PR fixes

apps/app-portal/src/app/(landing)/page.tsx

@@ -3,9 +3,17 @@ import Link from "next/link";
 import Image from "next/image";
 import icon from "@/app/icon.ico";
 import TiledBackground from "@/components/ui/tiled-background";
+import {redirect} from "next/navigation";
+import {isAdminEmail} from "@/lib/auth/roles.ts";
+import {getSession} from "@/lib/auth/session.ts";
+
+export default async function Page(): Promise<JSX.Element> {
+
+  const session = await getSession();
+  if (session?.user) {
+    redirect(isAdminEmail(session.user.email) ? "/admin" : "/dashboard");
+  }
 
-//TODO: update to redirect authed users to /dashboard
-export default function Page(): JSX.Element {
   return (
     <div className="relative w-[100vw] h-[100vh] overflow-hidden">
       <TiledBackground />

apps/app-portal/src/app/auth/signin/page.tsx

@@ -5,12 +5,19 @@ import { getSession } from "@/lib/auth/session";
 import { SignInForm } from "@/components/auth/SignInForm";
 import {isAdminEmail} from "@/lib/auth/roles.ts";
 
-export default async function Page(): Promise<JSX.Element> {
+export default async function Page({
+  searchParams,
+}: {
+  searchParams: { callbackUrl?: string };
+}): Promise<JSX.Element> {
   // read cookie - see if valid session in DB - if so, automatically redir user to logged in part
   const session = await getSession();
   if (session?.user) {
     redirect(isAdminEmail(session.user.email) ? "/admin" : "/dashboard");
   }
 
-  return <SignInForm />;
+  // callbackUrl is only present when middleware bounced an unauthed user here
+  // from a protected route. The form uses it both to prompt "sign in first" and
+  // as the post-sign-in destination baked into the magic link.
+  return <SignInForm callbackUrl={searchParams?.callbackUrl} />;
 }

apps/app-portal/src/components/auth/SignInForm.tsx

@@ -12,7 +12,11 @@ const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; //regex email checker
 
 type Status = "idle" | "loading" | "sent";
 
-export function SignInForm() {
+export function SignInForm({
+  callbackUrl,
+}: {
+  callbackUrl?: string;
+}) {
   const [dotCount, setDotCount] = useState(1);
   const [email, setEmail] = useState("");
   const [status, setStatus] = useState<Status>("idle");
@@ -25,6 +29,14 @@ export function SignInForm() {
     return () => clearInterval(id);
   }, []);
 
+  // Prompt users who were bounced here from a protected route (callbackUrl set).
+  useEffect(() => {
+    if (callbackUrl) {
+      // stable id so StrictMode's double-invoke shows one toast, not two
+      toast.info("Sign in before accessing the portal!", { id: "auth-required" });
+    }
+  }, [callbackUrl]);
+
   async function handleSignIn() {
     // invalid email -> inline error, no request sent
     if (!EMAIL_RE.test(email.trim())) {
@@ -37,12 +49,14 @@ export function SignInForm() {
     try {
       // signIn() handles CSRF, form-encoding, and the redirect for us.
       // redirect:false → we drive the UI state ourselves instead of navigating.
-      // The callbackUrl is baked into the magic link; the admin layout
-      // re-checks the role server-side, so this is routing, not authorization.
+      // The callbackUrl is baked into the magic link. If the user was bounced
+      // here from a protected route, send them back to it; otherwise fall back
+      // to their default landing. The admin layout re-checks the role
+      // server-side, so this is routing, not authorization.
       const res = await signIn("email", {
         email: email.trim(),
         redirect: false,
-        callbackUrl: isAdminEmail(email) ? "/admin" : "/dashboard",
+        callbackUrl: callbackUrl ?? (isAdminEmail(email) ? "/admin" : "/dashboard"),
       });
 
       if (res?.error) {
@@ -81,10 +95,14 @@ export function SignInForm() {
               setEmail(e.target.value);
               if (emailError) setEmailError(null);
             }}
+            onKeyDown={(e)=>{
+              if (e.key === "Enter") document.getElementById("submit")?.click()
+            }}
             className={"w-full p-1 mt-4 border-2 rounded-md"}
           />
           {/*confirm*/}
           <button
+            id={"submit"}
             className={
               "w-full bg-starlightBlueLight text-white p-1 px-5 mt-4 border-2 rounded-md disabled:opacity-50"
             }
@@ -97,9 +115,9 @@ export function SignInForm() {
           {/*status / error message*/}
           <div className={"w-full flex flex-row items-end min-h-[2rem] pb-2"}>
             {emailError ? (
-              <p className={"w-full text-[#FF0000] text-end text-[12px]"}>
+              <p className={"w-full text-[#bf3d3d] text-end text-[12px]"}>
                 {emailError}
-              </p> //todo: change the red
+              </p>
             ) : status === "loading" ? (
               <p className={"w-full text-[#AAAAAA] text-end"}>
                 Loading{".".repeat(dotCount)}
@@ -108,10 +126,9 @@ export function SignInForm() {
             ) : status === "sent" ? (
               <p
                 className={
-                  "w-full text-[rgb(120,255,150)] text-end text-[12px] whitespace-nowrap"
+                  "w-full text-[#319948] text-end text-[12px] whitespace-nowrap"
                 }
               >
-                {/*todo: change the green*/}
                 Check your email for a sign-in link!
               </p>
             ) : null}

apps/app-portal/src/lib/auth/config.ts

@@ -31,5 +31,10 @@ export const authOptions: NextAuthOptions = {
       }
       return session;
     },
+    async redirect({ url, baseUrl }) {
+      if (url.startsWith("/")) return `${baseUrl}${url}`
+      else if (new URL(url).origin === baseUrl) return url
+      return baseUrl
+    }
   },
 };

apps/app-portal/src/middleware.ts

@@ -5,11 +5,22 @@
 //  having needed to login in advance.
 //Unauthenticated requests to matched routes are redirected to sign-in
 
-import { NextResponse } from "next/server";
+import { withAuth } from "next-auth/middleware";
 
-export default function middleware() {
-  return NextResponse.next();
-}
+export default withAuth({
+  callbacks: {
+    authorized({ req }) {
+      return Boolean(
+        req.cookies.get("next-auth.session-token") ??
+          req.cookies.get("__Secure-next-auth.session-token"),
+      );
+    },
+  },
+  pages: {
+    signIn: "/auth/signin",
+    error: "/auth/error",
+  },
+});
 
 //the matcher was written with assistance of AI
 export const config = {
@@ -21,6 +32,6 @@ export const config = {
      *  - the landing page "/" and /login             public entry points
      * Add any other public path to this negative lookahead as you build it.
      */
-    "/((?!auth|_next/static|_next/image|favicon.ico|login$|$).*)",
+    "/((?!api/auth|_next/static|_next/image|favicon.ico|login$|$).*)",
   ],
 };