kdlb9zs9n: Scaffold Next.js app and create the server session from a Minnect login

src/app/api/session/route.ts

@@ -0,0 +1,89 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { loginToMinnect, LoginError } from "@/lib/minnect";
+import { createSession, getSession } from "@/lib/session-store";
+import { SESSION_COOKIE, sessionCookieOptions } from "@/lib/cookie";
+
+// This route holds the session on the server. The browser talks only to this
+// app; Minnect tokens never leave the server (ADR-001).
+//
+// This task implements POST (sign in) and GET (who am I). DELETE/revoke and
+// token refresh are separate, later tasks and are not implemented here.
+
+export const runtime = "nodejs";
+
+function badRequest(message: string) {
+  return NextResponse.json({ error: message }, { status: 400 });
+}
+
+/**
+ * POST /api/session
+ * Body: { email, password }
+ * On success: sets the opaque session cookie, returns { name, email, pictureUrl }.
+ * On failure: no session, no cookie, one generic message.
+ */
+export async function POST(req: NextRequest) {
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    body = null;
+  }
+
+  const record = body && typeof body === "object" ? (body as Record<string, unknown>) : {};
+  const email = typeof record.email === "string" ? record.email : "";
+  const password = typeof record.password === "string" ? record.password : "";
+
+  if (!email || !password) {
+    return badRequest("Email and password are required.");
+  }
+
+  try {
+    const { person, tokens } = await loginToMinnect(email, password);
+
+    const sessionId = createSession({
+      profileAccessToken: tokens.profileAccessToken,
+      profileAccessTokenExpiresAt: tokens.profileAccessTokenExpiresAt,
+      profileRefreshToken: tokens.profileRefreshToken,
+      feedAccessToken: tokens.feedAccessToken,
+      person,
+      createdAt: Date.now(),
+    });
+
+    const res = NextResponse.json({
+      name: person.name,
+      email: person.email,
+      pictureUrl: person.pictureUrl,
+    });
+    res.cookies.set(SESSION_COOKIE, sessionId, sessionCookieOptions());
+    return res;
+  } catch (err) {
+    if (err instanceof LoginError) {
+      return NextResponse.json({ error: err.publicMessage }, { status: err.status });
+    }
+    // Never echo an unexpected error to the browser.
+    return NextResponse.json({ error: "Could not sign you in." }, { status: 500 });
+  }
+}
+
+/**
+ * GET /api/session
+ * Returns { name, email, pictureUrl } for the signed-in person, or 401
+ * { error: "sign_in" } when the session is missing or dead.
+ */
+export async function GET(req: NextRequest) {
+  const sessionId = req.cookies.get(SESSION_COOKIE)?.value;
+  if (!sessionId) {
+    return NextResponse.json({ error: "sign_in" }, { status: 401 });
+  }
+
+  const session = getSession(sessionId);
+  if (!session) {
+    return NextResponse.json({ error: "sign_in" }, { status: 401 });
+  }
+
+  return NextResponse.json({
+    name: session.person.name,
+    email: session.person.email,
+    pictureUrl: session.person.pictureUrl,
+  });
+}

src/app/layout.tsx

@@ -0,0 +1,15 @@
+import type { Metadata } from "next";
+import type { ReactNode } from "react";
+
+export const metadata: Metadata = {
+  title: "Minnect feed browser",
+  description: "Sign in with your Minnect account to read and write the home feed.",
+};
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}

src/app/page.tsx

@@ -0,0 +1,12 @@
+// Placeholder home page. The sign-in screen and the feed UI are built in
+// later tasks (tlv84yb7n and the feed tasks). This task delivers the server
+// session routes under /api/session.
+
+export default function HomePage() {
+  return (
+    <main style={{ maxWidth: 640, margin: "0 auto", padding: "2rem 1rem" }}>
+      <h1>Minnect feed browser</h1>
+      <p>The sign-in screen is built in a later task.</p>
+    </main>
+  );
+}