.env.example

@@ -1,11 +1,6 @@
-NEXT_PUBLIC_API_BASE_URL=http://localhost:3005
+NEXT_PUBLIC_API_BASE_URL="http://localhost:8000"
+INTERNAL_API_BASE_URL="http://localhost:3005"
+
 
 DATABASE_URL="postgresql://postgres:root@localhost:5432/rooftop?schema=public"
 JWT_SECRET="secret_key"
-
-#SUNGROW
-SUNGROW_SECRET_KEY=
-SUNGROW_APP_KEY=
-
-#CHINT
-NEXT_PUBLIC_CHINT_TOKEN=

.gitea/workflows/pr-build-check.yml

@@ -27,8 +27,8 @@ jobs:
       - name: Build
         run: npm run build
         env:
-          NEXT_PUBLIC_URL: 'http://localhost:3000'
+          NEXT_PUBLIC_URL: 'http://localhost:3005'
-          NEXT_PUBLIC_FORECAST_URL: 'http://localhost:3001'
+          NEXT_PUBLIC_FORECAST_URL: 'http://localhost:3005'
           DATABASE_URL: 'postgresql://dummy:dummy@localhost:5432/dummy'
           SMTP_EMAIL: 'dummy@example.com'
           SMTP_EMAIL_PASSWORD: 'dummy'

app/(admin)/adminDashboard/page.tsx

@@ -59,6 +59,7 @@ const AdminDashboard = () => {
   const router = useRouter();
   const pathname = usePathname();
   const searchParams = useSearchParams();
+  const [authChecked, setAuthChecked] = useState(false);
 
   // --- load CRM projects dynamically ---
   const [sites, setSites] = useState<CrmProject[]>([]);
@@ -67,6 +68,30 @@ const AdminDashboard = () => {
   // near other refs
   const loggingRef = useRef<HTMLDivElement | null>(null);
 
+  useEffect(() => {
+    const checkAuth = async () => {
+      try {
+        const res = await fetch('/api/auth/me', { credentials: 'include' });
+        if (!res.ok) {
+          router.replace('/login');
+          return;
+        }
+        const data = await res.json();
+        if (!data.user) {
+          router.replace('/login');
+          return;
+        }
+      } catch {
+        router.replace('/login');
+      } finally {
+        setAuthChecked(true);
+      }
+    };
+
+    checkAuth();
+  }, [router]);
+
+  
 
   useEffect(() => {
     setSitesLoading(true);
@@ -300,6 +325,10 @@ const AdminDashboard = () => {
   };
 
   // ---------- RENDER ----------
+  if (!authChecked) {
+    return <div>Checking authentication…</div>;
+  }
+  
   if (sitesLoading) {
     return (
       <DashboardLayout>

app/(auth)/login/page.tsx

@@ -1,11 +1,40 @@
+// app/login/page.tsx
+'use client';
+
 import Link from 'next/link';
-import { Metadata } from 'next';
+import React, { useEffect, useState } from 'react';
-import React from 'react';
+import { useRouter } from 'next/navigation';
 import ComponentsAuthLoginForm from '@/components/auth/components-auth-login-form';
 
-type Props = {}
+export default function LoginPage() {
+  const router = useRouter();
+  const [ready, setReady] = useState(false); // gate to avoid UI flash
+
+  useEffect(() => {
+    let cancelled = false;
+
+    (async () => {
+      try {
+        const res = await fetch('/api/auth/me', {
+          method: 'GET',
+          cache: 'no-store',
+          credentials: 'include', // safe even if same-origin
+        });
+        if (!cancelled && res.ok) {
+          router.replace('/adminDashboard');
+          return;
+        }
+      } catch {
+        // ignore errors; just show the form
+      }
+      if (!cancelled) setReady(true);
+    })();
+
+    return () => { cancelled = true; };
+  }, [router]);
+
+  if (!ready) return null; // or a small spinner if you prefer
 
-const LoginPage = (props: Props) => {
   return (
     <div className="relative min-h-screen overflow-hidden bg-[#060818] text-white">
       {/* Background gradient layer */}
@@ -53,7 +82,7 @@ const LoginPage = (props: Props) => {
 
               {/* Footer link */}
               <div className="mt-6 text-sm text-gray-200 dark:text-gray-300">
-                                Don’t have an account?{" "}
+                Don’t have an account?{' '}
                 <Link
                   href="/register"
                   className="text-yellow-400 font-semibold underline transition hover:text-white"
@@ -67,7 +96,5 @@ const LoginPage = (props: Props) => {
       </div>
     </div>
   );
-};
+}
 
-
-export default LoginPage

components/layouts/header.tsx

@@ -72,7 +72,7 @@ useEffect(() => {
 }, [pathname]); // re-fetch on route change (after login redirect)
 
   const handleLogout = async () => {
-    await fetch('/api/auth/logout', { method: 'POST' });
+    await fetch('/api/logout', { method: 'POST' });
     setUser(null);
     router.push('/login'); // go to login
   };

package-lock.json

@@ -31,6 +31,7 @@
                 "he": "^1.2.0",
                 "html2canvas": "^1.4.1",
                 "i18next": "^22.4.10",
+                "jose": "^6.0.12",
                 "jsonwebtoken": "^9.0.2",
                 "jspdf": "^3.0.1",
                 "next": "14.0.3",
@@ -7107,6 +7108,15 @@
                 "jiti": "bin/jiti.js"
             }
         },
+        "node_modules/jose": {
+            "version": "6.0.12",
+            "resolved": "https://registry.npmjs.org/jose/-/jose-6.0.12.tgz",
+            "integrity": "sha512-T8xypXs8CpmiIi78k0E+Lk7T2zlK4zDyg+o1CZ4AkOHgDg98ogdP2BeZ61lTFKFyoEwJ9RgAgN+SdM3iPgNonQ==",
+            "license": "MIT",
+            "funding": {
+                "url": "https://github.com/sponsors/panva"
+            }
+        },
         "node_modules/js-sdsl": {
             "version": "4.2.0",
             "resolved": "https://registry.npmjs.org/js-sdsl/-/js-sdsl-4.2.0.tgz",
@@ -14693,6 +14703,11 @@
             "resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.0.tgz",
             "integrity": "sha512-gFqAIbuKyyso/3G2qhiO2OM6shY6EPP/R0+mkDbyspxKazh8BXDC5FiFsUjlczgdNz/vfra0da2y+aHrusLG/Q=="
         },
+        "jose": {
+            "version": "6.0.12",
+            "resolved": "https://registry.npmjs.org/jose/-/jose-6.0.12.tgz",
+            "integrity": "sha512-T8xypXs8CpmiIi78k0E+Lk7T2zlK4zDyg+o1CZ4AkOHgDg98ogdP2BeZ61lTFKFyoEwJ9RgAgN+SdM3iPgNonQ=="
+        },
         "js-sdsl": {
             "version": "4.2.0",
             "resolved": "https://registry.npmjs.org/js-sdsl/-/js-sdsl-4.2.0.tgz",

package.json

@@ -32,6 +32,7 @@
         "he": "^1.2.0",
         "html2canvas": "^1.4.1",
         "i18next": "^22.4.10",
+        "jose": "^6.0.12",
         "jsonwebtoken": "^9.0.2",
         "jspdf": "^3.0.1",
         "next": "14.0.3",

pages/api/logout.ts

@@ -1,20 +1,22 @@
-// pages/api/auth/logout.ts
+// pages/api/logout.ts  ->  /api/logout
-import type { NextApiRequest, NextApiResponse } from "next";
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { serialize } from 'cookie';
 
 export default function handler(req: NextApiRequest, res: NextApiResponse) {
-  const isProd = process.env.NODE_ENV === "production";
+  const isProd = process.env.NODE_ENV === 'production';
-  res.setHeader(
+
-    "Set-Cookie",
+  const setCookie = serialize('token', '', {
-    [
+    httpOnly: true,
-      "token=", // empty token
+    secure: isProd,
-      "HttpOnly",
+    sameSite: 'strict',  // matches login
-      "Path=/",
+    path: '/',           // matches login
-      "SameSite=Strict",
+    maxAge: 0,
-      "Max-Age=0", // expire immediately
+    expires: new Date(0),
-      isProd ? "Secure" : "",
+  });
-    ]
+
-      .filter(Boolean)
+  res.setHeader('Set-Cookie', setCookie);
-      .join("; ")
+  res.setHeader('Cache-Control', 'no-store');
-  );
+  return res.status(200).json({ message: 'Logged out' });
-  return res.status(200).json({ message: "Logged out" });
 }
+
+