Z User
17ceefe32a
CRITICAL SECURITY FIXES: - src/middleware.ts: protects all routes except public ones (health, license check, seed-prod) Redirects unauthenticated users to /login, returns 401 for API routes - src/app/login/page.tsx: login page with password input - src/app/api/auth/login: HMAC-signed session cookie (7-day expiry) - src/app/api/auth/logout: clears session cookie - Top bar: Abmelden (logout) button now functional - .env removed from git tracking (secrets no longer in repo) - seed-prod: hardcoded admin token replaced with env MCP_API_TOKEN or random UUID - ADMIN_PASSWORD env var required for login (set in Dokploy env) Public routes (no auth needed): /api/health, /api/aos/seed-prod, /api/aos/licenses/check, /api/aos/licenses/validate /api/v1/* (token-auth'd), /api/mcp (token-auth'd), /login
11 lines
237 B
TypeScript
11 lines
237 B
TypeScript
import { NextResponse } from 'next/server'
|
|
|
|
export const dynamic = 'force-dynamic'
|
|
|
|
// POST /api/auth/logout
|
|
export async function POST() {
|
|
const res = NextResponse.json({ ok: true })
|
|
res.cookies.delete('aos-session')
|
|
return res
|
|
}
|