Ihr Anmeldecode lautet:
${code}
Der Code ist 5 Minuten gültig.
Wenn Sie sich nicht angemeldet haben, ignorieren Sie diese E-Mail.
`, + }).catch(() => {}) + } + + return NextResponse.json({ + ok: true, + twoFactorRequired: true, + method, + challenge, + // mask email for display + maskedEmail: maskEmail(user.email), + message: method === 'email' + ? `Ein 6-stelliger Code wurde an ${maskEmail(user.email)} gesendet.` + : 'Bitte den Code aus Ihrer Authenticator-App eingeben.', + }) } - // Create session token: base64(payload).hmac - const crypto = await import('crypto') - const payload = { - sub: 'admin', - iat: Date.now(), - exp: Date.now() + 7 * 24 * 3600 * 1000, // 7 days - } - const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url') - const key = process.env.AUTH_SECRET || adminPassword - const signature = crypto - .createHmac('sha256', key) - .update(payloadB64) - .digest('base64url') - const token = `${payloadB64}.${signature}` + // --- No 2FA → set session immediately --- + await db.user.update({ where: { id: user.id }, data: { lastLoginAt: new Date() } }) + const token = createSessionToken({ sub: user.id, email: user.email, role: user.role }) const res = NextResponse.json({ ok: true, redirect: redirect || '/', + user: { id: user.id, email: user.email, name: user.name, role: user.role }, }) res.cookies.set('aos-session', token, { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', path: '/', - maxAge: 7 * 24 * 3600, // 7 days + maxAge: 7 * 24 * 3600, }) return res - } catch { - return NextResponse.json({ error: 'login failed' }, { status: 500 }) + } catch (err) { + const msg = err instanceof Error ? err.message : 'internal server error' + return NextResponse.json({ error: msg }, { status: 500 }) } } + +function maskEmail(email: string): string { + const [local, domain] = email.split('@') + if (!domain) return email + const visible = local.slice(0, Math.max(1, Math.min(2, local.length - 1))) + return `${visible}${'•'.repeat(Math.max(2, local.length - 2))}@${domain}` +} diff --git a/src/app/api/auth/login/verify/route.ts b/src/app/api/auth/login/verify/route.ts new file mode 100644 index 0000000..5d26852 --- /dev/null +++ b/src/app/api/auth/login/verify/route.ts @@ -0,0 +1,128 @@ +import { NextResponse } from 'next/server' +import { z } from 'zod' +import { db } from '@/lib/db' +import { + verifyLoginChallenge, + createSessionToken, + verifyTotp, + verifyOtpCode, + consumeBackupCode, + hashOtpCode, + otpMaxAttempts, +} from '@/lib/auth' + +export const dynamic = 'force-dynamic' + +const verifySchema = z.object({ + challenge: z.string().min(1), + code: z.string().min(4).max(40), + redirect: z.string().optional(), +}) + +// POST /api/auth/login/verify +// +// Step 2 of the login flow. Validates the challenge token (issued by step 1) +// and verifies the OTP code: +// - method='totp' → code verified against the stored TOTP secret +// - method='email' → code verified against a stored OtpCode row (hashed) +// - 10-char backup codes are also accepted as a recovery path. +// +// On success: sets the session cookie + updates lastLoginAt. On failure: +// 401 with a remaining-attempts hint (after 5 wrong attempts the latest +// code is invalidated and the user must restart login). +export async function POST(req: Request) { + try { + const parsed = verifySchema.safeParse(await req.json()) + if (!parsed.success) { + return NextResponse.json({ error: 'Code fehlt oder ist ungültig.' }, { status: 400 }) + } + const { challenge, code, redirect } = parsed.data + + const ch = verifyLoginChallenge(challenge) + if (!ch) { + return NextResponse.json({ error: 'Sitzung abgelaufen — bitte erneut anmelden.' }, { status: 401 }) + } + + const user = await db.user.findUnique({ + where: { id: ch.sub }, + select: { id: true, email: true, name: true, role: true, twoFactorMethod: true, twoFactorSecret: true, twoFactorBackup: true, twoFactorEnabled: true }, + }) + if (!user || !user.twoFactorEnabled) { + return NextResponse.json({ error: '2FA nicht aktiv — bitte erneut anmelden.' }, { status: 400 }) + } + + const normalizedCode = code.trim().replace(/\s/g, '') + + // --- Try TOTP --- + if (ch.method === 'totp' && user.twoFactorSecret) { + if (verifyTotp(normalizedCode, user.twoFactorSecret)) { + return await finishLogin(user, redirect) + } + } + + // --- Try email OTP (look up the latest unused code for this user+purpose) --- + if (ch.method === 'email') { + const otp = await db.otpCode.findFirst({ + where: { + userId: user.id, + purpose: 'login', + consumedAt: null, + expiresAt: { gt: new Date() }, + }, + orderBy: { createdAt: 'desc' }, + }) + if (!otp) { + return NextResponse.json({ error: 'Kein gültiger Code. Bitte erneut anmelden.' }, { status: 401 }) + } + if (otp.attempts >= otpMaxAttempts()) { + await db.otpCode.update({ where: { id: otp.id }, data: { consumedAt: new Date() } }) + return NextResponse.json({ error: 'Zu viele Versuche — bitte erneut anmelden.' }, { status: 429 }) + } + if (verifyOtpCode(normalizedCode, otp.codeHash)) { + await db.otpCode.update({ where: { id: otp.id }, data: { consumedAt: new Date() } }) + return await finishLogin(user, redirect) + } + await db.otpCode.update({ where: { id: otp.id }, data: { attempts: { increment: 1 } } }) + const remaining = otpMaxAttempts() - (otp.attempts + 1) + return NextResponse.json( + { error: 'Falscher Code.', remainingAttempts: Math.max(0, remaining) }, + { status: 401 } + ) + } + + // --- Try backup code (recovery, 10 chars, format XXXX-XXXX-XX) --- + if (user.twoFactorBackup && normalizedCode.length >= 8) { + const { match, remainingHashed } = consumeBackupCode(normalizedCode, user.twoFactorBackup) + if (match) { + await db.user.update({ where: { id: user.id }, data: { twoFactorBackup: remainingHashed } }) + return await finishLogin(user, redirect) + } + } + + return NextResponse.json({ error: 'Ungültiger Code.' }, { status: 401 }) + } catch (err) { + const msg = err instanceof Error ? err.message : 'internal server error' + return NextResponse.json({ error: msg }, { status: 500 }) + } +} + +async function finishLogin( + user: { id: string; email: string; name: string; role: string }, + redirect?: string +) { + await db.user.update({ where: { id: user.id }, data: { lastLoginAt: new Date() } }) + const token = createSessionToken({ sub: user.id, email: user.email, role: user.role }) + const res = NextResponse.json({ + ok: true, + redirect: redirect || '/', + user: { id: user.id, email: user.email, name: user.name, role: user.role }, + }) + res.cookies.set('aos-session', token, { + httpOnly: true, + secure: process.env.NODE_ENV === 'production', + sameSite: 'lax', + path: '/', + maxAge: 7 * 24 * 3600, + }) + return res +} diff --git a/src/app/api/auth/me/route.ts b/src/app/api/auth/me/route.ts new file mode 100644 index 0000000..0117237 --- /dev/null +++ b/src/app/api/auth/me/route.ts @@ -0,0 +1,26 @@ +import { NextResponse } from 'next/server' +import { getCurrentUser } from '@/lib/session' + +export const dynamic = 'force-dynamic' + +// GET /api/auth/me +// Returns the currently authenticated user (from the session cookie) or 401. +// Used by the frontend to hydrate the current session + show 2FA status. +export async function GET() { + const user = await getCurrentUser() + if (!user) { + return NextResponse.json({ error: 'unauthorized' }, { status: 401 }) + } + return NextResponse.json({ + user: { + id: user.id, + email: user.email, + name: user.name, + role: user.role, + emailVerifiedAt: user.emailVerifiedAt, + twoFactorEnabled: user.twoFactorEnabled, + twoFactorMethod: user.twoFactorMethod, + lastLoginAt: user.lastLoginAt, + }, + }) +} diff --git a/src/app/api/auth/register/route.ts b/src/app/api/auth/register/route.ts new file mode 100644 index 0000000..a1b59df --- /dev/null +++ b/src/app/api/auth/register/route.ts @@ -0,0 +1,106 @@ +import { NextResponse } from 'next/server' +import { z } from 'zod' +import { db } from '@/lib/db' +import { hashPassword, validatePasswordStrength } from '@/lib/auth' + +export const dynamic = 'force-dynamic' + +const registerSchema = z.object({ + name: z.string().min(1).max(100), + email: z.string().email().max(200).toLowerCase(), + password: z.string().min(8).max(200), +}) + +// POST /api/auth/register +// +// Email + password registration. Creates (or claims) a user account. +// +// Claim flow: if the email already belongs to a seeded User with no +// passwordHash (e.g. demo fixtures), registration sets the password on +// that existing user instead of failing — this lets seeded team members +// claim their accounts. +// +// Role assignment: +// - First account with a password on the system → owner (bootstrap) +// - Everyone else → 'member' (default staff role; can be elevated by an +// owner in settings later). +// +// Email verification: a verification code is emailed if SMTP is configured. +// Until verified, the user can still log in (verification is encouraged but +// not blocking for this single-tenant agency tool). Resend via /verify-email. +export async function POST(req: Request) { + try { + const parsed = registerSchema.safeParse(await req.json()) + if (!parsed.success) { + return NextResponse.json({ error: 'Angaben ungültig', details: parsed.error.flatten() }, { status: 400 }) + } + const { name, email, password } = parsed.data + + const pwError = validatePasswordStrength(password) + if (pwError) { + return NextResponse.json({ error: pwError }, { status: 400 }) + } + + // Check for an existing user with this email that already has a password + // (claimed) — that's a real conflict. + const existing = await db.user.findUnique({ where: { email } }) + if (existing?.passwordHash) { + return NextResponse.json( + { error: 'Für diese E-Mail existiert bereits ein Konto. Bitte anmelden.' }, + { status: 409 } + ) + } + + const passwordHash = hashPassword(password) + + // Decide the role: first account with a password becomes the owner. + const usersWithPassword = await db.user.count({ where: { NOT: { passwordHash: null } } }) + const role = usersWithPassword === 0 ? 'owner' : 'member' + + let user + if (existing) { + // Claim the seeded account (keep id, role may be elevated if first). + user = await db.user.update({ + where: { id: existing.id }, + data: { name, passwordHash, role: usersWithPassword === 0 ? 'owner' : existing.role }, + }) + } else { + user = await db.user.create({ + data: { name, email, passwordHash, role }, + }) + } + + // Send a verification email (best-effort; not blocking). + const { sendEmail } = await import('@/lib/email') + const { generateEmailOtp, hashOtpCode, otpExpiry } = await import('@/lib/auth') + const code = generateEmailOtp() + await db.otpCode.create({ + data: { + userId: user.id, + codeHash: hashOtpCode(code), + purpose: 'email-verify', + expiresAt: otpExpiry(), + }, + }) + await sendEmail({ + to: email, + subject: 'E-Mail bestätigen — AOS', + text: `Willkommen bei AOS!\n\nIhr Bestätigungscode lautet: ${code}\n\nDer Code ist 5 Minuten gültig.\n\nMit freundlichen Grüßen\nDFM Solutions`, + html: `Ihr Bestätigungscode lautet:
${code}
Der Code ist 5 Minuten gültig.
Mit freundlichen Grüßen
DFM Solutions
Ihr neuer Anmeldecode lautet:
${code}
Der Code ist 5 Minuten gültig.
`, + }).catch(() => {}) + } + + return NextResponse.json({ ok: true, message: 'Neuer Code gesendet.' }) + } catch (err) { + const msg = err instanceof Error ? err.message : 'internal server error' + return NextResponse.json({ error: msg }, { status: 500 }) + } +} diff --git a/src/app/api/auth/verify-email/route.ts b/src/app/api/auth/verify-email/route.ts new file mode 100644 index 0000000..15806ca --- /dev/null +++ b/src/app/api/auth/verify-email/route.ts @@ -0,0 +1,77 @@ +import { NextResponse } from 'next/server' +import { z } from 'zod' +import { db } from '@/lib/db' +import { verifyOtpCode, otpMaxAttempts } from '@/lib/auth' +import { getCurrentUser } from '@/lib/session' + +export const dynamic = 'force-dynamic' + +const schema = z.object({ + code: z.string().regex(/^\d{6}$/, 'Code muss 6 Ziffern sein.'), +}) + +// POST /api/auth/verify-email +// +// Verifies the email ownership OTP sent at registration. Marks the user's +// emailVerifiedAt. Can be called by: +// - an authenticated user verifying their own email, OR +// - an unauthenticated user with just the code (if they haven't logged in +// yet). In that case we look up by the most recent unconsumed code. +// +// Codes are single-use, 5-min TTL, max 5 attempts. +export async function POST(req: Request) { + try { + const parsed = schema.safeParse(await req.json()) + if (!parsed.success) { + return NextResponse.json({ error: 'Ungültiger Code.' }, { status: 400 }) + } + const { code } = parsed.data + + // Try the authenticated user first; fall back to the latest unconsumed code. + const me = await getCurrentUser() + let userId = me?.id + + let otp + if (userId) { + otp = await db.otpCode.findFirst({ + where: { userId, purpose: 'email-verify', consumedAt: null, expiresAt: { gt: new Date() } }, + orderBy: { createdAt: 'desc' }, + }) + } else { + // Find the most recent unconsumed email-verify code matching this code. + // This is a single-tenant tool with low volume — acceptable. + const candidates = await db.otpCode.findMany({ + where: { purpose: 'email-verify', consumedAt: null, expiresAt: { gt: new Date() } }, + orderBy: { createdAt: 'desc' }, + take: 20, + }) + otp = candidates.find((c) => verifyOtpCode(code, c.codeHash)) ?? null + if (otp) userId = otp.userId + } + + if (!otp || !userId) { + return NextResponse.json({ error: 'Kein gültiger Code gefunden — bitte neu anfordern.' }, { status: 404 }) + } + if (otp.attempts >= otpMaxAttempts()) { + await db.otpCode.update({ where: { id: otp.id }, data: { consumedAt: new Date() } }) + return NextResponse.json({ error: 'Zu viele Versuche — bitte neuen Code anfordern.' }, { status: 429 }) + } + + if (!verifyOtpCode(code, otp.codeHash)) { + await db.otpCode.update({ where: { id: otp.id }, data: { attempts: { increment: 1 } } }) + const remaining = otpMaxAttempts() - (otp.attempts + 1) + return NextResponse.json( + { error: 'Falscher Code.', remainingAttempts: Math.max(0, remaining) }, + { status: 401 } + ) + } + + await db.otpCode.update({ where: { id: otp.id }, data: { consumedAt: new Date() } }) + await db.user.update({ where: { id: userId }, data: { emailVerifiedAt: new Date() } }) + + return NextResponse.json({ ok: true, message: 'E-Mail bestätigt.' }) + } catch (err) { + const msg = err instanceof Error ? err.message : 'internal server error' + return NextResponse.json({ error: msg }, { status: 500 }) + } +} diff --git a/src/app/login/page.tsx b/src/app/login/page.tsx index 5983f38..580d3fb 100755 --- a/src/app/login/page.tsx +++ b/src/app/login/page.tsx @@ -2,65 +2,224 @@ import { Suspense, useState } from 'react' import { useRouter, useSearchParams } from 'next/navigation' +import Link from 'next/link' import { Button } from '@/components/ui/button' import { Input } from '@/components/ui/input' import { Label } from '@/components/ui/label' -import { Loader2, Lock } from 'lucide-react' +import { Loader2, Lock, Mail, ShieldCheck, ArrowLeft, RotateCw } from 'lucide-react' +import { toast } from 'sonner' + +type Step = + | { kind: 'credentials' } + | { kind: 'otp'; method: string; challenge: string; maskedEmail: string } function LoginForm() { const router = useRouter() const searchParams = useSearchParams() const redirect = searchParams.get('redirect') || '/' + const registered = searchParams.get('registered') === '1' + + const [step, setStep] = useState+ Zugang zum AOS — dfmpanel.eu +
++ Bereits ein Konto?{' '} + + Anmelden + +
+Nicht angemeldet.
+ ) : enabled ? ( + <> ++ Beim Anmelden wird zusätzlich zum Passwort ein einmaliger Code benötigt. Backup-Codes wurden bei der Einrichtung angezeigt — sicher aufbewahren. +
+ + ) : ( + <> ++ Schützen Sie Ihr Konto mit einem zweiten Faktor. Optional — kann jederzeit aktiviert oder deaktiviert werden. +
+ + + )} +