2 Commits

Include renames

Author	SHA1	Message	Date
Z User	ece8626137	fix: wrap login page in Suspense (useSearchParams prerender crash) ... - /login page used useSearchParams() without Suspense boundary - Next.js 16 requires Suspense for useSearchParams during static prerender - Extracted LoginForm component, wrapped in <Suspense> - Removed --webpack flag (default Turbopack build now works) - Build passes cleanly: ✓ Compiled successfully	2026-10-29 00:42:15 +00:00
Z User	17ceefe32a	feat: auth system (middleware + login) + remove .env from git + fix hardcoded token ... CRITICAL SECURITY FIXES: - src/middleware.ts: protects all routes except public ones (health, license check, seed-prod) Redirects unauthenticated users to /login, returns 401 for API routes - src/app/login/page.tsx: login page with password input - src/app/api/auth/login: HMAC-signed session cookie (7-day expiry) - src/app/api/auth/logout: clears session cookie - Top bar: Abmelden (logout) button now functional - .env removed from git tracking (secrets no longer in repo) - seed-prod: hardcoded admin token replaced with env MCP_API_TOKEN or random UUID - ADMIN_PASSWORD env var required for login (set in Dokploy env) Public routes (no auth needed): /api/health, /api/aos/seed-prod, /api/aos/licenses/check, /api/aos/licenses/validate /api/v1/* (token-auth'd), /api/mcp (token-auth'd), /login	2026-10-28 22:38:39 +00:00