createRateLimitHeaders(rateLimitResult),
+          }
+        }
+      );
+    }
+
+    // Handle logout logic here
+    return NextResponse.json(
+      { success: true },
+      { headers: createRateLimitHeaders(rateLimitResult) }
+    );
+  } catch (error) {
+    console.error("Error destroying session:", error);
+    return NextResponse.json(
+      { error: "Failed to destroy session" },
+      { status: 500 }
+    );
+  }
+}