6389dcf78e
Backend: - Auth controller sets httpOnly secure cookies (access_token, refresh_token, goodgo_authenticated) on login/register/refresh - JWT strategy reads token from cookie first, falls back to Authorization header - Added POST /auth/logout to clear auth cookies - Added POST /auth/exchange-token for OAuth callback token-to-cookie exchange - Refresh endpoint reads refresh_token from cookie (body fallback for backwards compat) - CSRF middleware excludes auth endpoints (login, register, refresh, exchange-token, logout) Frontend: - Removed all localStorage token storage (goodgo_tokens key) - Removed authGet/authPost/authPatch helpers from api-client (tokens sent via cookies) - All API calls use credentials:'include' for cookie-based auth - Updated auth-store: no more token state, uses isAuthenticated flag from cookie - Updated admin-api, listings-api to remove explicit token parameters - Updated all pages (admin dashboard, users, KYC, moderation, listings) to remove token passing - OAuth callbacks use exchange-token endpoint to convert URL tokens to cookies - Auth provider simplified (no client-side cookie management needed) Security improvements: - JWT no longer accessible via JavaScript (XSS-safe) - Refresh token scoped to /auth path only - Server-side goodgo_authenticated cookie with SameSite=Lax - Access token cookie with SameSite=Strict Co-Authored-By: Paperclip <noreply@paperclip.ing>
63 lines
2.2 KiB
TypeScript
63 lines
2.2 KiB
TypeScript
'use client';
|
||
|
||
import Link from 'next/link';
|
||
import { usePathname } from 'next/navigation';
|
||
import { cn } from '@/lib/utils';
|
||
import { useAuthStore } from '@/lib/auth-store';
|
||
import { Button } from '@/components/ui/button';
|
||
|
||
const navItems = [
|
||
{ href: '/dashboard', label: 'Bảng điều khiển', icon: '🏠' },
|
||
{ href: '/listings', label: 'Tin đăng', icon: '📋' },
|
||
{ href: '/listings/new', label: 'Đăng tin', icon: '➕' },
|
||
{ href: '/analytics', label: 'Phân tích', icon: '📊' },
|
||
];
|
||
|
||
export default function DashboardLayout({ children }: { children: React.ReactNode }) {
|
||
const pathname = usePathname();
|
||
const { user, logout } = useAuthStore();
|
||
|
||
return (
|
||
<div className="min-h-screen bg-background">
|
||
<header className="sticky top-0 z-50 border-b bg-background/95 backdrop-blur supports-[backdrop-filter]:bg-background/60">
|
||
<div className="mx-auto flex h-14 max-w-7xl items-center px-4">
|
||
<Link href="/" className="mr-6 flex items-center space-x-2">
|
||
<span className="text-lg font-bold text-primary">GoodGo</span>
|
||
</Link>
|
||
|
||
<nav className="flex items-center space-x-1">
|
||
{navItems.map((item) => (
|
||
<Link
|
||
key={item.href}
|
||
href={item.href}
|
||
className={cn(
|
||
'rounded-md px-3 py-2 text-sm font-medium transition-colors hover:bg-accent hover:text-accent-foreground',
|
||
pathname === item.href
|
||
? 'bg-accent text-accent-foreground'
|
||
: 'text-muted-foreground',
|
||
)}
|
||
>
|
||
<span className="mr-1.5">{item.icon}</span>
|
||
{item.label}
|
||
</Link>
|
||
))}
|
||
</nav>
|
||
|
||
<div className="ml-auto flex items-center space-x-3">
|
||
{user && (
|
||
<span className="text-sm text-muted-foreground">
|
||
{user.fullName}
|
||
</span>
|
||
)}
|
||
<Button variant="ghost" size="sm" onClick={() => logout()}>
|
||
Đăng xuất
|
||
</Button>
|
||
</div>
|
||
</div>
|
||
</header>
|
||
|
||
<main className="mx-auto max-w-7xl px-4 py-6">{children}</main>
|
||
</div>
|
||
);
|
||
}
|