@brainerce/mcp-server 1.1.0 → 1.2.0

package/dist/index.mjs

@@ -1867,39 +1867,24 @@ var EMBEDDED_TEMPLATES = {
   "src/lib/brainerce.ts.ejs": `import { BrainerceClient } from 'brainerce';
 
 const CONNECTION_ID = process.env.NEXT_PUBLIC_BRAINERCE_CONNECTION_ID || 'vc_YOUR_CONNECTION_ID';
-const API_URL = process.env.NEXT_PUBLIC_BRAINERCE_API_URL || 'https://api.brainerce.com';
 
-// Singleton SDK client
+// Singleton SDK client \u2014 routes through same-origin BFF proxy for httpOnly cookie auth
 let clientInstance: BrainerceClient | null = null;
 
 export function getClient(): BrainerceClient {
   if (!clientInstance) {
     clientInstance = new BrainerceClient({
       connectionId: CONNECTION_ID,
-      baseUrl: API_URL,
+      baseUrl: '/api/store', // same-origin proxy handles auth via httpOnly cookie
+      proxyMode: true, // skip client-side token checks; proxy adds Authorization header
     });
   }
   return clientInstance;
 }
 
-// Auth token helpers
-const TOKEN_KEY = 'brainerce_customer_token';
+// Cart ID helpers (not a security token \u2014 safe in localStorage)
 const CART_ID_KEY = 'brainerce_cart_id';
 
-export function getStoredToken(): string | null {
-  if (typeof window === 'undefined') return null;
-  return localStorage.getItem(TOKEN_KEY);
-}
-
-export function setStoredToken(token: string | null): void {
-  if (typeof window === 'undefined') return;
-  if (token) {
-    localStorage.setItem(TOKEN_KEY, token);
-  } else {
-    localStorage.removeItem(TOKEN_KEY);
-  }
-}
-
 export function getStoredCartId(): string | null {
   if (typeof window === 'undefined') return null;
   return localStorage.getItem(CART_ID_KEY);
@@ -1914,14 +1899,158 @@ export function setStoredCartId(cartId: string | null): void {
   }
 }
 
-// Initialize client with stored auth
+// Initialize client (no token hydration \u2014 auth handled by httpOnly cookie)
 export function initClient(): BrainerceClient {
-  const client = getClient();
-  const token = getStoredToken();
-  if (token) {
-    client.setCustomerToken(token);
+  return getClient();
+}
+`,
+  "src/lib/auth.ts": `/**
+ * Client-side auth helpers that call the BFF proxy API routes.
+ * All mutating requests include the CSRF header.
+ * The token is managed server-side via httpOnly cookies \u2014 never exposed to JS.
+ */
+
+const CONNECTION_ID = process.env.NEXT_PUBLIC_BRAINERCE_CONNECTION_ID || '';
+
+const CSRF_HEADERS: Record<string, string> = {
+  'Content-Type': 'application/json',
+  'X-Requested-With': 'brainerce',
+};
+
+interface LoginResult {
+  customer: {
+    id: string;
+    email: string;
+    firstName?: string;
+    lastName?: string;
+    emailVerified: boolean;
+  };
+  expiresAt: string;
+  requiresVerification?: boolean;
+}
+
+interface RegisterResult {
+  customer: {
+    id: string;
+    email: string;
+    firstName?: string;
+    lastName?: string;
+    emailVerified: boolean;
+  };
+  expiresAt: string;
+  requiresVerification?: boolean;
+}
+
+interface AuthStatus {
+  isLoggedIn: boolean;
+  customer?: {
+    id: string;
+    email: string;
+    firstName?: string;
+    lastName?: string;
+    phone?: string;
+    emailVerified: boolean;
+  };
+  error?: string;
+}
+
+interface VerifyEmailResult {
+  verified: boolean;
+  message?: string;
+}
+
+async function handleResponse<T>(response: Response): Promise<T> {
+  const data = await response.json();
+  if (!response.ok) {
+    throw new Error(data.message || data.error || \`Request failed (\${response.status})\`);
   }
-  return client;
+  return data as T;
+}
+
+/**
+ * Login via BFF proxy. The proxy sets the httpOnly cookie on success.
+ */
+export async function proxyLogin(email: string, password: string): Promise<LoginResult> {
+  const response = await fetch(\`/api/store/api/vc/\${CONNECTION_ID}/customers/login\`, {
+    method: 'POST',
+    headers: CSRF_HEADERS,
+    body: JSON.stringify({ email, password }),
+  });
+  return handleResponse<LoginResult>(response);
+}
+
+/**
+ * Register via BFF proxy. The proxy sets the httpOnly cookie on success.
+ */
+export async function proxyRegister(data: {
+  firstName: string;
+  lastName: string;
+  email: string;
+  password: string;
+}): Promise<RegisterResult> {
+  const response = await fetch(\`/api/store/api/vc/\${CONNECTION_ID}/customers/register\`, {
+    method: 'POST',
+    headers: CSRF_HEADERS,
+    body: JSON.stringify(data),
+  });
+  return handleResponse<RegisterResult>(response);
+}
+
+/**
+ * Check auth status. Reads httpOnly cookie server-side and validates with backend.
+ */
+export async function checkAuthStatus(): Promise<AuthStatus> {
+  const response = await fetch('/api/auth/me');
+  return response.json();
+}
+
+/**
+ * Logout. Clears httpOnly auth cookies server-side.
+ */
+export async function proxyLogout(): Promise<void> {
+  await fetch('/api/auth/logout', {
+    method: 'POST',
+    headers: { 'X-Requested-With': 'brainerce' },
+  });
+}
+
+/**
+ * Verify email via BFF proxy. The auth token is in the httpOnly cookie (set during login/register).
+ * The proxy adds the Authorization header automatically.
+ */
+export async function proxyVerifyEmail(code: string): Promise<VerifyEmailResult> {
+  const response = await fetch(\`/api/store/api/vc/\${CONNECTION_ID}/customers/verify-email\`, {
+    method: 'POST',
+    headers: CSRF_HEADERS,
+    body: JSON.stringify({ code }),
+  });
+  return handleResponse<VerifyEmailResult>(response);
+}
+
+/**
+ * Resend verification email via BFF proxy.
+ * Uses the auth token from the httpOnly cookie.
+ */
+export async function proxyResendVerification(): Promise<{ message: string }> {
+  const response = await fetch(\`/api/store/api/vc/\${CONNECTION_ID}/customers/resend-verification\`, {
+    method: 'POST',
+    headers: CSRF_HEADERS,
+  });
+  return handleResponse<{ message: string }>(response);
+}
+
+/**
+ * Reset password via BFF proxy.
+ * The reset token is in an httpOnly cookie (set by /api/auth/reset-callback when the user
+ * clicked the email link). The proxy reads it server-side \u2014 the token never reaches client JS.
+ */
+export async function proxyResetPassword(newPassword: string): Promise<{ message: string }> {
+  const response = await fetch('/api/auth/reset-password', {
+    method: 'POST',
+    headers: CSRF_HEADERS,
+    body: JSON.stringify({ newPassword }),
+  });
+  return handleResponse<{ message: string }>(response);
 }
 `,
   "src/lib/utils.ts": `import { clsx, type ClassValue } from 'clsx';
@@ -1934,9 +2063,10 @@ export function cn(...inputs: ClassValue[]) {
   "src/providers/store-provider.tsx.ejs": `'use client';
 
 import React, { createContext, useContext, useEffect, useState, useCallback } from 'react';
-import type { StoreInfo, Cart } from 'brainerce';
+import type { StoreInfo, Cart, CustomerProfile } from 'brainerce';
 import { getCartTotals } from 'brainerce';
-import { getClient, initClient, getStoredToken, setStoredToken, setStoredCartId } from '@/lib/brainerce';
+import { getClient, initClient, setStoredCartId } from '@/lib/brainerce';
+import { checkAuthStatus, proxyLogout } from '@/lib/auth';
 
 // ---- Store Info Context ----
 interface StoreInfoContextValue {
@@ -1957,17 +2087,17 @@ export function useStoreInfo() {
 interface AuthContextValue {
   isLoggedIn: boolean;
   authLoading: boolean;
-  token: string | null;
-  login: (token: string) => void;
-  logout: () => void;
+  customer: CustomerProfile | null;
+  login: () => Promise<void>;
+  logout: () => Promise<void>;
 }
 
 const AuthContext = createContext<AuthContextValue>({
   isLoggedIn: false,
   authLoading: true,
-  token: null,
-  login: () => {},
-  logout: () => {},
+  customer: null,
+  login: async () => {},
+  logout: async () => {},
 });
 
 export function useAuth() {
@@ -1999,26 +2129,46 @@ export function useCart() {
 export function StoreProvider({ children }: { children: React.ReactNode }) {
   const [storeInfo, setStoreInfo] = useState<StoreInfo | null>(null);
   const [storeLoading, setStoreLoading] = useState(true);
-  const [token, setToken] = useState<string | null>(null);
+  const [isLoggedIn, setIsLoggedIn] = useState(false);
+  const [customer, setCustomer] = useState<CustomerProfile | null>(null);
   const [authLoading, setAuthLoading] = useState(true);
   const [cart, setCart] = useState<Cart | null>(null);
   const [cartLoading, setCartLoading] = useState(true);
 
-  // Initialize client and auth
+  // Check auth status via httpOnly cookie (server-side validation)
+  const refreshAuth = useCallback(async () => {
+    try {
+      const status = await checkAuthStatus();
+      setIsLoggedIn(status.isLoggedIn);
+      setCustomer(status.isLoggedIn ? (status.customer as CustomerProfile) : null);
+    } catch {
+      setIsLoggedIn(false);
+      setCustomer(null);
+    } finally {
+      setAuthLoading(false);
+    }
+  }, []);
+
+  // Initialize client, check auth, and fetch store info
   useEffect(() => {
     const client = initClient();
-    const stored = getStoredToken();
-    if (stored) {
-      setToken(stored);
+
+    // Optimistic check: if brainerce_logged_in cookie exists, assume logged in
+    // while we validate the actual token server-side
+    if (typeof document !== 'undefined' && document.cookie.includes('brainerce_logged_in=1')) {
+      setIsLoggedIn(true);
     }
-    setAuthLoading(false);
 
+    // Validate auth token server-side
+    refreshAuth();
+
+    // Fetch store info (public, no auth needed)
     client
       .getStoreInfo()
       .then(setStoreInfo)
       .catch(console.error)
       .finally(() => setStoreLoading(false));
-  }, []);
+  }, [refreshAuth]);
 
   // Cart management
   const refreshCart = useCallback(async () => {
@@ -2041,24 +2191,26 @@ export function StoreProvider({ children }: { children: React.ReactNode }) {
 
   useEffect(() => {
     refreshCart();
-  }, [refreshCart, token]);
+  }, [refreshCart, isLoggedIn]);
 
-  const login = useCallback((newToken: string) => {
-    const client = getClient();
-    client.setCustomerToken(newToken);
-    setStoredToken(newToken);
-    setToken(newToken);
+  // Called after successful login (cookie already set by proxy)
+  const login = useCallback(async () => {
+    // Refresh auth state from server (reads httpOnly cookie)
+    await refreshAuth();
 
     // Merge guest session cart into customer cart
+    const client = getClient();
     client.syncCartOnLogin().catch(console.error);
-  }, []);
+  }, [refreshAuth]);
+
+  const logout = useCallback(async () => {
+    // Clear httpOnly cookie server-side
+    await proxyLogout();
 
-  const logout = useCallback(() => {
     const client = getClient();
-    client.clearCustomerToken();
     client.onLogout();
-    setStoredToken(null);
-    setToken(null);
+    setIsLoggedIn(false);
+    setCustomer(null);
     setCart(null);
     refreshCart();
   }, [refreshCart]);
@@ -2071,7 +2223,7 @@ export function StoreProvider({ children }: { children: React.ReactNode }) {
 
   return (
     <StoreInfoContext.Provider value={{ storeInfo, loading: storeLoading }}>
-      <AuthContext.Provider value={{ isLoggedIn: !!token, authLoading, token, login, logout }}>
+      <AuthContext.Provider value={{ isLoggedIn, authLoading, customer, login, logout }}>
         <CartContext.Provider
           value={{ cart, cartLoading, refreshCart, itemCount, totals }}
         >
@@ -3891,8 +4043,8 @@ export default function OrderConfirmationPage() {
 import { useState } from 'react';
 import { useRouter } from 'next/navigation';
 import Link from 'next/link';
-import { getClient } from '@/lib/brainerce';
 import { useAuth } from '@/providers/store-provider';
+import { proxyLogin } from '@/lib/auth';
 import { LoginForm } from '@/components/auth/login-form';
 import { OAuthButtons } from '@/components/auth/oauth-buttons';
 import { useTranslations } from '@/lib/translations';
@@ -3906,15 +4058,16 @@ export default function LoginPage() {
   async function handleLogin(email: string, password: string) {
     try {
       setError(null);
-      const client = getClient();
-      const result = await client.loginCustomer(email, password);
+      const result = await proxyLogin(email, password);
 
       if (result.requiresVerification) {
-        router.push(\`/verify-email?token=\${encodeURIComponent(result.token)}\`);
+        // Verification token is NOT the auth JWT \u2014 safe to pass in URL
+        router.push('/verify-email');
         return;
       }
 
-      auth.login(result.token);
+      // Cookie was set by the proxy; refresh auth state
+      await auth.login();
       router.push('/');
     } catch (err) {
       const message = err instanceof Error ? err.message : 'Login failed. Please try again.';
@@ -3950,8 +4103,8 @@ export default function LoginPage() {
 import { useState } from 'react';
 import { useRouter } from 'next/navigation';
 import Link from 'next/link';
-import { getClient } from '@/lib/brainerce';
 import { useAuth } from '@/providers/store-provider';
+import { proxyRegister } from '@/lib/auth';
 import { RegisterForm } from '@/components/auth/register-form';
 import { OAuthButtons } from '@/components/auth/oauth-buttons';
 import { useTranslations } from '@/lib/translations';
@@ -3970,20 +4123,16 @@ export default function RegisterPage() {
   }) {
     try {
       setError(null);
-      const client = getClient();
-      const result = await client.registerCustomer({
-        firstName: data.firstName,
-        lastName: data.lastName,
-        email: data.email,
-        password: data.password,
-      });
+      const result = await proxyRegister(data);
 
       if (result.requiresVerification) {
-        router.push(\`/verify-email?token=\${encodeURIComponent(result.token)}\`);
+        // Cookie already set by proxy; verify-email uses it for auth
+        router.push('/verify-email');
         return;
       }
 
-      auth.login(result.token);
+      // Cookie was set by the proxy; refresh auth state
+      await auth.login();
       router.push('/');
     } catch (err) {
       const message = err instanceof Error ? err.message : 'Registration failed. Please try again.';
@@ -4017,10 +4166,10 @@ export default function RegisterPage() {
   "src/app/verify-email/page.tsx": `'use client';
 
 import { Suspense, useState, useRef, useEffect, useCallback } from 'react';
-import { useRouter, useSearchParams } from 'next/navigation';
+import { useRouter } from 'next/navigation';
 import Link from 'next/link';
-import { getClient } from '@/lib/brainerce';
 import { useAuth } from '@/providers/store-provider';
+import { proxyVerifyEmail, proxyResendVerification } from '@/lib/auth';
 import { LoadingSpinner } from '@/components/shared/loading-spinner';
 import { useTranslations } from '@/lib/translations';
 
@@ -4029,10 +4178,8 @@ const RESEND_COOLDOWN_SECONDS = 60;
 
 function VerifyEmailContent() {
   const router = useRouter();
-  const searchParams = useSearchParams();
   const auth = useAuth();
 
-  const token = searchParams.get('token');
   const t = useTranslations('auth');
 
   const [digits, setDigits] = useState<string[]>(Array(CODE_LENGTH).fill(''));
@@ -4060,18 +4207,17 @@ function VerifyEmailContent() {
 
   const handleSubmit = useCallback(
     async (code: string) => {
-      if (!token || code.length !== CODE_LENGTH || loading) return;
+      if (code.length !== CODE_LENGTH || loading) return;
 
       try {
         setLoading(true);
         setError(null);
-        const client = getClient();
-        const result = await client.verifyEmail(code, token);
+        // Auth token is in httpOnly cookie \u2014 proxy adds Authorization header
+        const result = await proxyVerifyEmail(code);
 
         if (result.verified) {
-          // token field exists on newer SDK versions
-          const authToken = (result as unknown as { token?: string }).token || token;
-          auth.login(authToken);
+          // Refresh auth state (cookie already set)
+          await auth.login();
           setSuccess('Email verified successfully! Redirecting...');
           setTimeout(() => router.push('/'), 1500);
         } else {
@@ -4085,7 +4231,7 @@ function VerifyEmailContent() {
         setLoading(false);
       }
     },
-    [token, loading, auth, router]
+    [loading, auth, router]
   );
 
   function handleDigitChange(index: number, value: string) {
@@ -4139,13 +4285,12 @@ function VerifyEmailContent() {
   }
 
   async function handleResend() {
-    if (!token || resending || cooldown > 0) return;
+    if (resending || cooldown > 0) return;
 
     try {
       setResending(true);
       setError(null);
-      const client = getClient();
-      await client.resendVerificationEmail(token);
+      await proxyResendVerification();
       setSuccess('Verification code sent! Check your email.');
       setCooldown(RESEND_COOLDOWN_SECONDS);
       // Clear digits for fresh entry
@@ -4165,37 +4310,6 @@ function VerifyEmailContent() {
     handleSubmit(code);
   }
 
-  // No token provided
-  if (!token) {
-    return (
-      <div className="flex min-h-[60vh] items-center justify-center px-4 py-12">
-        <div className="w-full max-w-md space-y-4 text-center">
-          <svg
-            className="text-muted-foreground mx-auto h-12 w-12"
-            fill="none"
-            viewBox="0 0 24 24"
-            stroke="currentColor"
-          >
-            <path
-              strokeLinecap="round"
-              strokeLinejoin="round"
-              strokeWidth={1.5}
-              d="M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z"
-            />
-          </svg>
-          <h1 className="text-foreground text-2xl font-bold">{t('verificationInvalid')}</h1>
-          <p className="text-muted-foreground text-sm">{t('verificationInvalidDesc')}</p>
-          <Link
-            href="/register"
-            className="bg-primary text-primary-foreground inline-flex items-center rounded px-6 py-3 font-medium transition-opacity hover:opacity-90"
-          >
-            {t('goToRegister')}
-          </Link>
-        </div>
-      </div>
-    );
-  }
-
   return (
     <div className="flex min-h-[60vh] items-center justify-center px-4 py-12">
       <div className="w-full max-w-md space-y-6">
@@ -4325,8 +4439,8 @@ function OAuthCallbackContent() {
   const t = useTranslations('auth');
 
   const oauthSuccess = searchParams.get('oauth_success');
-  const token = searchParams.get('token');
   const oauthError = searchParams.get('oauth_error');
+  // Token is no longer in URL \u2014 it was set as httpOnly cookie by /api/auth/oauth-callback
 
   useEffect(() => {
     // Prevent double-processing in React StrictMode
@@ -4338,13 +4452,15 @@ function OAuthCallbackContent() {
       return;
     }
 
-    if (oauthSuccess === 'true' && token) {
-      auth.login(token);
-      router.push('/');
+    if (oauthSuccess === 'true') {
+      // Cookie was already set by the API route; refresh auth state
+      auth.login().then(() => {
+        router.push('/');
+      });
     } else {
       setError(t('authFailedDesc'));
     }
-  }, [oauthSuccess, token, oauthError, auth, router]);
+  }, [oauthSuccess, oauthError, auth, router, t]);
 
   if (error) {
     return (
@@ -4511,6 +4627,348 @@ export default function AccountPage() {
     </div>
   );
 }
+`,
+  "src/app/api/store/[...path]/route.ts": `import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+
+const BACKEND_URL = (process.env.BRAINERCE_API_URL || 'https://api.brainerce.com').replace(
+  /\\/$/,
+  ''
+);
+
+const TOKEN_COOKIE = 'brainerce_customer_token';
+const LOGGED_IN_COOKIE = 'brainerce_logged_in';
+const CSRF_HEADER = 'x-requested-with';
+const CSRF_VALUE = 'brainerce';
+
+const COOKIE_MAX_AGE = 7 * 24 * 60 * 60; // 7 days
+
+/** Auth endpoints whose responses contain tokens to intercept */
+const AUTH_ENDPOINTS = ['customers/login', 'customers/register', 'customers/verify-email'];
+
+function isAuthEndpoint(path: string): boolean {
+  return AUTH_ENDPOINTS.some((ep) => path.endsWith(ep));
+}
+
+function isSecure(): boolean {
+  return process.env.NODE_ENV === 'production';
+}
+
+function setAuthCookies(response: NextResponse, token: string): void {
+  response.cookies.set(TOKEN_COOKIE, token, {
+    httpOnly: true,
+    secure: isSecure(),
+    sameSite: 'lax',
+    path: '/',
+    maxAge: COOKIE_MAX_AGE,
+  });
+  response.cookies.set(LOGGED_IN_COOKIE, '1', {
+    httpOnly: false,
+    secure: isSecure(),
+    sameSite: 'lax',
+    path: '/',
+    maxAge: COOKIE_MAX_AGE,
+  });
+}
+
+function clearAuthCookies(response: NextResponse): void {
+  response.cookies.delete(TOKEN_COOKIE);
+  response.cookies.delete(LOGGED_IN_COOKIE);
+}
+
+async function proxyRequest(
+  request: NextRequest,
+  params: { path: string[] }
+): Promise<NextResponse> {
+  const method = request.method;
+
+  // CSRF protection for mutating requests
+  if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {
+    const csrfHeader = request.headers.get(CSRF_HEADER);
+    if (csrfHeader !== CSRF_VALUE) {
+      return NextResponse.json({ error: 'CSRF validation failed' }, { status: 403 });
+    }
+  }
+
+  // Build backend URL from path segments
+  const pathSegments = params.path.join('/');
+  const backendUrl = new URL(\`\${BACKEND_URL}/\${pathSegments}\`);
+
+  // Forward query parameters
+  request.nextUrl.searchParams.forEach((value, key) => {
+    backendUrl.searchParams.set(key, value);
+  });
+
+  // Build headers for backend request
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/json',
+  };
+
+  // Forward SDK version header if present
+  const sdkVersion = request.headers.get('x-sdk-version');
+  if (sdkVersion) {
+    headers['X-SDK-Version'] = sdkVersion;
+  }
+
+  // Add auth token from httpOnly cookie
+  const cookieStore = await cookies();
+  const tokenCookie = cookieStore.get(TOKEN_COOKIE);
+  if (tokenCookie?.value) {
+    headers['Authorization'] = \`Bearer \${tokenCookie.value}\`;
+  }
+
+  // Forward request body for non-GET requests
+  let body: string | undefined;
+  if (method !== 'GET' && method !== 'HEAD') {
+    try {
+      body = await request.text();
+    } catch {
+      // No body
+    }
+  }
+
+  // Proxy the request to backend
+  let backendResponse: Response;
+  try {
+    backendResponse = await fetch(backendUrl.toString(), {
+      method,
+      headers,
+      body,
+    });
+  } catch (error) {
+    return NextResponse.json({ error: 'Backend service unavailable' }, { status: 502 });
+  }
+
+  // Read response body
+  const responseText = await backendResponse.text();
+
+  // For auth endpoints: intercept token, set cookie, strip token from response
+  if (backendResponse.ok && method === 'POST' && isAuthEndpoint(pathSegments)) {
+    try {
+      const data = JSON.parse(responseText);
+      if (data.token) {
+        const token = data.token;
+
+        // Strip token from client response
+        const { token: _stripped, ...safeData } = data;
+
+        const response = NextResponse.json(safeData, {
+          status: backendResponse.status,
+        });
+        setAuthCookies(response, token);
+        return response;
+      }
+    } catch {
+      // Not JSON or no token field \u2014 pass through
+    }
+  }
+
+  // Handle 401 responses: clear auth cookies
+  if (backendResponse.status === 401 && tokenCookie?.value) {
+    const response = new NextResponse(responseText, {
+      status: backendResponse.status,
+      headers: {
+        'Content-Type': backendResponse.headers.get('Content-Type') || 'application/json',
+      },
+    });
+    clearAuthCookies(response);
+    return response;
+  }
+
+  // Pass through response as-is
+  return new NextResponse(responseText, {
+    status: backendResponse.status,
+    headers: {
+      'Content-Type': backendResponse.headers.get('Content-Type') || 'application/json',
+    },
+  });
+}
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ path: string[] }> }
+) {
+  return proxyRequest(request, await params);
+}
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ path: string[] }> }
+) {
+  return proxyRequest(request, await params);
+}
+
+export async function PUT(
+  request: NextRequest,
+  { params }: { params: Promise<{ path: string[] }> }
+) {
+  return proxyRequest(request, await params);
+}
+
+export async function PATCH(
+  request: NextRequest,
+  { params }: { params: Promise<{ path: string[] }> }
+) {
+  return proxyRequest(request, await params);
+}
+
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: Promise<{ path: string[] }> }
+) {
+  return proxyRequest(request, await params);
+}
+`,
+  "src/app/api/auth/oauth-callback/route.ts": `import { NextRequest, NextResponse } from 'next/server';
+
+const TOKEN_COOKIE = 'brainerce_customer_token';
+const LOGGED_IN_COOKIE = 'brainerce_logged_in';
+const COOKIE_MAX_AGE = 7 * 24 * 60 * 60; // 7 days
+
+function isSecure(): boolean {
+  return process.env.NODE_ENV === 'production';
+}
+
+/**
+ * OAuth callback handler.
+ * The backend redirects here with ?token=jwt&oauth_success=true after OAuth code exchange.
+ * We set the httpOnly cookie and redirect to the client-side callback page (without the token).
+ */
+export async function GET(request: NextRequest) {
+  const { searchParams } = request.nextUrl;
+  const token = searchParams.get('token');
+  const oauthSuccess = searchParams.get('oauth_success');
+  const oauthError = searchParams.get('oauth_error');
+
+  // Build redirect URL to client-side callback page
+  const redirectUrl = new URL('/auth/callback', request.url);
+
+  if (oauthError) {
+    redirectUrl.searchParams.set('oauth_error', oauthError);
+    return NextResponse.redirect(redirectUrl);
+  }
+
+  if (oauthSuccess === 'true' && token) {
+    redirectUrl.searchParams.set('oauth_success', 'true');
+
+    const response = NextResponse.redirect(redirectUrl);
+
+    // Set httpOnly cookie with the token
+    response.cookies.set(TOKEN_COOKIE, token, {
+      httpOnly: true,
+      secure: isSecure(),
+      sameSite: 'lax',
+      path: '/',
+      maxAge: COOKIE_MAX_AGE,
+    });
+
+    // Set indicator cookie (readable by client JS)
+    response.cookies.set(LOGGED_IN_COOKIE, '1', {
+      httpOnly: false,
+      secure: isSecure(),
+      sameSite: 'lax',
+      path: '/',
+      maxAge: COOKIE_MAX_AGE,
+    });
+
+    return response;
+  }
+
+  // Fallback: no token or success flag
+  redirectUrl.searchParams.set('oauth_error', 'Authentication failed');
+  return NextResponse.redirect(redirectUrl);
+}
+`,
+  "src/app/api/auth/me/route.ts": `import { NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
+
+const BACKEND_URL = (process.env.BRAINERCE_API_URL || 'https://api.brainerce.com').replace(
+  /\\/$/,
+  ''
+);
+
+const CONNECTION_ID = process.env.NEXT_PUBLIC_BRAINERCE_CONNECTION_ID || '';
+
+const TOKEN_COOKIE = 'brainerce_customer_token';
+const LOGGED_IN_COOKIE = 'brainerce_logged_in';
+
+/**
+ * Auth status check endpoint.
+ * Reads the httpOnly cookie, validates against backend, returns auth state.
+ */
+export async function GET() {
+  const cookieStore = await cookies();
+  const tokenCookie = cookieStore.get(TOKEN_COOKIE);
+
+  if (!tokenCookie?.value) {
+    return NextResponse.json({ isLoggedIn: false });
+  }
+
+  try {
+    // Validate token by calling backend profile endpoint
+    const response = await fetch(\`\${BACKEND_URL}/api/vc/\${CONNECTION_ID}/customers/me\`, {
+      headers: {
+        Authorization: \`Bearer \${tokenCookie.value}\`,
+        'Content-Type': 'application/json',
+      },
+    });
+
+    if (!response.ok) {
+      // Token is invalid or expired \u2014 clear cookies
+      const res = NextResponse.json({ isLoggedIn: false });
+      res.cookies.delete(TOKEN_COOKIE);
+      res.cookies.delete(LOGGED_IN_COOKIE);
+      return res;
+    }
+
+    const customer = await response.json();
+    return NextResponse.json({ isLoggedIn: true, customer });
+  } catch {
+    // Backend unreachable \u2014 don't clear cookies, might be temporary
+    return NextResponse.json({ isLoggedIn: false, error: 'Service unavailable' }, { status: 503 });
+  }
+}
+`,
+  "src/app/api/auth/logout/route.ts": `import { NextResponse } from 'next/server';
+
+const TOKEN_COOKIE = 'brainerce_customer_token';
+const LOGGED_IN_COOKIE = 'brainerce_logged_in';
+
+/**
+ * Logout endpoint. Clears auth cookies.
+ */
+export async function POST() {
+  const response = NextResponse.json({ success: true });
+  response.cookies.delete(TOKEN_COOKIE);
+  response.cookies.delete(LOGGED_IN_COOKIE);
+  return response;
+}
+`,
+  "src/middleware.ts": `import { NextRequest, NextResponse } from 'next/server';
+
+const TOKEN_COOKIE = 'brainerce_customer_token';
+
+/** Routes that require customer authentication */
+const PROTECTED_PATHS = ['/account'];
+
+export function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+  const isProtected = PROTECTED_PATHS.some((p) => pathname.startsWith(p));
+
+  if (isProtected) {
+    const token = request.cookies.get(TOKEN_COOKIE);
+    if (!token?.value) {
+      const loginUrl = new URL('/login', request.url);
+      return NextResponse.redirect(loginUrl);
+    }
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: ['/account/:path*'],
+};
 `,
   "src/components/products/product-card.tsx": `'use client';
 
@@ -5842,8 +6300,11 @@ declare global {
 }
 
 // Payment SDK script URLs \u2014 resolved per provider
+// SRI hashes must be regenerated when the provider updates their SDK
 const PAYMENT_SDK_URL = 'https://cdn.meshulam.co.il/sdk/gs.min.js';
+const PAYMENT_SDK_SRI = 'sha384-e1OYzZERZLgbR8Zw1I4Ww/J7qXGyEsZb7LF0z5W/sbnTsFwtxop7sKZsLGNp6CB1';
 const APPLE_PAY_SDK_URL = 'https://meshulam.co.il/_media/js/apple_pay_sdk/sdk.min.js';
+const APPLE_PAY_SDK_SRI = 'sha384-CG67HXmWBeyuRR/jqFsYr6dGEMFyuZw3/hRmcyACJRYHGb/1ebEkQZyzdJXDc9/u';
 
 interface PaymentStepProps {
   checkoutId: string;
@@ -5854,7 +6315,7 @@ interface PaymentStepProps {
  * Load a script tag if not already present in the DOM.
  * Resolves when the script loads (or immediately if already present).
  */
-function loadScript(src: string, optional = false): Promise<void> {
+function loadScript(src: string, optional = false, integrity?: string): Promise<void> {
   return new Promise((resolve) => {
     if (document.querySelector(\`script[src="\${src}"]\`)) {
       resolve();
@@ -5863,6 +6324,10 @@ function loadScript(src: string, optional = false): Promise<void> {
     const script = document.createElement('script');
     script.src = src;
     script.async = true;
+    if (integrity) {
+      script.integrity = integrity;
+      script.crossOrigin = 'anonymous';
+    }
     script.onload = () => resolve();
     script.onerror = () => {
       if (optional) {
@@ -5955,10 +6420,10 @@ export function PaymentStep({ checkoutId, className }: PaymentStepProps) {
 
     async function loadSdkScripts() {
       // Load Apple Pay SDK (optional)
-      await loadScript(APPLE_PAY_SDK_URL, true);
+      await loadScript(APPLE_PAY_SDK_URL, true, APPLE_PAY_SDK_SRI);
 
       // Load payment SDK script
-      await loadScript(PAYMENT_SDK_URL);
+      await loadScript(PAYMENT_SDK_URL, false, PAYMENT_SDK_SRI);
 
       // Wait for SDK global to be set by the script
       const available = await waitForPaymentSdkGlobal();
@@ -6621,7 +7086,7 @@ export function OAuthButtons({ className }: OAuthButtonsProps) {
     try {
       setRedirecting(provider);
       const client = getClient();
-      const redirectUrl = window.location.origin + '/auth/callback';
+      const redirectUrl = window.location.origin + '/api/auth/oauth-callback';
       const result = await client.getOAuthAuthorizeUrl(provider, { redirectUrl });
       window.location.href = result.authorizationUrl;
     } catch (err) {
@@ -8256,6 +8721,39 @@ my-store/
 | \`app/auth/callback/page.tsx\` | Extracts OAuth token from URL params, stores in localStorage |
 | \`app/account/page.tsx\` | Protected page: getMyProfile() + getMyOrders() |
 | \`components/Header.tsx\` | Site header with nav, cart count badge, search autocomplete |
+
+## Content Security Policy (CSP)
+
+Payment SDKs load iframes and scripts from external domains. Add these CSP headers in \`next.config.js\`:
+
+\`\`\`js
+// next.config.js
+module.exports = {
+  async headers() {
+    return [{
+      source: '/(.*)',
+      headers: [{
+        key: 'Content-Security-Policy',
+        value: [
+          "default-src 'self'",
+          "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.meshulam.co.il https://meshulam.co.il https://*.meshulam.co.il https://grow.link https://*.grow.link https://*.grow.security https://js.stripe.com https://pay.google.com",
+          "style-src 'self' 'unsafe-inline'",
+          "img-src 'self' data: blob: https:",
+          "font-src 'self' data:",
+          "frame-src 'self' https://*.meshulam.co.il https://grow.link https://*.grow.link https://*.grow.security https://*.creditguard.co.il https://js.stripe.com https://hooks.stripe.com https://pay.google.com",
+          "connect-src 'self' https://*.meshulam.co.il https://grow.link https://*.grow.link https://*.grow.security https://google.com https://pay.google.com https://*.stripe.com https://*.creditguard.co.il",
+          "worker-src 'self' blob:",
+        ].join('; '),
+      }],
+    }];
+  },
+};
+\`\`\`
+
+**Required domains by provider:**
+- **Grow**: \`*.meshulam.co.il\`, \`grow.link\`, \`*.grow.link\`, \`*.grow.security\`, \`*.creditguard.co.il\`
+- **Stripe**: \`js.stripe.com\`, \`hooks.stripe.com\`, \`*.stripe.com\`
+- **Google Pay**: \`pay.google.com\`, \`google.com\`
 `;
 
 // src/resources/project-template.ts