tyler/blackcanyontickets
1
0
Fork 0
Code Issues 8 Pull Requests Packages Projects Releases Wiki Activity

fix: Resolve authentication login loop preventing dashboard access

Browse Source 
## Problem
Users experienced infinite login loops where successful authentication would
redirect to dashboard, then immediately redirect back to login page.

## Root Cause
Client-server authentication mismatch due to httpOnly cookies:
- Login API sets httpOnly cookies using server-side Supabase client ✅
- Dashboard server reads httpOnly cookies correctly ✅
- Dashboard client script tried to read httpOnly cookies using client-side Supabase ❌

## Solution
1. Fixed Admin Dashboard: Removed non-existent `is_super_admin` column references
2. Created Auth Check API: Server-side auth validation for client scripts
3. Updated Admin API Router: Uses auth check API instead of client-side Supabase

## Key Changes
- src/pages/admin/dashboard.astro: Fixed database queries
- src/pages/api/admin/auth-check.ts: NEW server-side auth validation API
- src/lib/admin-api-router.ts: Uses API calls instead of client-side auth
- src/pages/api/auth/session.ts: Return 200 status for unauthenticated users
- src/pages/login.astro: Enhanced cache clearing and session management

## Testing
- Automated Playwright tests validate end-to-end login flow
- Manual testing confirms successful login without loops

## Documentation
- AUTHENTICATION_FIX.md: Complete technical documentation
- CLAUDE.md: Updated with authentication system notes

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
dzinesco
2025-07-13 10:19:04 -06:00
parent 7fe90e7330
commit f4f929912d
9 changed files with 584 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
CLAUDE.md
View File

@@ -244,4 +244,32 @@ The `/events/[id]/manage.astro` page is the core of the platform:
- **Performance**: Glassmorphism effects may impact mobile performance
- **Accessibility**: WCAG AA compliance maintained throughout
- **SEO**: Server-side rendering for public pages
- **Multi-tenant**: All features must respect organization boundaries
- **Multi-tenant**: All features must respect organization boundaries
## Authentication System - CRITICAL FIX APPLIED
### Login Loop Issue (RESOLVED)
**Problem**: Users experienced infinite login loops where successful authentication would redirect to dashboard, then immediately back to login page.
**Root Cause**: Client-server authentication mismatch due to httpOnly cookies:
- Login API sets httpOnly cookies using server-side Supabase client ✅
- Dashboard server reads httpOnly cookies correctly ✅
- Dashboard client script tried to read httpOnly cookies using client-side Supabase ❌
**Solution Implemented**:
1. **Fixed Admin Dashboard**: Removed non-existent `is_super_admin` column references in `/src/pages/admin/dashboard.astro`
2. **Created Auth Check API**: `/src/pages/api/admin/auth-check.ts` provides server-side auth validation for client scripts
3. **Updated Admin API Router**: `/src/lib/admin-api-router.ts` now uses auth check API instead of client-side Supabase
**Key Files Modified**:
- `/src/pages/admin/dashboard.astro` - Fixed database queries
- `/src/pages/api/admin/auth-check.ts` - NEW: Server-side auth validation API
- `/src/lib/admin-api-router.ts` - Uses API calls instead of client-side auth
- `/src/pages/api/auth/session.ts` - Return 200 status for unauthenticated users
- `/src/pages/login.astro` - Enhanced cache clearing and session management
**Testing**: Automated Playwright tests in `/test-login.js` validate end-to-end login flow
**Documentation**: See `AUTHENTICATION_FIX.md` for complete technical details
**⚠️ IMPORTANT**: Do NOT modify the authentication system without understanding this fix. The httpOnly cookie approach is intentional for security and requires server-side validation for client scripts.