feat: 3-click SSO registration - unified /auth page, Google/Apple/GitHub OAuth, email fallback, provider model

src/app/api/auth/[provider]/callback/route.ts

@@ -0,0 +1,157 @@
+import { NextRequest, NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import {
+  type Provider,
+  exchangeCode,
+  findOrCreateOAuthUser,
+  verifyState,
+} from "@/lib/oauth";
+import { signJWT } from "@/lib/auth";
+
+const VALID_PROVIDERS = ["google", "apple", "github"];
+
+async function handleCallback(
+  req: NextRequest,
+  provider: string
+): Promise<NextResponse> {
+  try {
+    // Grab code and state from query params or POST body (Apple uses form_post)
+    const url = new URL(req.url);
+    let code = url.searchParams.get("code");
+    let stateParam = url.searchParams.get("state");
+
+    // Apple may POST form data — try reading POST body
+    if (!code) {
+      try {
+        const contentType = req.headers.get("content-type") || "";
+        if (contentType.includes("form")) {
+          const formData = await req.formData();
+          code = formData.get("code") as string | null;
+          stateParam = formData.get("state") as string | null;
+        }
+      } catch {
+        // not a form POST, that's fine
+      }
+    }
+
+    if (!code) {
+      return NextResponse.json(
+        { error: "Missing authorization code" },
+        { status: 400 }
+      );
+    }
+
+    if (!stateParam) {
+      return NextResponse.json(
+        { error: "Missing state parameter" },
+        { status: 400 }
+      );
+    }
+
+    // Verify state from cookie (CSRF protection)
+    const cookieStore = await cookies();
+    const storedState = cookieStore.get("oauth_state")?.value;
+
+    if (!storedState) {
+      return NextResponse.json(
+        {
+          error: "Missing state cookie. Please start the OAuth flow again.",
+        },
+        { status: 400 }
+      );
+    }
+
+    const statePayload = await verifyState(stateParam);
+    if (!statePayload) {
+      return NextResponse.json(
+        {
+          error:
+            "Invalid or expired state. Please start the OAuth flow again.",
+        },
+        { status: 400 }
+      );
+    }
+
+    // Verify the state and provider match
+    if (statePayload.provider !== provider) {
+      return NextResponse.json(
+        { error: "State/provider mismatch" },
+        { status: 400 }
+      );
+    }
+
+    // Clear the state cookie
+    cookieStore.set("oauth_state", "", {
+      httpOnly: true,
+      path: "/",
+      maxAge: 0,
+    });
+
+    // Build the redirect URI (must match the one used in the authorization request)
+    const baseUrl = `${url.protocol}//${url.host}`;
+    const redirectUri = `${baseUrl}/mobile/api/auth/${provider}/callback`;
+
+    // Exchange code for user info
+    const providerUser = await exchangeCode(
+      provider as Provider,
+      code,
+      redirectUri
+    );
+
+    // Find or create user in database
+    const user = await findOrCreateOAuthUser(
+      provider as Provider,
+      providerUser
+    );
+
+    // Generate JWT
+    const token = await signJWT({
+      userId: user.id,
+      email: user.email,
+      isPremium: user.isPremium,
+      isPro: user.isPro,
+    });
+
+    // Redirect to frontend callback page with token
+    const frontendUrl = `${baseUrl}/mobile/auth/callback?token=${encodeURIComponent(token)}`;
+    return NextResponse.redirect(frontendUrl);
+  } catch (error) {
+    console.error(`${provider} OAuth callback error:`, error);
+    const message =
+      error instanceof Error ? error.message : "OAuth callback failed";
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}
+
+export async function GET(
+  req: NextRequest,
+  { params }: { params: Promise<{ provider: string }> }
+) {
+  const { provider } = await params;
+  if (!VALID_PROVIDERS.includes(provider)) {
+    return NextResponse.json(
+      {
+        error: `Unsupported provider. Must be one of: ${VALID_PROVIDERS.join(", ")}`,
+      },
+      { status: 400 }
+    );
+  }
+  return handleCallback(req, provider);
+}
+
+/** Apple OAuth may use form_post response_mode, which sends a POST. */
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ provider: string }> }
+) {
+  const { provider } = await params;
+  if (!VALID_PROVIDERS.includes(provider)) {
+    return NextResponse.json(
+      {
+        error: `Unsupported provider. Must be one of: ${VALID_PROVIDERS.join(", ")}`,
+      },
+      { status: 400 }
+    );
+  }
+  return handleCallback(req, provider);
+}

src/app/api/auth/[provider]/route.ts

@@ -0,0 +1,63 @@
+import { NextRequest, NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import {
+  type Provider,
+  PROVIDER_CONFIGS,
+  generateState,
+  buildAuthorizationUrl,
+} from "@/lib/oauth";
+
+const VALID_PROVIDERS = ["google", "apple", "github"];
+
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ provider: string }> }
+) {
+  const { provider } = await params;
+
+  if (!VALID_PROVIDERS.includes(provider)) {
+    return NextResponse.json(
+      { error: `Unsupported provider. Must be one of: ${VALID_PROVIDERS.join(", ")}` },
+      { status: 400 }
+    );
+  }
+
+  const config = PROVIDER_CONFIGS[provider as Provider];
+  const clientId = process.env[config.clientIdEnv];
+
+  if (!clientId) {
+    return NextResponse.json(
+      {
+        error: `${provider} OAuth is not configured. Missing ${config.clientIdEnv} environment variable.`,
+      },
+      { status: 503 }
+    );
+  }
+
+  // Build the redirect URI — the callback URL for this provider
+  const url = new URL(_req.url);
+  const baseUrl = `${url.protocol}//${url.host}`;
+  const redirectUri = `${baseUrl}/mobile/api/auth/${provider}/callback`;
+
+  // Generate state for CSRF protection
+  const state = await generateState(provider as Provider);
+
+  // Store state in a cookie
+  const cookieStore = await cookies();
+  cookieStore.set("oauth_state", state, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: 60 * 10, // 10 minutes
+  });
+
+  // Build the authorization URL and redirect
+  const authUrl = buildAuthorizationUrl(
+    provider as Provider,
+    state,
+    redirectUri
+  );
+
+  return NextResponse.redirect(authUrl);
+}

src/app/api/auth/register/route.ts

@@ -29,6 +29,7 @@ export async function POST(req: NextRequest) {
         email,
         name,
         passwordHash,
+        provider: "email",
         flhBalance: 5000,
         trialEndsAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
       },