@johnnyboy11234/esg-idea-contest 0.2.1 → 0.2.3

package/backend/internal/server/public.go

@@ -0,0 +1,37 @@
+package server
+
+import "net/http"
+
+// PublicRoutes is the explicit list of operations that need no session
+// (Backend.md §3). It must equal the operations marked `security: []` in
+// api/openapi.yaml; a test locks that. Paths include the /api/v1 prefix.
+var PublicRoutes = []struct{ Method, Path string }{
+	{http.MethodGet, "/api/v1/auth/csrf"},
+	{http.MethodPost, "/api/v1/auth/login"},
+	{http.MethodPost, "/api/v1/auth/register"},
+	{http.MethodPost, "/api/v1/auth/logout"},
+	{http.MethodGet, "/api/v1/deadline"},
+}
+
+// IsPublic reports whether r is exactly one of PublicRoutes. A public path with
+// another method is not public: without a session it answers 401, with one 405.
+func IsPublic(r *http.Request) bool {
+	for _, p := range PublicRoutes {
+		if r.Method == p.Method && r.URL.Path == p.Path {
+			return true
+		}
+	}
+	return false
+}
+
+// WriteActions maps the writes that exist today to their audit action, so a
+// CSRF denial is recorded (PRD §6.11). Later PRs add their routes here, with
+// the same exact-path rule; a write on an unknown path is not audited.
+var WriteActions = map[string]string{
+	http.MethodPost + " /api/v1/auth/login":    "AUTH_LOGIN",
+	http.MethodPost + " /api/v1/auth/register": "AUTH_REGISTER",
+	http.MethodPost + " /api/v1/auth/logout":   "AUTH_LOGOUT",
+}
+
+// ActionFor returns the audit action of r, or "" when unknown.
+func ActionFor(r *http.Request) string { return WriteActions[r.Method+" "+r.URL.Path] }

package/backend/internal/server/public_test.go

@@ -0,0 +1,73 @@
+package server_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"testing"
+
+	"github.com/getkin/kin-openapi/openapi3"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
+)
+
+// The public list in code must equal the operations the spec marks
+// `security: []`; otherwise the contract and the middleware disagree.
+func TestPublicRoutesMatchOpenAPI(t *testing.T) {
+	doc, err := openapi3.NewLoader().LoadFromFile("../../api/openapi.yaml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var want []string
+	for path, item := range doc.Paths.Map() {
+		for method, op := range item.Operations() {
+			if op.Security != nil && len(*op.Security) == 0 {
+				want = append(want, method+" /api/v1"+path)
+			}
+		}
+	}
+	var got []string
+	for _, p := range server.PublicRoutes {
+		got = append(got, p.Method+" "+p.Path)
+	}
+	slices.Sort(want)
+	slices.Sort(got)
+	if !slices.Equal(want, got) {
+		t.Errorf("PublicRoutes\n got  %v\n want %v (spec, security: [])", got, want)
+	}
+}
+
+func TestIsPublicNeedsExactMethodAndPath(t *testing.T) {
+	tests := []struct {
+		method, path string
+		want         bool
+	}{
+		{"GET", "/api/v1/auth/csrf", true},
+		{"POST", "/api/v1/auth/logout", true},
+		{"POST", "/api/v1/auth/csrf", false},
+		{"HEAD", "/api/v1/deadline", false},
+		{"GET", "/api/v1/auth/csrf/", false},
+		{"GET", "/api/v1/auth/me", false},
+		{"GET", "/api/v1/auth/../ideas", false},
+		{"GET", "/auth/csrf", false},
+	}
+	for _, tc := range tests {
+		req := httptest.NewRequestWithContext(context.Background(), tc.method, "http://x"+tc.path, nil)
+		if got := server.IsPublic(req); got != tc.want {
+			t.Errorf("%s %s = %v, want %v", tc.method, tc.path, got, tc.want)
+		}
+	}
+}
+
+func TestActionForCoversPublicWrites(t *testing.T) {
+	for _, p := range server.PublicRoutes {
+		if p.Method == http.MethodGet {
+			continue
+		}
+		r := httptest.NewRequest(p.Method, p.Path, nil)
+		if server.ActionFor(r) == "" {
+			t.Errorf("%s %s has no audit action for a CSRF denial", p.Method, p.Path)
+		}
+	}
+}

package/backend/internal/server/server.go

@@ -22,8 +22,8 @@ const (
 
 // NewPublic builds the public router. Module routes are mounted by `mount`
 // (nil in the skeleton) under the chain: request ID → access log → recover →
-// Accept check.
-func NewPublic(log *slog.Logger, mount func(chi.Router)) http.Handler {
+// extra (the session middleware, so 401 beats 406) → Accept check.
+func NewPublic(log *slog.Logger, mount func(chi.Router), extra ...func(http.Handler) http.Handler) http.Handler {
 	r := chi.NewRouter()
 	r.NotFound(web.NotFound)
 	r.MethodNotAllowed(web.MethodNotAllowed)
@@ -32,7 +32,11 @@ func NewPublic(log *slog.Logger, mount func(chi.Router)) http.Handler {
 	}
 	// The chain wraps the router instead of using r.Use: chi skips r.Use
 	// middleware (also for NotFound) while no route is registered.
-	return web.RequestID(web.AccessLog(log)(web.Recover(log)(web.AcceptCheck(r))))
+	h := web.AcceptCheck(r)
+	for i := len(extra) - 1; i >= 0; i-- {
+		h = extra[i](h)
+	}
+	return web.RequestID(web.AccessLog(log)(web.Recover(log)(h)))
 }
 
 // Check reports whether one dependency is usable; a non-nil error makes

package/backend/internal/shared/config/config.go

@@ -18,8 +18,16 @@ type Config struct {
 	LogLevel        slog.Level
 	ShutdownTimeout time.Duration // must stay below terminationGracePeriodSeconds
 	ReadyDrainDelay time.Duration // time readiness stays false before Shutdown starts
+	CSRFKey         string        // HMAC key that signs CSRF tokens (>= 32 bytes)
+	CSRFKeyPrevious string        // optional: still verifies for 8 h after a rotation
 }
 
+// DefaultCSRFKey is the throwaway key of the local profile only; every other
+// profile must set ESG_CSRF_KEY.
+const DefaultCSRFKey = "local-dev-csrf-key-not-a-secret-0000"
+
+const minCSRFKeyBytes = 32
+
 // DefaultDSN matches docker-compose.yml (throwaway local credentials). The query
 // pins UTC and matched-row counts (Backend.md §2.3).
 const DefaultDSN = "esg:esg@tcp(localhost:3306)/esg?parseTime=true&loc=UTC&time_zone=%27%2B00%3A00%27&clientFoundRows=true"
@@ -33,16 +41,27 @@ func Load(getenv func(string) string) (Config, error) {
 		return def
 	}
 	c := Config{
-		Profile:        get("ESG_PROFILE", "local"),
-		PublicAddr:     get("ESG_PUBLIC_ADDR", ":8080"),
-		ManagementAddr: get("ESG_MANAGEMENT_ADDR", ":8081"),
-		DBDSN:          get("ESG_DB_DSN", DefaultDSN),
+		Profile:         get("ESG_PROFILE", "local"),
+		PublicAddr:      get("ESG_PUBLIC_ADDR", ":8080"),
+		ManagementAddr:  get("ESG_MANAGEMENT_ADDR", ":8081"),
+		DBDSN:           get("ESG_DB_DSN", DefaultDSN),
+		CSRFKey:         getenv("ESG_CSRF_KEY"),
+		CSRFKeyPrevious: getenv("ESG_CSRF_KEY_PREVIOUS"),
 	}
 	switch c.Profile {
 	case "local", "k3s", "dev":
 	default:
 		return Config{}, fmt.Errorf("ESG_PROFILE %q: want local, k3s or dev", c.Profile)
 	}
+	if c.CSRFKey == "" && c.Profile == "local" {
+		c.CSRFKey = DefaultCSRFKey
+	}
+	if len(c.CSRFKey) < minCSRFKeyBytes {
+		return Config{}, fmt.Errorf("ESG_CSRF_KEY: need at least %d bytes", minCSRFKeyBytes)
+	}
+	if c.CSRFKeyPrevious != "" && len(c.CSRFKeyPrevious) < minCSRFKeyBytes {
+		return Config{}, fmt.Errorf("ESG_CSRF_KEY_PREVIOUS: need at least %d bytes", minCSRFKeyBytes)
+	}
 	if err := c.LogLevel.UnmarshalText([]byte(strings.ToUpper(get("ESG_LOG_LEVEL", "info")))); err != nil {
 		return Config{}, fmt.Errorf("ESG_LOG_LEVEL: %w", err)
 	}

package/backend/internal/shared/config/config_test.go

@@ -8,6 +8,8 @@ import (
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/config"
 )
 
+const key = "0123456789abcdef0123456789abcdef"
+
 func env(m map[string]string) func(string) string { return func(k string) string { return m[k] } }
 
 func TestDefaults(t *testing.T) {
@@ -16,14 +18,14 @@ func TestDefaults(t *testing.T) {
 		t.Fatal(err)
 	}
 	if c.Profile != "local" || c.PublicAddr != ":8080" || c.ManagementAddr != ":8081" ||
-		c.LogLevel != slog.LevelInfo || c.ShutdownTimeout != 20*time.Second {
+		c.LogLevel != slog.LevelInfo || c.ShutdownTimeout != 20*time.Second || c.CSRFKey != config.DefaultCSRFKey {
 		t.Fatalf("%+v", c)
 	}
 }
 
 func TestOverrides(t *testing.T) {
 	c, err := config.Load(env(map[string]string{
-		"ESG_PROFILE": "dev", "ESG_LOG_LEVEL": "debug", "ESG_SHUTDOWN_TIMEOUT": "5s", "ESG_READY_DRAIN_DELAY": "1s",
+		"ESG_PROFILE": "dev", "ESG_CSRF_KEY": key, "ESG_CSRF_KEY_PREVIOUS": key + "2", "ESG_LOG_LEVEL": "debug", "ESG_SHUTDOWN_TIMEOUT": "5s", "ESG_READY_DRAIN_DELAY": "1s",
 	}))
 	if err != nil || c.Profile != "dev" || c.LogLevel != slog.LevelDebug || c.ReadyDrainDelay != time.Second {
 		t.Fatalf("%+v %v", c, err)
@@ -32,12 +34,16 @@ func TestOverrides(t *testing.T) {
 
 func TestInvalid(t *testing.T) {
 	for name, m := range map[string]map[string]string{
-		"profile":      {"ESG_PROFILE": "prod"},
-		"log level":    {"ESG_LOG_LEVEL": "loud"},
-		"timeout":      {"ESG_SHUTDOWN_TIMEOUT": "soon"},
-		"zero timeout": {"ESG_SHUTDOWN_TIMEOUT": "0s"},
-		"drain":        {"ESG_READY_DRAIN_DELAY": "x"},
-		"same address": {"ESG_PUBLIC_ADDR": ":9", "ESG_MANAGEMENT_ADDR": ":9"},
+		"profile":            {"ESG_PROFILE": "prod"},
+		"log level":          {"ESG_LOG_LEVEL": "loud"},
+		"timeout":            {"ESG_SHUTDOWN_TIMEOUT": "soon"},
+		"zero timeout":       {"ESG_SHUTDOWN_TIMEOUT": "0s"},
+		"drain":              {"ESG_READY_DRAIN_DELAY": "x"},
+		"short csrf key":     {"ESG_CSRF_KEY": "short"},
+		"short previous key": {"ESG_CSRF_KEY": key, "ESG_CSRF_KEY_PREVIOUS": "short"},
+		"dev needs csrf key": {"ESG_PROFILE": "dev"},
+		"k3s needs csrf key": {"ESG_PROFILE": "k3s"},
+		"same address":       {"ESG_PUBLIC_ADDR": ":9", "ESG_MANAGEMENT_ADDR": ":9"},
 	} {
 		if _, err := config.Load(env(m)); err == nil {
 			t.Errorf("%s: want error", name)

package/backend/internal/shared/web/problem.go

@@ -3,6 +3,8 @@ package web
 import (
 	"encoding/json"
 	"net/http"
+	"strconv"
+	"time"
 
 	"github.com/google/uuid"
 )
@@ -28,6 +30,9 @@ type Error struct {
 	Detail string
 	Fields []FieldError
 	Cause  error
+	// RetryAfter, when positive, is sent as Retry-After in whole seconds,
+	// rounded up (minimum 1; PRD §6.5 throttling).
+	RetryAfter time.Duration
 
 	// AuditReason is the real reason of a rejected attempt (CSRF, role, state,
 	// not-yours, not-found). It is stored in the row's after_json, never sent
@@ -94,6 +99,10 @@ func WriteProblem(w http.ResponseWriter, r *http.Request, e *Error) {
 	}
 	w.Header().Set("Content-Type", ProblemContentType)
 	w.Header().Set("Cache-Control", "no-store")
+	if e.RetryAfter > 0 {
+		secs := max(1, int64((e.RetryAfter+time.Second-1)/time.Second))
+		w.Header().Set("Retry-After", strconv.FormatInt(secs, 10))
+	}
 	w.WriteHeader(e.Status)
 	_ = json.NewEncoder(w).Encode(body)
 }

package/backend/internal/shared/web/retryafter_test.go

@@ -0,0 +1,31 @@
+package web_test
+
+import (
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+func TestRetryAfterWholeSecondsRoundedUpMinimumOne(t *testing.T) {
+	tests := []struct {
+		d    time.Duration
+		want string
+	}{
+		{0, ""},
+		{time.Millisecond, "1"},
+		{time.Second, "1"},
+		{1001 * time.Millisecond, "2"},
+		{15 * time.Minute, "900"},
+	}
+	for _, tc := range tests {
+		e := web.NewError(web.CodeLoginThrottled, "")
+		e.RetryAfter = tc.d
+		rec := httptest.NewRecorder()
+		web.WriteProblem(rec, httptest.NewRequest("POST", "/", nil), e)
+		if got := rec.Header().Get("Retry-After"); got != tc.want {
+			t.Errorf("%v: Retry-After = %q, want %q", tc.d, got, tc.want)
+		}
+	}
+}

package/frontend/src/app/App.test.tsx

@@ -161,3 +161,16 @@ describe('accessibility', () => {
     expect((await axe(container)).violations).toEqual([]);
   });
 });
+
+describe('global 401 (Frontend.md §5.2)', () => {
+  it('goes to /login?next=<current> with a session-ended notice and forgets the user', async () => {
+    const { router } = await open('/ideas?page=2', 'USER');
+    await screen.findByRole('heading', { level: 1 });
+    server.use(http.get(`${API}/ideas`, () => problem(401, 'UNAUTHENTICATED')));
+    const { apiFetch } = await import('@/shared/api');
+    await expect(apiFetch('/ideas')).rejects.toMatchObject({ status: 401 });
+    await waitFor(() => expect(router.state.location.pathname).toBe('/login'));
+    expect(router.state.location.search).toBe(`?next=${encodeURIComponent('/ideas?page=2')}`);
+    expect(router.state.location.state).toEqual({ notice: 'sessionEnded' });
+  });
+});

package/frontend/src/app/App.tsx

@@ -1,11 +1,15 @@
+import { useEffect } from 'react';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { RouterProvider, createBrowserRouter, type DataRouter } from 'react-router';
+import { setUnauthenticatedHandler } from '@/shared/api';
 import { routes } from './router';
+import { handleSessionEnded } from './session';
 
 const queryClient = new QueryClient();
 const browserRouter = createBrowserRouter(routes);
 
 export function App({ router = browserRouter, client = queryClient }: { router?: DataRouter; client?: QueryClient }) {
+  useEffect(() => setUnauthenticatedHandler(() => handleSessionEnded(client, router)), [client, router]);
   return (
     <QueryClientProvider client={client}>
       <RouterProvider router={router} />

package/frontend/src/app/index.css

@@ -6,58 +6,58 @@
    Frontend.md §8.1 (4.5:1 text, 3:1 components). */
 :root {
   --radius: 0.5rem;
-  --background: oklch(0.9751 0.0127 244.2507);
-  --foreground: oklch(0.3729 0.0306 259.7328);
-  --card: oklch(1.0000 0 0);
-  --card-foreground: oklch(0.3729 0.0306 259.7328);
-  --popover: oklch(1.0000 0 0);
-  --popover-foreground: oklch(0.3729 0.0306 259.7328);
-  --primary: oklch(0.7227 0.1920 149.5793);
-  --primary-foreground: oklch(1.0000 0 0);
-  --secondary: oklch(0.9514 0.0250 236.8242);
-  --secondary-foreground: oklch(0.4461 0.0263 256.8018);
-  --muted: oklch(0.9670 0.0029 264.5419);
-  --muted-foreground: oklch(0.5510 0.0234 264.3637);
-  --accent: oklch(0.9505 0.0507 163.0508);
-  --accent-foreground: oklch(0.3729 0.0306 259.7328);
-  --destructive: oklch(0.6368 0.2078 25.3313);
-  --border: oklch(0.9276 0.0058 264.5313);
-  --input: oklch(0.9276 0.0058 264.5313);
-  --ring: oklch(0.7227 0.1920 149.5793);
-  --destructive-foreground: oklch(1.0000 0 0);
-  --chart-1: oklch(0.7227 0.1920 149.5793);
-  --chart-2: oklch(0.6959 0.1491 162.4796);
-  --chart-3: oklch(0.5960 0.1274 163.2254);
-  --chart-4: oklch(0.5081 0.1049 165.6121);
-  --chart-5: oklch(0.4318 0.0865 166.9128);
-  --sidebar: oklch(0.9514 0.0250 236.8242);
-  --sidebar-foreground: oklch(0.3729 0.0306 259.7328);
-  --sidebar-primary: oklch(0.7227 0.1920 149.5793);
-  --sidebar-primary-foreground: oklch(1.0000 0 0);
-  --sidebar-accent: oklch(0.9505 0.0507 163.0508);
-  --sidebar-accent-foreground: oklch(0.3729 0.0306 259.7328);
-  --sidebar-border: oklch(0.9276 0.0058 264.5313);
-  --sidebar-ring: oklch(0.7227 0.1920 149.5793);
-  --font-sans: DM Sans, sans-serif;
-  --font-serif: Lora, serif;
-  --font-mono: IBM Plex Mono, monospace;
-  --shadow-color: hsl(0 0% 0%);
-  --shadow-opacity: 0.1;
-  --shadow-blur: 8px;
-  --shadow-spread: -1px;
+  --background: oklch(0.9911 0 0);
+  --foreground: oklch(0.2046 0 0);
+  --card: oklch(0.9911 0 0);
+  --card-foreground: oklch(0.2046 0 0);
+  --popover: oklch(0.9911 0 0);
+  --popover-foreground: oklch(0.4386 0 0);
+  --primary: oklch(0.8348 0.1302 160.9080);
+  --primary-foreground: oklch(0.2626 0.0147 166.4589);
+  --secondary: oklch(0.9940 0 0);
+  --secondary-foreground: oklch(0.2046 0 0);
+  --muted: oklch(0.9461 0 0);
+  --muted-foreground: oklch(0.2435 0 0);
+  --accent: oklch(0.9461 0 0);
+  --accent-foreground: oklch(0.2435 0 0);
+  --destructive: oklch(0.5523 0.1927 32.7272);
+  --border: oklch(0.9037 0 0);
+  --input: oklch(0.9731 0 0);
+  --ring: oklch(0.8348 0.1302 160.9080);
+  --destructive-foreground: oklch(0.9934 0.0032 17.2118);
+  --chart-1: oklch(0.8348 0.1302 160.9080);
+  --chart-2: oklch(0.6231 0.1880 259.8145);
+  --chart-3: oklch(0.6056 0.2189 292.7172);
+  --chart-4: oklch(0.7686 0.1647 70.0804);
+  --chart-5: oklch(0.6959 0.1491 162.4796);
+  --sidebar: oklch(0.9911 0 0);
+  --sidebar-foreground: oklch(0.5452 0 0);
+  --sidebar-primary: oklch(0.8348 0.1302 160.9080);
+  --sidebar-primary-foreground: oklch(0.2626 0.0147 166.4589);
+  --sidebar-accent: oklch(0.9461 0 0);
+  --sidebar-accent-foreground: oklch(0.2435 0 0);
+  --sidebar-border: oklch(0.9037 0 0);
+  --sidebar-ring: oklch(0.8348 0.1302 160.9080);
+  --font-sans: Outfit, sans-serif;
+  --font-serif: ui-serif, Georgia, Cambria, "Times New Roman", Times, serif;
+  --font-mono: monospace;
+  --shadow-color: #000000;
+  --shadow-opacity: 0.17;
+  --shadow-blur: 3px;
+  --shadow-spread: 0px;
   --shadow-offset-x: 0px;
-  --shadow-offset-y: 4px;
-  --letter-spacing: 0em;
+  --shadow-offset-y: 1px;
+  --letter-spacing: 0.025em;
   --spacing: 0.25rem;
-  --shadow-2xs: 0px 4px 8px -1px hsl(0 0% 0% / 0.05);
-  --shadow-xs: 0px 4px 8px -1px hsl(0 0% 0% / 0.05);
-  --shadow-sm: 0px 4px 8px -1px hsl(0 0% 0% / 0.10), 0px 1px 2px -2px hsl(0 0% 0% / 0.10);
-  --shadow: 0px 4px 8px -1px hsl(0 0% 0% / 0.10), 0px 1px 2px -2px hsl(0 0% 0% / 0.10);
-  --shadow-md: 0px 4px 8px -1px hsl(0 0% 0% / 0.10), 0px 2px 4px -2px hsl(0 0% 0% / 0.10);
-  --shadow-lg: 0px 4px 8px -1px hsl(0 0% 0% / 0.10), 0px 4px 6px -2px hsl(0 0% 0% / 0.10);
-  --shadow-xl: 0px 4px 8px -1px hsl(0 0% 0% / 0.10), 0px 8px 10px -2px hsl(0 0% 0% / 0.10);
-  --shadow-2xl: 0px 4px 8px -1px hsl(0 0% 0% / 0.25);
-  --tracking-normal: 0em;
+  --shadow-2xs: 0px 1px 3px 0px hsl(0 0% 0% / 0.09);
+  --shadow-xs: 0px 1px 3px 0px hsl(0 0% 0% / 0.09);
+  --shadow-sm: 0px 1px 3px 0px hsl(0 0% 0% / 0.17), 0px 1px 2px -1px hsl(0 0% 0% / 0.17);
+  --shadow: 0px 1px 3px 0px hsl(0 0% 0% / 0.17), 0px 1px 2px -1px hsl(0 0% 0% / 0.17);
+  --shadow-md: 0px 1px 3px 0px hsl(0 0% 0% / 0.17), 0px 2px 4px -1px hsl(0 0% 0% / 0.17);
+  --shadow-lg: 0px 1px 3px 0px hsl(0 0% 0% / 0.17), 0px 4px 6px -1px hsl(0 0% 0% / 0.17);
+  --shadow-xl: 0px 1px 3px 0px hsl(0 0% 0% / 0.17), 0px 8px 10px -1px hsl(0 0% 0% / 0.17);
+  --shadow-2xl: 0px 1px 3px 0px hsl(0 0% 0% / 0.43);
+  --tracking-normal: 0.025em;
 }
 
 @theme inline {
@@ -83,9 +83,9 @@
   --color-border: var(--border);
   --color-input: var(--input);
   --color-ring: var(--ring);
-  --font-sans: DM Sans, sans-serif;
-  --font-mono: IBM Plex Mono, monospace;
-  --font-serif: Lora, serif;
+  --font-sans: Outfit, sans-serif;
+  --font-mono: monospace;
+  --font-serif: ui-serif, Georgia, Cambria, "Times New Roman", Times, serif;
   --radius: 0.5rem;
   --tracking-tighter: calc(var(--tracking-normal) - 0.05em);
   --tracking-tight: calc(var(--tracking-normal) - 0.025em);
@@ -139,56 +139,56 @@
 }
 
 .dark {
-  --background: oklch(0.2077 0.0398 265.7549);
-  --foreground: oklch(0.8717 0.0093 258.3382);
-  --card: oklch(0.2795 0.0368 260.0310);
-  --card-foreground: oklch(0.8717 0.0093 258.3382);
-  --popover: oklch(0.2795 0.0368 260.0310);
-  --popover-foreground: oklch(0.8717 0.0093 258.3382);
-  --primary: oklch(0.7729 0.1535 163.2231);
-  --primary-foreground: oklch(0.2077 0.0398 265.7549);
-  --secondary: oklch(0.3351 0.0331 260.9120);
-  --secondary-foreground: oklch(0.7118 0.0129 286.0665);
-  --muted: oklch(0.2463 0.0275 259.9628);
-  --muted-foreground: oklch(0.5510 0.0234 264.3637);
-  --accent: oklch(0.3729 0.0306 259.7328);
-  --accent-foreground: oklch(0.7118 0.0129 286.0665);
-  --destructive: oklch(0.6368 0.2078 25.3313);
-  --destructive-foreground: oklch(0.2077 0.0398 265.7549);
-  --border: oklch(0.4461 0.0263 256.8018);
-  --input: oklch(0.4461 0.0263 256.8018);
-  --ring: oklch(0.7729 0.1535 163.2231);
-  --chart-1: oklch(0.7729 0.1535 163.2231);
-  --chart-2: oklch(0.7845 0.1325 181.9120);
-  --chart-3: oklch(0.7227 0.1920 149.5793);
-  --chart-4: oklch(0.6959 0.1491 162.4796);
-  --chart-5: oklch(0.5960 0.1274 163.2254);
+  --background: oklch(0.1822 0 0);
+  --foreground: oklch(0.9288 0.0126 255.5078);
+  --card: oklch(0.2046 0 0);
+  --card-foreground: oklch(0.9288 0.0126 255.5078);
+  --popover: oklch(0.2603 0 0);
+  --popover-foreground: oklch(0.7348 0 0);
+  --primary: oklch(0.4365 0.1044 156.7556);
+  --primary-foreground: oklch(0.9213 0.0135 167.1556);
+  --secondary: oklch(0.2603 0 0);
+  --secondary-foreground: oklch(0.9851 0 0);
+  --muted: oklch(0.2393 0 0);
+  --muted-foreground: oklch(0.7122 0 0);
+  --accent: oklch(0.3132 0 0);
+  --accent-foreground: oklch(0.9851 0 0);
+  --destructive: oklch(0.3123 0.0852 29.7877);
+  --destructive-foreground: oklch(0.9368 0.0045 34.3092);
+  --border: oklch(0.2809 0 0);
+  --input: oklch(0.2603 0 0);
+  --ring: oklch(0.8003 0.1821 151.7110);
+  --chart-1: oklch(0.8003 0.1821 151.7110);
+  --chart-2: oklch(0.7137 0.1434 254.6240);
+  --chart-3: oklch(0.7090 0.1592 293.5412);
+  --chart-4: oklch(0.8369 0.1644 84.4286);
+  --chart-5: oklch(0.7845 0.1325 181.9120);
   --radius: 0.5rem;
-  --sidebar: oklch(0.2795 0.0368 260.0310);
-  --sidebar-foreground: oklch(0.8717 0.0093 258.3382);
-  --sidebar-primary: oklch(0.7729 0.1535 163.2231);
-  --sidebar-primary-foreground: oklch(0.2077 0.0398 265.7549);
-  --sidebar-accent: oklch(0.3729 0.0306 259.7328);
-  --sidebar-accent-foreground: oklch(0.7118 0.0129 286.0665);
-  --sidebar-border: oklch(0.4461 0.0263 256.8018);
-  --sidebar-ring: oklch(0.7729 0.1535 163.2231);
-  --font-sans: DM Sans, sans-serif;
-  --font-serif: Lora, serif;
-  --font-mono: IBM Plex Mono, monospace;
-  --shadow-color: hsl(0 0% 0%);
-  --shadow-opacity: 0.1;
-  --shadow-blur: 8px;
-  --shadow-spread: -1px;
+  --sidebar: oklch(0.1822 0 0);
+  --sidebar-foreground: oklch(0.6301 0 0);
+  --sidebar-primary: oklch(0.4365 0.1044 156.7556);
+  --sidebar-primary-foreground: oklch(0.9213 0.0135 167.1556);
+  --sidebar-accent: oklch(0.3132 0 0);
+  --sidebar-accent-foreground: oklch(0.9851 0 0);
+  --sidebar-border: oklch(0.2809 0 0);
+  --sidebar-ring: oklch(0.8003 0.1821 151.7110);
+  --font-sans: Outfit, sans-serif;
+  --font-serif: ui-serif, Georgia, Cambria, "Times New Roman", Times, serif;
+  --font-mono: monospace;
+  --shadow-color: #000000;
+  --shadow-opacity: 0.17;
+  --shadow-blur: 3px;
+  --shadow-spread: 0px;
   --shadow-offset-x: 0px;
-  --shadow-offset-y: 4px;
-  --letter-spacing: 0em;
+  --shadow-offset-y: 1px;
+  --letter-spacing: 0.025em;
   --spacing: 0.25rem;
-  --shadow-2xs: 0px 4px 8px -1px hsl(0 0% 0% / 0.05);
-  --shadow-xs: 0px 4px 8px -1px hsl(0 0% 0% / 0.05);
-  --shadow-sm: 0px 4px 8px -1px hsl(0 0% 0% / 0.10), 0px 1px 2px -2px hsl(0 0% 0% / 0.10);
-  --shadow: 0px 4px 8px -1px hsl(0 0% 0% / 0.10), 0px 1px 2px -2px hsl(0 0% 0% / 0.10);
-  --shadow-md: 0px 4px 8px -1px hsl(0 0% 0% / 0.10), 0px 2px 4px -2px hsl(0 0% 0% / 0.10);
-  --shadow-lg: 0px 4px 8px -1px hsl(0 0% 0% / 0.10), 0px 4px 6px -2px hsl(0 0% 0% / 0.10);
-  --shadow-xl: 0px 4px 8px -1px hsl(0 0% 0% / 0.10), 0px 8px 10px -2px hsl(0 0% 0% / 0.10);
-  --shadow-2xl: 0px 4px 8px -1px hsl(0 0% 0% / 0.25);
+  --shadow-2xs: 0px 1px 3px 0px hsl(0 0% 0% / 0.09);
+  --shadow-xs: 0px 1px 3px 0px hsl(0 0% 0% / 0.09);
+  --shadow-sm: 0px 1px 3px 0px hsl(0 0% 0% / 0.17), 0px 1px 2px -1px hsl(0 0% 0% / 0.17);
+  --shadow: 0px 1px 3px 0px hsl(0 0% 0% / 0.17), 0px 1px 2px -1px hsl(0 0% 0% / 0.17);
+  --shadow-md: 0px 1px 3px 0px hsl(0 0% 0% / 0.17), 0px 2px 4px -1px hsl(0 0% 0% / 0.17);
+  --shadow-lg: 0px 1px 3px 0px hsl(0 0% 0% / 0.17), 0px 4px 6px -1px hsl(0 0% 0% / 0.17);
+  --shadow-xl: 0px 1px 3px 0px hsl(0 0% 0% / 0.17), 0px 8px 10px -1px hsl(0 0% 0% / 0.17);
+  --shadow-2xl: 0px 1px 3px 0px hsl(0 0% 0% / 0.43);
 }