good forst commit

apps/web/app/api/auth/login/route.ts

@@ -0,0 +1,19 @@
+import { getApiBaseUrl, jsonResponse } from '../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function POST(req: Request): Promise<Response> {
+  const body = await req.json();
+  const upstream = await fetch(`${getApiBaseUrl()}/auth/login`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify(body),
+    cache: 'no-store',
+  });
+  const payload = await upstream.json();
+  if (!upstream.ok) return jsonResponse(payload, upstream.status);
+  const token: string | undefined = payload?.token;
+  if (!token) return jsonResponse({ message: 'Login response missing token' }, 502);
+  const cookieValue = `tower_token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${60 * 60 * 24 * 7}`;
+  return jsonResponse({ admin: payload.admin }, 200, { 'Set-Cookie': cookieValue });
+}

apps/web/app/api/auth/logout/route.ts

@@ -0,0 +1,12 @@
+import { TOKEN_COOKIE, jsonResponse } from '../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function POST(): Promise<Response> {
+  const cookieValue = `${TOKEN_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+  return new Response(null, { status: 204, headers: { 'Set-Cookie': cookieValue } });
+}
+
+export function GET(): Response {
+  return jsonResponse({ message: 'Use POST to log out' }, 405);
+}

apps/web/app/api/auth/me/route.ts

@@ -0,0 +1,9 @@
+import { apiFetch, jsonResponse } from '../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(): Promise<Response> {
+  const res = await apiFetch('/auth/me');
+  const body = await res.json();
+  return jsonResponse(body, res.status);
+}

apps/web/app/api/auth/signup/route.ts

@@ -0,0 +1,19 @@
+import { getApiBaseUrl, jsonResponse } from '../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function POST(req: Request): Promise<Response> {
+  const body = await req.json();
+  const upstream = await fetch(`${getApiBaseUrl()}/auth/signup`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify(body),
+    cache: 'no-store',
+  });
+  const payload = await upstream.json();
+  if (!upstream.ok) return jsonResponse(payload, upstream.status);
+  const token: string | undefined = payload?.token;
+  if (!token) return jsonResponse({ message: 'Signup response missing token' }, 502);
+  const cookieValue = `tower_token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${60 * 60 * 24 * 7}`;
+  return jsonResponse({ admin: payload.admin }, 200, { 'Set-Cookie': cookieValue });
+}

apps/web/app/api/auth/super/login/route.ts

@@ -0,0 +1,19 @@
+import { getApiBaseUrl, jsonResponse } from '../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function POST(req: Request): Promise<Response> {
+  const body = await req.json().catch(() => ({}));
+  const res = await fetch(`${getApiBaseUrl()}/auth/super/login`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify(body),
+    cache: 'no-store',
+  });
+  const payload = await res.json();
+  const headers: Record<string, string> = {};
+  if (res.ok && payload.token) {
+    headers['Set-Cookie'] = `tower_super_token=${payload.token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${7 * 24 * 60 * 60}`;
+  }
+  return jsonResponse(payload, res.status, headers);
+}

apps/web/app/api/auth/super/logout/route.ts

@@ -0,0 +1,9 @@
+import { jsonResponse } from '../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function POST(): Promise<Response> {
+  return jsonResponse({ ok: true }, 200, {
+    'Set-Cookie': 'tower_super_token=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0',
+  });
+}

apps/web/app/api/auth/super/me/route.ts

@@ -0,0 +1,16 @@
+import { getApiBaseUrl, jsonResponse } from '../../../../_lib/api';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(): Promise<Response> {
+  const token = await (await import('next/headers')).cookies().then(c => c.get('tower_super_token')?.value);
+  const res = await fetch(`${getApiBaseUrl()}/auth/super/me`, {
+    headers: {
+      Accept: 'application/json',
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+    },
+    cache: 'no-store',
+  });
+  const body = await res.json();
+  return jsonResponse(body, res.status);
+}