No description
Find a file
Mannu fc0e75b5ad fix(admin): scope FamilyProvider out of admin routes, ensure cookies on admin fetches
Root causes:
- tia_admin_session is httpOnly so document.cookie could never read it → all
  client-side cookie checks always failed and redirected before any data fetched
- Sub-pages used localStorage.getItem("admin_token") which was never stored,
  and passed Authorization: Bearer null headers the server ignores

Fixes:
- FamilyProvider: use usePathname() hook instead of window.location.pathname
- admin/layout.tsx: rewrite as server component using verifyAdminSession()
  (new lib/admin-auth.ts helper that uses next/headers cookies()) → server-side
  redirect to /admin-login if session invalid; extract sidebar to AdminSidebar.tsx
- admin/page.tsx: remove broken document.cookie guard (layout handles auth now)
- admin-login/page.tsx: replace document.cookie check with GET /api/admin/auth call
- All 7 admin sub-pages: remove localStorage guard, remove Authorization: Bearer
  headers, add credentials: include to every fetch call

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-17 12:16:10 +05:30
docker/init-db chore: initial setup 2026-05-10 03:33:32 +05:30
docs Security hardening: auth, bcrypt, rate-limiting, RLS, audit 2026-05-16 23:11:01 +05:30
drizzle/manual Add audit_log and password_resets migrations 2026-05-17 00:01:07 +05:30
public Add menu navigation, sun/moon toggle, baby favicon 2026-05-10 11:34:00 +05:30
scripts Add security libs: auth, audit, rate-limit, scoped db 2026-05-16 23:10:56 +05:30
src fix(admin): scope FamilyProvider out of admin routes, ensure cookies on admin fetches 2026-05-17 12:16:10 +05:30
.dockerignore chore: add Dockerfile and docker config 2026-05-10 03:38:03 +05:30
.gitignore chore: initial setup 2026-05-10 03:33:32 +05:30
CLAUDE.md Rate limit controlled via RATE_LIMIT_ENABLED env 2026-05-17 01:12:15 +05:30
docker-compose.dev.yml chore: initial setup 2026-05-10 03:33:32 +05:30
Dockerfile Dockerfile: enable pnpm in builder stage 2026-05-16 22:38:02 +05:30
drizzle.config.ts feat: add Drizzle config and auth/family schema 2026-05-10 04:08:39 +05:30
next-env.d.ts Security hardening - all 8 patches applied 2026-05-16 23:59:43 +05:30
next.config.ts Security hardening: auth, bcrypt, rate-limiting, RLS, audit 2026-05-16 23:11:01 +05:30
package-lock.json fix: build errors and simplify auth 2026-05-10 04:14:23 +05:30
package.json Security hardening: auth, bcrypt, rate-limiting, RLS, audit 2026-05-16 23:11:01 +05:30
pnpm-lock.yaml Security hardening: auth, bcrypt, rate-limiting, RLS, audit 2026-05-16 23:11:01 +05:30
pnpm-workspace.yaml Fix FamilyProvider error handling 2026-05-11 00:12:00 +05:30
postcss.config.mjs chore: initial setup 2026-05-10 03:33:32 +05:30
Project_tia.md chore: initial setup 2026-05-10 03:33:32 +05:30
README.md chore: initial setup 2026-05-10 03:33:32 +05:30
tsconfig.json chore: initial setup 2026-05-10 03:33:32 +05:30

This is a Next.js project bootstrapped with create-next-app.

Getting Started

First, run the development server:

npm run dev
# or
yarn dev
# or
pnpm dev
# or
bun dev

Open http://localhost:3000 with your browser to see the result.

You can start editing the page by modifying app/page.tsx. The page auto-updates as you edit the file.

This project uses next/font to automatically optimize and load Geist, a new font family for Vercel.

Learn More

To learn more about Next.js, take a look at the following resources:

You can check out the Next.js GitHub repository - your feedback and contributions are welcome!

Deploy on Vercel

The easiest way to deploy your Next.js app is to use the Vercel Platform from the creators of Next.js.

Check out our Next.js deployment documentation for more details.