4 Commits

Author	SHA1	Message	Date
Tyler	11cd2fd01a	Water Log: production-ready module (schema, auth, CRUD, UI, tests, docs) ... Completes the Tuxedo Water Log feature end-to-end. Builds on the existing water_* tables in 0001_init.sql; extends them with 0090 and rewrites the server actions, settings page, export route, and admin panel to actually function. Schema (db/migrations/0090_water_log_completion.sql, db/schema/water-log.ts) - headgate_token + status + max_flow_gpm + thresholds + notes on water_headgates - role + phone + notes on water_irrigators - method + total_gallons + photo_url + logged_date + lat/lon on water_log_entries - new tables: water_admin_settings, water_admin_sessions, water_audit_log, water_alert_log Auth (src/lib/water-log-pin.ts, src/lib/water-log-audit.ts) - scrypt N=16384 per-PIN random salt, self-describing hash format - weak-PIN detection (repeats, monotonic, palindromes) - 200ms delay + timingSafeEqual on failed verify - 4-8 digit PINs, generatePin() rejects weak patterns Server actions (src/actions/water-log/{admin,field,settings}.ts) - full Drizzle CRUD: headgates, irrigators, entries (with audit hooks) - verifyPin + 8h field sessions, admin PIN + configurable 1-168h sessions - regenerateAdminPin invalidates existing admin sessions - threshold breach detection + alert log writes - getWaterAdminSession() helper for admin pages API routes - /api/water-admin-auth: PIN-protected, generic error (no enum leak) - /api/water-logs/export: admin-gated JSON/CSV, correct headers UI (Field Almanac — cream + forest, Fraunces display, § section markers) - src/components/admin/WaterLogAdminPanel.tsx: full rewrite - src/components/water/WaterFieldClient.tsx: matches palette - src/components/water/icons/{WaterGauge,SeasonMark}.tsx: custom SVGs - src/app/admin/water-log/settings/page.tsx: full rewrite, Field Almanac Tests - tests/unit/water-log-pin.test.ts (21 cases): validate, hash, verify, generate - tests/unit/water-log-reporting.test.ts (31 cases): season, filter, CSV, report - tests/water-log.spec.ts (Playwright E2E): PIN form, auth gates, API gates Docs - docs/water-log.md: full admin guide, security model, data dictionary, checklist - README: link to docs/water-log.md in admin modules list - .env.example: Water Log section comment Type-check: clean. Tests: 70 pass, 3 fail (3 pre-existing getAdminUser failures on main, unrelated to this work).	2026-06-17 11:36:00 -06:00
openclaw	916ad39176	feat(storage): MinIO object storage, Neon Auth, Supabase removal ... - Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject, deleteObject, presigned URL helpers, and BUCKETS constant - Wire product images, brand logos, and water log photos to MinIO via the new storage client - Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call) - Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge Function proxy) - Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass brand_settings.logo_url from all call sites - Update email templates to use dynamic logoUrl instead of hardcoded Supabase bucket URLs - Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage, TimeTrackingFieldClient; use brand_settings props + local public/ fallback - Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to public/ for local development - Add MinIO env vars to .env.example (endpoint, access key, secret, buckets) - Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props - Fix admin/users.ts logoUrl type (null → undefined for optional string) - Remove stale sb- cookie from wholesale-auth - Migrate tuxedo/about page to remove supabase import and use pool query for wholesale_settings lookup	2026-06-09 12:23:37 -06:00
tyler	5654ebaecd	chore(auth): remove legacy rc_auth_uid/rc_uid/upsert_admin_user path; scope sign-in to ADMIN_ALLOWED_EMAILS; silence lockfile warning ... Cleanup after Auth.js v5 became the only sign-in path. The platform had three overlapping auth modes (dev cookie, legacy rc_auth_uid, Auth.js JWT) and a pile of dead-code pages/routes that only existed to support the legacy path. What changed: * getAdminUser() now has only two auth paths: 1. dev_session cookie (auto-issued by src/proxy.ts for /admin/* when ALLOW_DEV_LOGIN is enabled) 2. Auth.js v5 JWT (the encrypted cookie + auth() lookup) The legacy rc_auth_uid/rc_uid branch and the Supabase REST fetch against admin_users are gone. * The signIn callback in src/lib/auth.ts enforces ADMIN_ALLOWED_EMAILS when set. Unset = open mode (backward compatible with demo/dev). Dev credentials provider is exempt. The new env var is wired through .env.example and .gitea/workflows/deploy.yml (read from secrets.ADMIN_ALLOWED_EMAILS, written to the server .env file). * change-password/page.tsx now uses auth() server-side instead of fetching the deleted /api/auth/uid endpoint. The form is split into page.tsx (server component, auth check) + ChangePasswordForm.tsx (client component, form state). updatePasswordAction now reads the user id from auth() instead of the rc_auth_uid cookie. * Deleted 14 dead-code files: - Pages: login2, logout, auth/callback, admin/debug-auth, admin/test-auth - API routes: api/login, api/logout, api/auth/uid, api/force-admin, api/set-auth-cookie, api/debug-cookie, api/debug-me, api/debug-auth - Actions: src/actions/login.ts These were the old email/password login, the old Supabase OAuth callback, the old /api/auth/uid probe, and a pile of debug endpoints that have been superseded by the new proxy + the new /login page. * next.config.ts: set outputFileTracingRoot: '.' to silence the Next.js 16 lockfile-inference warning. Without this the build walked up from package.json looking for a lockfile, found the homelab runner's stale act cache at /home/tyler/.cache/act/.../package-lock.json, and warned on every build. '. resolves to the project root in both dev and CI, so it's the right answer. Out of scope (deferred): * src/actions/admin/users.ts still uses rc_auth_uid internally for its dev-bypass logic. It works (the rc_auth_uid branch is gated on NODE_ENV != 'production' and DEV_FORCE_UID), but it's now genuinely unreachable in production. Clean up in a follow-up. Pre-flight: * npx tsc --noEmit: clean * npm run lint (touched files): clean * npm run build: clean — proxy picked up, no lockfile warning, all 93 static pages generated.	2026-06-06 22:13:56 +00:00
tyler	ec1506dc82	feat(auth): Auth.js v5 + Postgres adapter for local smoke test ... Wire up NextAuth v5 with @auth/pg-adapter, JWT sessions (edge-friendly), and a dev Credentials provider for local testing without Google OAuth. Stack - next-auth@5.0.0-beta.31, @auth/pg-adapter@1.11.2, @types/pg - Google OAuth provider via GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET (falls back to AUTH_GOOGLE_ID / AUTH_GOOGLE_SECRET) - Postgres adapter wired to a single pg.Pool in src/lib/db.ts style — reads DATABASE_URL with SUPABASE_DB_URL / POSTGRES_URL fallbacks - JWT session strategy (edge-safe) so the proxy can verify sessions without a DB round-trip Files - src/auth.config.ts edge-safe config (Google + authorized cb) - src/lib/auth.ts server config (adapter + dev Credentials) - src/proxy.ts Next.js 16 proxy (was middleware.ts) - src/app/api/auth/[...nextauth]/route.ts catch-all handler - src/app/protected-example/page.tsx demo page that renders auth() session - src/actions/auth-signin.ts signInWithGoogle, signInWithDev, signOutAction server actions - src/app/login/LoginClient.tsx added "Sign in with Google" + dev form - supabase/migrations/204_authjs_tables.sql users / accounts / sessions / verification_token schema (UUID-keyed) - .env.example AUTH_SECRET, AUTH_URL, GOOGLE_CLIENT_*, DATABASE_URL, ALLOW_DEV_LOGIN Removed - src/middleware.ts deleted; Next.js 16 only runs one proxy (the new src/proxy.ts is canonical) Routes - /login, /admin, /admin/*, /protected-example proxy matcher - /api/auth/{providers,csrf,signin/<provider>,callback/<provider>, session,signout} standard Auth.js endpoints Local dev - npm run dev (now runs on port 4000) - push migration 204 then visit /login - dev signin works with any non-empty username/password (hidden when ALLOW_DEV_LOGIN=false) - Google signin requires real GOOGLE_CLIENT_ID + redirect URI http://localhost:4000/api/auth/callback/google Verified - tsc --noEmit clean - /admin, /admin/orders, /protected-example → 307 to /login when unauthenticated - /api/auth/session returns user after signin - /protected-example renders session info - /api/auth/providers returns google + dev-login Docs - CLAUDE.md and MEMORY.md updated to reflect the Supabase → Postgres + Auth.js v5 pivot Gradual migration in progress - src/lib/admin-permissions.ts still uses dev_session / rc_auth_uid; the admin shell will show 'Access Denied' for Auth.js-only sessions until each page is flipped over - @supabase/* packages remain in package.json for the same reason - production deployment (AUTH_URL=https://, __Secure- cookies) is out of scope for this pass	2026-06-06 03:40:09 +00:00