route.ts

Go to the documentation of this file.

import { NextRequest, NextResponse } from 'next/server';
import { fieldpineServerApi } from '@/lib/server/fieldpineApi';
import { getStoreById, transformManifestStore } from '@/lib/stores';
import { cookies } from 'next/headers';
import jwt from 'jsonwebtoken';
import { promises as fs } from 'fs';
import path from 'path';
 
interface LoginRequest {
  username: string;
  password: string;
  storeId: string;
}
 
interface StaffRecord {
  f100?: string; // Staff ID
  f101?: string; // Staff Name
  f102?: string; // Active status
  f103?: string; // Password
  f134?: string; // Is Customer Rep
  f135?: string; // Is Account Rep
}
 
const MANIFEST_PATH = path.join(process.cwd(), 'data', 'config', 'stores-manifest.json');
 
/**
 * Read stores from manifest file
 */
async function readManifestStores() {
  try {
    const fileContent = await fs.readFile(MANIFEST_PATH, 'utf-8');
    const manifest = JSON.parse(fileContent);
    return manifest.stores || [];
  } catch (error) {
    console.warn('[Auth] Failed to read manifest:', error);
    return [];
  }
}
 
/**
 * Find store by friendly name (e.g., "iig", "cowra", "murwillumbah")
 */
async function findStoreByName(storeName: string) {
  // First try static stores
  const staticStore = getStoreById(storeName);
  if (staticStore) {
    return staticStore;
  }
 
  // Then check manifest
  const manifestStores = await readManifestStores();
  for (const manifestStore of manifestStores) {
    const transformed = transformManifestStore(manifestStore);
    if (transformed && transformed.id === storeName) {
      return transformed;
    }
  }
 
  return null;
}
 
/**
 * Determine user role based on staff record
 */
function determineUserRole(staffData: StaffRecord): 'staff' | 'employee' | 'admin' {
  const isCustomerRep = staffData.f134 === '1';
  const isAccountRep = staffData.f135 === '1';
  
  if (isCustomerRep || isAccountRep) {
    return 'employee';
  }
  
  return 'staff';
}
 
export async function POST(request: NextRequest) {
  try {
    const body: LoginRequest = await request.json();
    const { username, password, storeId } = body;
    
    console.log('[Auth] Login request received:', { username, storeId, hasPassword: !!password });
    
    if (!username || !password || !storeId) {
      return NextResponse.json(
        { error: 'Username, password, and store are required' },
        { status: 400 }
      );
    }
 
    // Get store configuration by friendly name
    const store = await findStoreByName(storeId.toLowerCase().trim());
    console.log('[Auth] Store lookup result:', store ? `Found: ${store.name}` : 'Not found', 'storeId:', storeId);
    
    if (!store) {
      return NextResponse.json(
        { error: `Store "${storeId}" not found. Please check the store name.` },
        { status: 400 }
      );
    }
 
    // Rate limiting - Get client IP from headers
    const clientId = request.headers.get('x-forwarded-for') || 
                    request.headers.get('x-real-ip') || 
                    request.headers.get('cf-connecting-ip') || 
                    'unknown';
    if (!fieldpineServerApi.checkClientRateLimit(clientId)) {
      return NextResponse.json(
        { error: 'Rate limit exceeded' },
        { status: 429 }
      );
    }
 
    console.log('[Auth] Login attempt for user:', username, 'at store:', store.name);
 
    // Authenticate with Fieldpine at the selected store URL
    const authResult = await fieldpineServerApi.authenticate(username, password, store.url);
    
    if (!authResult.success) {
      return NextResponse.json(
        { error: authResult.error || 'Authentication failed' },
        { status: 401 }
      );
    }
 
    // Get staff record to determine role
    let role: 'staff' | 'employee' | 'admin' = 'employee';
    try {
      const buckParams: Record<string, string> = {
        "3": "retailmax.elink.staff.list",
        "9": `f101,0,${username}`,
        "10": "134,135",
      };
 
      const staffResponse = await fieldpineServerApi.buckApiCall(
        buckParams,
        authResult.cookie,
        store.url
      );
 
      if (staffResponse?.DATS && staffResponse.DATS.length > 0) {
        const staffData: StaffRecord = staffResponse.DATS[0];
        role = determineUserRole(staffData);
      }
    } catch (error) {
      console.log('[Auth] Could not fetch staff role, defaulting to employee');
    }
 
    // Create secure session with auth data and store info
    const sessionData = {
      userId: username,
      username: username,
      authenticated: true,
      role: role,
      timestamp: Date.now(),
      storeId: store.id,
      storeName: store.name,
      storeUrl: store.url,
      storeType: store.type,
      fieldpineData: {
        valid: authResult.data?.valid,
        HomePage: authResult.data?.HomePage,
        RmSystem: authResult.data?.RmSystem
      },
      apiKey: authResult.cookie
    };
 
    // Set secure HTTP-only cookie
    const cookieStore = await cookies();
    
    // Determine if we should use secure cookies
    // In production, always use secure. Also check X-Forwarded-Proto for proxy scenarios
    const isProduction = process.env.NODE_ENV === 'production';
    const isHttps = request.headers.get('x-forwarded-proto') === 'https' || 
                    request.url.startsWith('https://');
    const shouldBeSecure = isProduction || isHttps;
    
    console.log('[Auth] Cookie settings:', { 
      isProduction, 
      isHttps, 
      shouldBeSecure,
      protocol: request.headers.get('x-forwarded-proto'),
      url: request.url.substring(0, 50)
    });
    
    cookieStore.set('fieldpine-session', JSON.stringify(sessionData), {
      httpOnly: true,
      secure: shouldBeSecure,
      sameSite: 'lax',
      maxAge: 60 * 60 * 8, // 8 hours
      path: '/' // Explicitly set path
    });
 
    console.log('[Auth] Login successful for user:', username, 'role:', role, 'store:', store.name);
 
    return NextResponse.json({
      success: true,
      user: { 
        id: username,
        name: username,
        username,
        role: role,
        authenticated: true,
        valid: authResult.data?.valid
      },
      store: {
        id: store.id,
        name: store.name,
        type: store.type,
        url: store.url,
      },
      data: authResult.data,
      redirect: authResult.data?.HomePage || '/pages/home'
    });
    
  } catch (error) {
    console.error('Login API error:', error);
    return NextResponse.json(
      { error: 'Internal server error' },
      { status: 500 }
    );
  }
}