create-nevela 0.2.1 → 0.4.1

package/template/laravel/src/Models/Passkey.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace Nevela\Laravel\Models;
+
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * A passkey: the public half of a key pair whose private half never leaves the person's
+ * device. Nothing here is secret.
+ *
+ * @property string $user_id
+ * @property string|null $name
+ * @property string $credential_id  base64url
+ * @property string $public_key     PEM
+ * @property int $counter
+ * @property list<string>|null $transports
+ * @property \Illuminate\Support\Carbon|null $last_used_at
+ */
+class Passkey extends Model
+{
+    use HasUuids;
+
+    protected $table = 'nevela_passkeys';
+
+    protected $guarded = [];
+
+    protected $hidden = ['public_key'];
+
+    protected function casts(): array
+    {
+        return [
+            'counter' => 'integer',
+            'transports' => 'array',
+            'last_used_at' => 'datetime',
+        ];
+    }
+}

package/template/laravel/src/Models/TwoFactor.php

@@ -0,0 +1,64 @@
+<?php
+
+namespace Nevela\Laravel\Models;
+
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * One person's second step for signing in.
+ *
+ * The authenticator app's secret and the backup codes are encrypted with the app key:
+ * a copy of the database alone is not enough to produce a code. Backup codes are also
+ * only kept as hashes.
+ *
+ * @property string $user_id
+ * @property string|null $secret
+ * @property \Illuminate\Support\Carbon|null $totp_confirmed_at
+ * @property list<string>|null $backup_codes
+ * @property \Illuminate\Support\Carbon|null $enabled_at
+ */
+class TwoFactor extends Model
+{
+    use HasUuids;
+
+    protected $table = 'nevela_two_factor';
+
+    protected $guarded = [];
+
+    protected $hidden = ['secret', 'backup_codes'];
+
+    protected function casts(): array
+    {
+        return [
+            'secret' => 'encrypted',
+            'backup_codes' => 'encrypted:array',
+            'totp_confirmed_at' => 'datetime',
+            'enabled_at' => 'datetime',
+        ];
+    }
+
+    /**
+     * Accept a code from the authenticator app, once. False when the code is wrong, or
+     * when it is one that was already used (or older than one that was).
+     */
+    public function spendCode(string $code): bool
+    {
+        $step = $this->secret === null ? null : \Nevela\Laravel\Auth\Totp::step((string) $this->secret, $code);
+        if ($step === null) {
+            return false;
+        }
+        // One statement decides it, so two requests with the same code can't both win.
+        $taken = static::query()->whereKey($this->getKey())
+            ->where(fn ($query) => $query->whereNull('totp_last_step')->orWhere('totp_last_step', '<', $step))
+            ->update(['totp_last_step' => $step]);
+
+        return $taken === 1;
+    }
+
+    /** Whether codes from an authenticator app are set up and confirmed. */
+    public function usesAuthenticator(): bool
+    {
+        return $this->secret !== null && $this->totp_confirmed_at !== null;
+    }
+}

package/template/laravel/src/Nevela.php

@@ -18,7 +18,7 @@ use Nevela\Laravel\Support\Naming;
 final class Nevela
 {
     /** Written by `pnpm release`; the same number as the repository's git tag. */
-    public const VERSION = '0.2.1';
+    public const VERSION = '0.4.1';
 
     /** @var array<string, Descriptor> */
     private static array $descriptors = [];

package/template/laravel/src/NevelaServiceProvider.php

@@ -3,7 +3,10 @@
 namespace Nevela\Laravel;
 
 use Illuminate\Contracts\Debug\ExceptionHandler;
+use Illuminate\Cache\RateLimiting\Limit;
 use Illuminate\Foundation\Console\ServeCommand;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\Facades\Route;
 use Illuminate\Support\ServiceProvider;
 use Nevela\Laravel\Console\DevCommand;
@@ -16,6 +19,9 @@ use Nevela\Laravel\Console\UpdateCommand;
 use Nevela\Laravel\Console\UserCommand;
 use Nevela\Laravel\Console\VersionCommand;
 use Nevela\Laravel\Http\FlareErrors;
+use Nevela\Laravel\Http\Auth\AccountController;
+use Nevela\Laravel\Http\Auth\SecurityController;
+use Nevela\Laravel\Http\Auth\SignInController;
 use Nevela\Laravel\Http\TokenController;
 use Nevela\Laravel\Http\UploadController;
 use Nevela\Laravel\Media\Uploads;
@@ -58,16 +64,78 @@ final class NevelaServiceProvider extends ServiceProvider
         }
     }
 
+    /**
+     * Ten tries a minute at one account is plenty for a person and useless for guessing.
+     *
+     * The count is kept per account (or per sign-in that is under way), not per address
+     * alone: the dashboard's server makes these calls, so to Laravel every person arrives
+     * from the same address, and one limit for all of them would lock everyone out
+     * together. A second, much higher limit per address caps what any one caller can do.
+     */
+    private function limitAttempts(): void
+    {
+        RateLimiter::for('nevela-auth', function (Request $request) {
+            $who = $request->input('email') ?: $request->input('challenge') ?: $request->input('token') ?: $request->user('sanctum')?->getAuthIdentifier();
+            $limits = [Limit::perMinute((int) config('nevela.auth.attempts_per_address', 300))->by('nevela-auth-address:'.$request->ip())];
+            if (is_scalar($who) && (string) $who !== '') {
+                $limits[] = Limit::perMinute(10)->by('nevela-auth:'.sha1(mb_strtolower((string) $who)));
+            }
+
+            return $limits;
+        });
+    }
+
     private function registerRoutes(): void
     {
+        $this->limitAttempts();
+
         $prefix = config('nevela.prefix', 'api');
 
         if (config('nevela.auth.enabled', true)) {
-            Route::prefix($prefix)->middleware('api')->name('nevela.auth.')->group(function () {
-                Route::post('auth/token', [TokenController::class, 'store'])->middleware('throttle:6,1')->name('store');
+            Route::prefix($prefix.'/auth')->middleware('api')->name('nevela.auth.')->group(function () {
+                Route::get('config', [SignInController::class, 'config'])->name('config');
+
+                // Anything that takes a secret, or sends an email, is slowed down (see limitAttempts()).
+                Route::middleware('throttle:nevela-auth')->group(function () {
+                    Route::post('token', [SignInController::class, 'password'])->name('store');
+                    Route::post('two-factor/send', [SignInController::class, 'sendSecondStep'])->name('two-factor.send');
+                    Route::post('two-factor/verify', [SignInController::class, 'secondStep'])->name('two-factor.verify');
+                    Route::post('magic-link', [SignInController::class, 'sendLink'])->name('magic-link.send');
+                    Route::post('magic-link/verify', [SignInController::class, 'link'])->name('magic-link.verify');
+                    Route::post('email-code', [SignInController::class, 'sendCode'])->name('email-code.send');
+                    Route::post('email-code/verify', [SignInController::class, 'code'])->name('email-code.verify');
+                    Route::post('passkey/options', [SignInController::class, 'passkeyOptions'])->name('passkey.options');
+                    Route::post('passkey', [SignInController::class, 'passkey'])->name('passkey.verify');
+                    Route::post('register', [AccountController::class, 'register'])->name('register');
+                    Route::post('email/send', [AccountController::class, 'resendVerification'])->name('email.send');
+                    Route::post('email/verify', [AccountController::class, 'verifyEmail'])->name('email.verify');
+                    Route::post('password/forgot', [AccountController::class, 'forgotPassword'])->name('password.forgot');
+                    Route::post('password/reset', [AccountController::class, 'resetPassword'])->name('password.reset');
+                });
+
                 Route::middleware('auth:sanctum')->group(function () {
-                    Route::get('auth/me', [TokenController::class, 'show'])->name('show');
-                    Route::delete('auth/token', [TokenController::class, 'destroy'])->name('destroy');
+                    Route::get('me', [TokenController::class, 'show'])->name('show');
+                    Route::patch('me', [AccountController::class, 'update'])->name('update');
+                    Route::put('avatar', [AccountController::class, 'avatar'])->name('avatar');
+                    Route::delete('token', [TokenController::class, 'destroy'])->name('destroy');
+                    Route::post('password', [AccountController::class, 'changePassword'])->middleware('throttle:nevela-auth')->name('password.change');
+
+                    Route::get('sessions', [AccountController::class, 'sessions'])->name('sessions');
+                    Route::delete('sessions', [AccountController::class, 'revokeOtherSessions'])->name('sessions.revoke-others');
+                    Route::delete('sessions/{id}', [AccountController::class, 'revokeSession'])->name('sessions.revoke');
+
+                    Route::middleware('throttle:nevela-auth')->group(function () {
+                        Route::post('two-factor/enable', [SecurityController::class, 'enable'])->name('two-factor.enable');
+                        Route::post('two-factor/confirm', [SecurityController::class, 'confirm'])->name('two-factor.confirm');
+                        Route::post('two-factor/disable', [SecurityController::class, 'disable'])->name('two-factor.disable');
+                        Route::post('two-factor/backup-codes', [SecurityController::class, 'regenerateBackupCodes'])->name('two-factor.backup-codes');
+                    });
+
+                    Route::get('passkeys', [SecurityController::class, 'passkeys'])->name('passkeys');
+                    Route::post('passkeys/options', [SecurityController::class, 'passkeyOptions'])->name('passkeys.options');
+                    Route::post('passkeys', [SecurityController::class, 'addPasskey'])->name('passkeys.add');
+                    Route::patch('passkeys/{id}', [SecurityController::class, 'renamePasskey'])->name('passkeys.rename');
+                    Route::delete('passkeys/{id}', [SecurityController::class, 'removePasskey'])->name('passkeys.remove');
                 });
             });
         }

package/template/laravel/src/Support/Descriptor.php

@@ -148,16 +148,16 @@ final class Descriptor
         return str_replace('-', '_', Naming::snake($this->name));
     }
 
-    /** Split on commas that are not inside enum parentheses. @return list<string> */
+    /** Split on commas that are not inside parentheses or square brackets. @return list<string> */
     private static function splitSpec(string $spec): array
     {
         $parts = [];
         $depth = 0;
         $current = '';
         foreach (str_split($spec) as $char) {
-            if ($char === '(') {
+            if ($char === '(' || $char === '[') {
                 $depth++;
-            } elseif ($char === ')') {
+            } elseif ($char === ')' || $char === ']') {
                 $depth--;
             }
             if ($char === ',' && $depth === 0) {

package/template/laravel/src/Support/Field.php

@@ -106,12 +106,15 @@ final class Field
      *   category:belongsTo(Category)      stored as categoryId
      *   image:image                       an optimised image; image:image(product) names a profile
      *   manual:file(pdf|document)         any other upload
+     *
+     * Grit's and Flare's spellings are understood too: see normalise().
      */
     public static function parse(string $token): self
     {
-        $token = trim($token);
+        $written = trim($token);
+        $token = self::normalise($written);
         if (! preg_match('/^([A-Za-z][A-Za-z0-9_]*):([A-Za-z_]+)(?:\(([^)]*)\))?([?!]{0,2})$/', $token, $m)) {
-            throw new InvalidArgumentException("Invalid field \"{$token}\". Expected name:type, e.g. price:money or status:enum(draft|live)?");
+            throw new InvalidArgumentException("Invalid field \"{$written}\". Expected name:type, e.g. price:money, status:enum(draft|live)?, image:image or category:belongsTo(Category).");
         }
         [, $name, $type, $args, $suffix] = $m + [3 => '', 4 => ''];
         $name = Naming::camel($name);
@@ -142,6 +145,30 @@ final class Field
         return new self($name, $kind, $format, $required, $unique);
     }
 
+    /**
+     * The other ways people write a field, turned into Nevela's own.
+     *
+     * Grit puts what a type takes after a second colon, and Flare in square brackets, so
+     * someone coming from either types what they know:
+     *
+     *   image:file:image          image:file[image]        image:file:[image]     → image:file(image)
+     *   category:belongs_to:Category                                              → category:belongs_to(Category)
+     *   status:enum:draft|live    docs:file:[pdf, image]                          → …(draft|live), …(pdf|image)
+     */
+    private static function normalise(string $token): string
+    {
+        // Spaces around the punctuation don't mean anything: "file: [ image ]".
+        $token = (string) preg_replace('/\s*([:\[\]])\s*/', '$1', $token);
+        if (preg_match('/^([^:()\[\]]+):([A-Za-z_]+):?\[([^\[\]()]*)\]([?!]{0,2})$/', $token, $m)
+            || preg_match('/^([^:()\[\]]+):([A-Za-z_]+):([^:()\[\]?!]+)([?!]{0,2})$/', $token, $m)) {
+            $list = implode('|', array_filter(array_map('trim', preg_split('/[,|]/', $m[3])), fn ($value) => $value !== ''));
+
+            return "{$m[1]}:{$m[2]}({$list}){$m[4]}";
+        }
+
+        return $token;
+    }
+
     /** @param array<string, mixed> $data */
     public static function fromArray(string $name, array $data): self
     {

package/template/web/app/api/[...path]/route.ts

@@ -73,7 +73,11 @@ export async function PUT(request: NextRequest, context: Context) {
   if (!url || path[0] !== "_nevela" || path[1] !== "uploads") {
     return Response.json({ error: "Only uploads are sent this way. Records are saved through the dashboard." }, { status: 405 });
   }
-  if (Number(request.headers.get("content-length") ?? 0) > MAX_UPLOAD_BYTES) {
+  // Nothing is read until it is known who is sending it and how much there is.
+  if (!(await sessionToken())) return Response.json({ error: "Sign in first." }, { status: 401 });
+  const length = Number(request.headers.get("content-length"));
+  if (!Number.isFinite(length) || length <= 0) return Response.json({ error: "The upload didn't say how large it is." }, { status: 411 });
+  if (length > MAX_UPLOAD_BYTES) {
     return Response.json({ error: "That file is too large to upload." }, { status: 413 });
   }
 

package/template/web/app/api/auth/[...action]/route.ts

@@ -0,0 +1,196 @@
+import { cookies } from "next/headers";
+import type { NextRequest } from "next/server";
+import { API_URL, callerHeaders, sessionToken, TOKEN_COOKIE } from "@/lib/laravel";
+import { encodePending, PENDING_COOKIE, PENDING_MAX_AGE, pendingSecondStep, type SecondStepMethod } from "@/lib/second-step";
+import { safeRedirectPath } from "@/lib/session";
+
+/**
+ * Signing in and looking after an account, for the browser.
+ *
+ * Every auth screen calls this route (through lib/auth-client.ts), and this route calls
+ * Laravel's `auth/…` endpoints. It exists so the browser never holds a token:
+ *
+ * - when Laravel answers with a token, it goes into an httpOnly cookie and is taken out
+ *   of the answer,
+ * - a password sign-in that needs a second step is kept in a short-lived httpOnly cookie
+ *   until the code arrives, and
+ * - every other call has the token from the cookie added on the way through.
+ *
+ * Laravel decides everything: who may sign in, which methods are switched on, what a
+ * password must look like.
+ */
+export const dynamic = "force-dynamic";
+
+/** Sanctum tokens don't expire unless Laravel is told to; the cookie lasts 30 days. */
+const TOKEN_MAX_AGE = 60 * 60 * 24 * 30;
+/** The largest profile picture passed on; Laravel enforces its own limit. */
+const MAX_UPLOAD_BYTES = 64 * 1024 * 1024;
+
+type Context = { params: Promise<{ action: string[] }> };
+type Body = Record<string, unknown>;
+
+const cookieOptions = (maxAge: number) => ({
+  httpOnly: true,
+  sameSite: "lax" as const,
+  secure: process.env.NODE_ENV === "production",
+  path: "/",
+  maxAge,
+});
+
+/**
+ * A request that changes something has to come from this site's own pages. The cookie is
+ * SameSite=Lax, which already keeps it off cross-site POSTs; this refuses them outright.
+ */
+function fromThisSite(request: NextRequest): boolean {
+  const origin = request.headers.get("origin");
+  if (!origin) return request.headers.get("sec-fetch-site") !== "cross-site";
+  try {
+    return new URL(origin).host === (request.headers.get("x-forwarded-host") ?? request.headers.get("host"));
+  } catch {
+    return false;
+  }
+}
+
+async function callLaravel(request: NextRequest, method: string, path: string, body?: Body | ArrayBuffer, contentType?: string) {
+  const token = await sessionToken();
+  const headers: Record<string, string> = { Accept: "application/json", ...(await callerHeaders()) };
+  if (token) headers.Authorization = `Bearer ${token}`;
+  if (body !== undefined) headers["Content-Type"] = contentType ?? "application/json";
+
+  let response: Response;
+  try {
+    response = await fetch(`${API_URL}/auth/${path}${request.nextUrl.search}`, {
+      method,
+      headers,
+      body: body === undefined ? undefined : body instanceof ArrayBuffer ? body : JSON.stringify(body),
+      cache: "no-store",
+    });
+  } catch {
+    return { status: 502, body: { error: "Can't reach the server. Is the Laravel app running? Start both with: nevela dev", code: "SERVER_UNREACHABLE" } as Body };
+  }
+  const text = response.status === 204 ? "" : await response.text();
+  let parsed: Body = {};
+  if (text) {
+    try {
+      parsed = JSON.parse(text) as Body;
+    } catch {
+      parsed = { error: `The server answered ${response.status} with something unexpected.` };
+    }
+  }
+  // Laravel's own validation answers with issues per field; the screens show one message.
+  if (!response.ok) {
+    const issues = parsed.issues as { message?: string }[] | undefined;
+    parsed.error = issues?.[0]?.message ?? (parsed.error as string | undefined) ?? (parsed.message as string | undefined) ?? "Something went wrong. Try again.";
+  }
+  if (response.status === 429 && !parsed.code) parsed = { error: "Too many attempts. Wait a minute and try again.", code: "TOO_MANY_ATTEMPTS" };
+  return { status: response.status, body: parsed };
+}
+
+/** A sign-in that needs its second step: Laravel answered with a challenge instead of a token. */
+function secondStep(body: Body): { challenge: string; methods: SecondStepMethod[] } | null {
+  if (body.twoFactor !== true || typeof body.challenge !== "string") return null;
+  return { challenge: body.challenge, methods: (Array.isArray(body.methods) ? body.methods : []) as SecondStepMethod[] };
+}
+
+/**
+ * Keep a token Laravel issued in the cookie, and hand the rest of the answer to the browser.
+ * When Laravel asks for a second step instead (after a password, or an emailed link or code,
+ * on an account with two-factor on), the pending sign-in is remembered here and the browser
+ * is told to ask for the code.
+ */
+async function finish(result: { status: number; body: Body }): Promise<Response> {
+  const jar = await cookies();
+  const waiting = result.status === 200 ? secondStep(result.body) : null;
+  if (waiting) {
+    jar.set(PENDING_COOKIE, encodePending(waiting), cookieOptions(PENDING_MAX_AGE));
+    return Response.json({ twoFactorRedirect: true, methods: waiting.methods });
+  }
+  const { token, ...rest } = result.body;
+  if (typeof token === "string" && token) {
+    jar.set(TOKEN_COOKIE, token, cookieOptions(TOKEN_MAX_AGE));
+    jar.set(PENDING_COOKIE, "", cookieOptions(0));
+  }
+  return Response.json(rest, { status: result.status });
+}
+
+async function handle(request: NextRequest, context: Context, method: string): Promise<Response> {
+  const action = (await context.params).action.join("/");
+  if (!/^[a-z0-9/-]+$/i.test(action)) return Response.json({ error: "Not found." }, { status: 404 });
+  const jar = await cookies();
+
+  // The link in a sign-in email opens here.
+  if (method === "GET" && action === "magic-link") {
+    const safe = safeRedirectPath(request.nextUrl.searchParams.get("next"));
+    const result = await callLaravel(request, "POST", "magic-link/verify", { token: request.nextUrl.searchParams.get("token") ?? "" });
+    // An account with an authenticator app still owes its second step.
+    const waiting = result.status === 200 ? secondStep(result.body) : null;
+    if (waiting) {
+      jar.set(PENDING_COOKIE, encodePending(waiting), cookieOptions(PENDING_MAX_AGE));
+      return Response.redirect(new URL(`/two-factor?next=${encodeURIComponent(safe)}`, request.url), 303);
+    }
+    const token = result.body.token;
+    if (result.status >= 400 || typeof token !== "string") return Response.redirect(new URL("/sign-in?error=link", request.url), 303);
+    jar.set(TOKEN_COOKIE, token, cookieOptions(TOKEN_MAX_AGE));
+    const destination = new URL(safe, request.url);
+    // Belt and braces: whatever the path was, the destination is this site.
+    return Response.redirect(destination.origin === new URL(request.url).origin ? destination : new URL("/dashboard", request.url), 303);
+  }
+
+  if (method !== "GET" && !fromThisSite(request)) {
+    return Response.json({ error: "That request didn't come from this site.", code: "CROSS_SITE" }, { status: 403 });
+  }
+
+  // The profile picture is the request body, not JSON.
+  if (method === "PUT" && action === "avatar") {
+    // Nothing is read until it is known who is sending it and how much there is.
+    if (!(await sessionToken())) return Response.json({ error: "Sign in first.", code: "UNAUTHENTICATED" }, { status: 401 });
+    const length = Number(request.headers.get("content-length"));
+    if (!Number.isFinite(length) || length <= 0) return Response.json({ error: "The upload didn't say how large it is." }, { status: 411 });
+    if (length > MAX_UPLOAD_BYTES) return Response.json({ error: "That picture is too large." }, { status: 413 });
+    const file = await request.arrayBuffer();
+    if (file.byteLength > MAX_UPLOAD_BYTES) return Response.json({ error: "That picture is too large." }, { status: 413 });
+    return finish(await callLaravel(request, "PUT", "avatar", file, request.headers.get("content-type") ?? "application/octet-stream"));
+  }
+
+  let body: Body | undefined;
+  if (method !== "GET" && method !== "DELETE") {
+    try {
+      body = ((await request.json()) ?? {}) as Body;
+    } catch {
+      body = {};
+    }
+  }
+
+  // Signing out: the cookie goes whether or not Laravel could be told.
+  if (method === "DELETE" && action === "token") {
+    const result = await callLaravel(request, "DELETE", "token");
+    // Removed with the attributes they were set with: a browser won't let a cookie marked
+    // Secure be replaced by one that isn't.
+    jar.set(TOKEN_COOKIE, "", cookieOptions(0));
+    jar.set(PENDING_COOKIE, "", cookieOptions(0));
+    return Response.json({}, { status: result.status === 204 || result.status === 401 ? 200 : result.status });
+  }
+
+  // The second step. The browser sends only the code; which sign-in it belongs to is in the cookie.
+  if (method === "POST" && (action === "two-factor/send" || action === "two-factor/verify")) {
+    const waiting = await pendingSecondStep();
+    if (!waiting) return Response.json({ error: "That sign-in has expired. Start again.", code: "SESSION_EXPIRED" }, { status: 401 });
+    const result = await callLaravel(request, "POST", action, { ...body, challenge: waiting.challenge });
+    if (result.body.code === "SESSION_EXPIRED" || result.body.code === "TOO_MANY_ATTEMPTS") jar.set(PENDING_COOKIE, "", cookieOptions(0));
+    return finish(result);
+  }
+
+  // Whether a sign-in is waiting for its second step, and how it can be completed.
+  if (method === "GET" && action === "two-factor/pending") {
+    const waiting = await pendingSecondStep();
+    return Response.json({ pending: waiting !== null, methods: waiting?.methods ?? [] });
+  }
+
+  return finish(await callLaravel(request, method, action, body));
+}
+
+export const GET = (request: NextRequest, context: Context) => handle(request, context, "GET");
+export const POST = (request: NextRequest, context: Context) => handle(request, context, "POST");
+export const PUT = (request: NextRequest, context: Context) => handle(request, context, "PUT");
+export const PATCH = (request: NextRequest, context: Context) => handle(request, context, "PATCH");
+export const DELETE = (request: NextRequest, context: Context) => handle(request, context, "DELETE");

package/template/web/app/auth-actions.ts

@@ -1,48 +1,7 @@
 "use server";
 
 import { cookies } from "next/headers";
-import { API_URL, laravel, TOKEN_COOKIE } from "@/lib/laravel";
-
-export type SignInResult = { ok: true } | { ok: false; error: string };
-
-/** Sanctum tokens don't expire unless Laravel is told to; the cookie lasts 30 days. */
-const MAX_AGE = 60 * 60 * 24 * 30;
-
-/**
- * Exchange an email and password for a Sanctum token (`POST /auth/token`) and keep it
- * in an httpOnly cookie. The browser never holds the token itself.
- */
-export async function signInAction(email: string, password: string): Promise<SignInResult> {
-  let response;
-  try {
-    response = await laravel("auth/token", { method: "POST", body: { email, password }, token: null });
-  } catch {
-    return { ok: false, error: `Can't reach the server at ${API_URL}. Start it with: php nevela dev` };
-  }
-  if (!response.ok) {
-    const body = (response.body ?? {}) as { error?: string; message?: string; issues?: { message: string }[] };
-    if (response.status === 429) return { ok: false, error: "Too many attempts. Wait a minute and try again." };
-    if (response.status === 404 || response.status === 405) {
-      // Something answered, but it has no sign-in route: it isn't this app's API. Usually
-      // another program already had the port when the API was started.
-      return {
-        ok: false,
-        error: `${API_URL} is answered by a different program, not this app's API. Stop what is using that port, or start both with "php nevela dev", which picks a free one.`,
-      };
-    }
-    return { ok: false, error: body.issues?.[0]?.message ?? body.error ?? body.message ?? "Sign-in failed. Try again." };
-  }
-
-  const { token } = response.body as { token: string };
-  (await cookies()).set(TOKEN_COOKIE, token, {
-    httpOnly: true,
-    sameSite: "lax",
-    secure: process.env.NODE_ENV === "production",
-    path: "/",
-    maxAge: MAX_AGE,
-  });
-  return { ok: true };
-}
+import { laravel, TOKEN_COOKIE } from "@/lib/laravel";
 
 /** Revoke the token in Laravel (`DELETE /auth/token`) and forget it here. */
 export async function signOutAction(): Promise<void> {
@@ -51,5 +10,7 @@ export async function signOutAction(): Promise<void> {
   } catch {
     // Laravel being down shouldn't keep someone signed in on this side.
   }
-  (await cookies()).delete(TOKEN_COOKIE);
+  // Removed with the attributes it was set with: a browser won't let a cookie marked
+  // Secure be replaced by one that isn't.
+  (await cookies()).set(TOKEN_COOKIE, "", { httpOnly: true, sameSite: "lax", secure: process.env.NODE_ENV === "production", path: "/", maxAge: 0 });
 }

package/template/web/app/dashboard/account/layout.tsx

@@ -0,0 +1,29 @@
+import { AccountNav } from "@/components/account/account-nav";
+import { PageHeader } from "@/components/dashboard/page-header";
+import { authConfig, enabledSocialProviders, twoFactorAvailable } from "@/lib/auth-config";
+import { requireSession } from "@/lib/session";
+
+/** The frame the account's pages share: one header, one set of links. */
+export default async function AccountLayout({ children }: { children: React.ReactNode }) {
+  await requireSession("/dashboard/account");
+  const security = twoFactorAvailable || authConfig.passkeys || enabledSocialProviders().length > 0;
+
+  return (
+    <>
+      <PageHeader
+        title="Account"
+        description="Your profile, how you sign in, and where you're signed in."
+        crumbs={[{ label: "Dashboard", href: "/dashboard" }, { label: "Account" }]}
+      />
+      <AccountNav
+        links={[
+          { href: "/dashboard/account", label: "Profile" },
+          { href: "/dashboard/account/password", label: "Password" },
+          ...(security ? [{ href: "/dashboard/account/security", label: "Security" }] : []),
+          { href: "/dashboard/account/sessions", label: "Devices" },
+        ]}
+      />
+      <div className="flex max-w-3xl flex-col gap-6">{children}</div>
+    </>
+  );
+}

package/template/web/app/dashboard/account/page.tsx

@@ -0,0 +1,19 @@
+import { Profile } from "@/components/account/sections";
+import { requireSession } from "@/lib/session";
+
+export const metadata = { title: "Profile" };
+
+export default async function ProfilePage() {
+  const { user } = await requireSession("/dashboard/account");
+  return (
+    <Profile
+      user={{
+        name: user.name ?? "",
+        email: user.email,
+        emailVerified: user.emailVerified,
+        twoFactorEnabled: user.twoFactorEnabled,
+        avatar: user.avatar,
+      }}
+    />
+  );
+}

package/template/web/app/dashboard/account/password/page.tsx

@@ -0,0 +1,10 @@
+import { Password } from "@/components/account/sections";
+import { requireSession } from "@/lib/session";
+
+export const metadata = { title: "Password" };
+
+export default async function PasswordPage() {
+  const { user } = await requireSession("/dashboard/account/password");
+  // Every Laravel account has a password; there are no social-only accounts yet.
+  return <Password hasPassword email={user.email} />;
+}

package/template/web/app/dashboard/account/security/page.tsx

@@ -0,0 +1,19 @@
+import { ConnectedAccounts, Passkeys, TwoFactor } from "@/components/account/sections";
+import { authConfig, enabledSocialProviders, twoFactorAvailable } from "@/lib/auth-config";
+import { requireSession } from "@/lib/session";
+
+export const metadata = { title: "Security" };
+
+/** Two-factor, passkeys and the accounts you can sign in with. */
+export default async function SecurityPage() {
+  const { user } = await requireSession("/dashboard/account/security");
+  const providers = enabledSocialProviders();
+
+  return (
+    <>
+      {twoFactorAvailable && <TwoFactor enabled={user.twoFactorEnabled} hasPassword methods={authConfig.twoFactor} />}
+      {authConfig.passkeys && <Passkeys />}
+      {providers.length > 0 && <ConnectedAccounts providers={providers} />}
+    </>
+  );
+}

package/template/web/app/dashboard/account/sessions/page.tsx

@@ -0,0 +1,9 @@
+import { Sessions } from "@/components/account/sections";
+import { requireSession } from "@/lib/session";
+
+export const metadata = { title: "Devices" };
+
+export default async function SessionsPage() {
+  await requireSession("/dashboard/account/sessions");
+  return <Sessions />;
+}