Files
tool-evaluator/artifacts/toolrate/src/pages/login.tsx
T
opencode bcae59626f
Build & Push Docker Image / build (push) Successful in 2m16s
feat(security): add CSRF protection for all state-changing API routes
- Synchronizer token stored in session; GET /auth/csrf to obtain it
- csrfProtection middleware requires X-CSRF-Token on non-safe methods
- customFetch injects the header via setCsrfTokenGetter
- toolrate boot loads token; reload after local login (session regenerate)
- OpenAPI GET /auth/csrf + CsrfToken schema, orval regenerated
2026-08-03 10:30:13 +02:00

117 lines
4.1 KiB
TypeScript

import { useState } from "react";
import { useLocation, useSearch, Link } from "wouter";
import { useLocalLogin } from "@workspace/api-client-react";
import { useQueryClient } from "@tanstack/react-query";
import { Button } from "@/components/ui/button";
import { Input } from "@/components/ui/input";
import { Label } from "@/components/ui/label";
import { PasswordInput } from "@/components/password-input";
import { loadCsrfToken } from "@/lib/csrf";
import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
import { ThemeToggle } from "@/components/theme-toggle";
import { Wrench, AlertCircle } from "lucide-react";
import { useTranslation } from "react-i18next";
export default function Login() {
const { t } = useTranslation();
const [, setLocation] = useLocation();
const search = useSearch();
const params = new URLSearchParams(search);
const returnTo = params.get("returnTo") || "/";
const [username, setUsername] = useState("");
const [password, setPassword] = useState("");
const [error, setError] = useState<string | null>(null);
const queryClient = useQueryClient();
const localLogin = useLocalLogin();
const handleSubmit = (e: React.FormEvent) => {
e.preventDefault();
setError(null);
localLogin.mutate(
{ data: { username, password } },
{
onSuccess: () => {
queryClient.invalidateQueries();
void loadCsrfToken();
setLocation(returnTo);
},
onError: (err) => {
setError(err.data?.error || err.message || t("auth.invalidCredentials"));
},
},
);
};
return (
<div className="min-h-screen bg-background flex items-center justify-center p-4">
<div className="absolute top-4 right-4">
<ThemeToggle />
</div>
<div className="w-full max-w-sm space-y-6">
<div className="flex flex-col items-center gap-2 text-center">
<Link href="/" className="flex items-center gap-2 text-primary font-bold text-2xl">
<Wrench className="w-7 h-7" />
<span>toolr</span>
</Link>
<p className="text-muted-foreground text-sm">{t("auth.loginSubtitle")}</p>
</div>
<Card>
<CardHeader className="pb-4">
<CardTitle className="text-lg">{t("auth.signIn")}</CardTitle>
<CardDescription>{t("auth.loginDescription")}</CardDescription>
</CardHeader>
<CardContent>
<form onSubmit={handleSubmit} className="space-y-4">
<div className="space-y-2">
<Label htmlFor="username">{t("auth.username")}</Label>
<Input
id="username"
type="text"
value={username}
onChange={(e) => setUsername(e.target.value)}
placeholder="admin"
autoFocus
required
/>
</div>
<div className="space-y-2">
<Label htmlFor="password">{t("auth.password")}</Label>
<PasswordInput
id="password"
value={password}
onChange={(e) => setPassword(e.target.value)}
required
/>
</div>
{error && (
<div className="flex items-center gap-2 text-destructive text-sm rounded-md bg-destructive/10 px-3 py-2">
<AlertCircle className="w-4 h-4 shrink-0" />
{error}
</div>
)}
<Button
type="submit"
className="w-full"
disabled={localLogin.isPending}
>
{localLogin.isPending ? t("common.loading") : t("auth.signIn")}
</Button>
</form>
</CardContent>
</Card>
<div className="text-center">
<Link href="/" className="text-sm text-muted-foreground hover:text-primary transition-colors">
{t("notFound.backHome")}
</Link>
</div>
</div>
</div>
);
}