7 Commits

Author SHA1 Message Date
ade7ad19d6 Fix getCurrentSession for NextAuth v4 compatibility 2025-12-02 14:12:22 +00:00
d7297248c1 Fix all NextAuth v4 imports across codebase 2025-12-02 14:03:13 +00:00
534796edd7 feat: implement security enhancements (task 17)
- Add rate limiting for login, registration, and invitations
- Implement CSRF protection with SameSite cookies and security headers
- Configure secure session cookies with httpOnly and secure flags
- Enhance input sanitization for XSS and injection prevention
- Add comprehensive security tests (41 tests passing)
- Document security enhancements in SECURITY_ENHANCEMENTS.md

Requirements: 9.3, 9.4, 9.5
2025-12-02 01:29:35 +00:00
85c8a1650b Implement profile management (task 14)
- Add updateProfile and updatePassword server actions
- Add getUserProfile function with sensitive data protection
- Create ProfileForm component for name and email updates
- Create PasswordChangeForm component with current password verification
- Create profile page at /profile with all profile management features
- Add profile and invitations navigation links to main page
- Implement email uniqueness validation
- Implement password hashing on password change

Requirements: 7.1, 7.2, 7.3, 7.4, 7.5
2025-12-02 01:06:21 +00:00
895ceba55f Implement session management (Task 5)
- Configure JWT session strategy with 30-day expiration
- Implement session validation middleware for route protection
- Create logout functionality with session termination
- Handle session expiration automatically via JWT
- Add session helper functions (getCurrentSession, isAuthenticated)
- Protect routes: /, /list/*, /profile/*, /invitations/*
- Redirect unauthenticated users to login with callback URL
- Requirements: 2.4, 2.5, 3.1, 3.2, 3.4
2025-12-02 00:39:04 +00:00
211ed50503 Implement authentication functionality with login server action
- Created loginUser server action with credential validation
- Implemented password verification using bcrypt (via NextAuth authorize)
- Session creation on successful login handled by NextAuth
- Invalid credentials handled with appropriate error messages
- Added comprehensive unit tests for login functionality
- All tests passing (11/11)

Requirements: 2.1, 2.2
2025-12-02 00:36:03 +00:00
70121982a0 feat: implement user registration functionality
- Created registerUser server action with email/password validation
- Implemented password hashing with bcrypt (10 rounds)
- Added email uniqueness check to prevent duplicate registrations
- Created session after successful registration using NextAuth
- Added comprehensive validation for email format and password length (min 8 chars)
- Added email and password validation utilities to lib/validation.ts
- Removed PrismaAdapter from auth.ts (using JWT sessions only)
- Added vitest testing framework and configuration
- Created comprehensive unit tests for registration functionality
- All tests passing (6/6)

Requirements covered: 1.1, 1.2, 1.3, 1.4, 1.5
2025-12-02 00:03:23 +00:00