kdlb9zs9n: Scaffold Next.js app and create the server session from a Minnect login

src/app/api/session/route.ts

@@ -0,0 +1,89 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { loginToMinnect, LoginError } from "@/lib/minnect";
+import { createSession, getSession } from "@/lib/session-store";
+import { SESSION_COOKIE, sessionCookieOptions } from "@/lib/cookie";
+
+// This route holds the session on the server. The browser talks only to this
+// app; Minnect tokens never leave the server (ADR-001).
+//
+// This task implements POST (sign in) and GET (who am I). DELETE/revoke and
+// token refresh are separate, later tasks and are not implemented here.
+
+export const runtime = "nodejs";
+
+function badRequest(message: string) {
+  return NextResponse.json({ error: message }, { status: 400 });
+}
+
+/**
+ * POST /api/session
+ * Body: { email, password }
+ * On success: sets the opaque session cookie, returns { name, email, pictureUrl }.
+ * On failure: no session, no cookie, one generic message.
+ */
+export async function POST(req: NextRequest) {
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    body = null;
+  }
+
+  const record = body && typeof body === "object" ? (body as Record<string, unknown>) : {};
+  const email = typeof record.email === "string" ? record.email : "";
+  const password = typeof record.password === "string" ? record.password : "";
+
+  if (!email || !password) {
+    return badRequest("Email and password are required.");
+  }
+
+  try {
+    const { person, tokens } = await loginToMinnect(email, password);
+
+    const sessionId = createSession({
+      profileAccessToken: tokens.profileAccessToken,
+      profileAccessTokenExpiresAt: tokens.profileAccessTokenExpiresAt,
+      profileRefreshToken: tokens.profileRefreshToken,
+      feedAccessToken: tokens.feedAccessToken,
+      person,
+      createdAt: Date.now(),
+    });
+
+    const res = NextResponse.json({
+      name: person.name,
+      email: person.email,
+      pictureUrl: person.pictureUrl,
+    });
+    res.cookies.set(SESSION_COOKIE, sessionId, sessionCookieOptions());
+    return res;
+  } catch (err) {
+    if (err instanceof LoginError) {
+      return NextResponse.json({ error: err.publicMessage }, { status: err.status });
+    }
+    // Never echo an unexpected error to the browser.
+    return NextResponse.json({ error: "Could not sign you in." }, { status: 500 });
+  }
+}
+
+/**
+ * GET /api/session
+ * Returns { name, email, pictureUrl } for the signed-in person, or 401
+ * { error: "sign_in" } when the session is missing or dead.
+ */
+export async function GET(req: NextRequest) {
+  const sessionId = req.cookies.get(SESSION_COOKIE)?.value;
+  if (!sessionId) {
+    return NextResponse.json({ error: "sign_in" }, { status: 401 });
+  }
+
+  const session = getSession(sessionId);
+  if (!session) {
+    return NextResponse.json({ error: "sign_in" }, { status: 401 });
+  }
+
+  return NextResponse.json({
+    name: session.person.name,
+    email: session.person.email,
+    pictureUrl: session.person.pictureUrl,
+  });
+}