From 8175c95e6e8afd3e5cc0e0fbc8c213ca78811cc6 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 10 Feb 2026 01:54:45 +0000
Subject: [PATCH] fix(auth): implement email normalization and robust
 NEXTAUTH_URL detection

- Implement case-insensitive email handling in `lib/auth.ts` and `app/api/register/route.ts` to fix login issues for returning users.
- Remove hardcoded `NEXTAUTH_URL` from `scripts/init.js` and `.env` to allow auto-detection, fixing Google OAuth redirect failures.
- Add a subtle "Admin Sanctuary" link to the landing page footer for easier admin access.

Co-authored-by: virtuehearts <17357584+virtuehearts@users.noreply.github.com>
---
 app/api/register/route.ts |  8 ++--
 app/page.tsx              | 20 ++++++---
 dev_server.log            | 88 ---------------------------------------
 lib/auth.ts               | 19 +++++----
 scripts/init.js           |  1 -
 5 files changed, 32 insertions(+), 104 deletions(-)
 delete mode 100644 dev_server.log

diff --git a/app/api/register/route.ts b/app/api/register/route.ts
index 33c299d..1610529 100644
--- a/app/api/register/route.ts
+++ b/app/api/register/route.ts
@@ -12,7 +12,9 @@ export async function POST(req: Request) {
       return NextResponse.json({ error: "Missing fields" }, { status: 400 });
     }
 
-    const [existingUser] = await db.select().from(users).where(eq(users.email, email)).limit(1);
+    const normalizedEmail = email.toLowerCase();
+
+    const [existingUser] = await db.select().from(users).where(eq(users.email, normalizedEmail)).limit(1);
 
     if (existingUser) {
       return NextResponse.json({ error: "User already exists" }, { status: 400 });
@@ -22,10 +24,10 @@ export async function POST(req: Request) {
 
     const [user] = await db.insert(users).values({
       name,
-      email,
+      email: normalizedEmail,
       password: hashedPassword,
       status: "PENDING",
-      role: email === process.env.ADMIN_EMAIL ? "ADMIN" : "USER",
+      role: normalizedEmail === process.env.ADMIN_EMAIL?.toLowerCase() ? "ADMIN" : "USER",
     }).returning();
 
     return NextResponse.json({ user: { email: user.email, name: user.name } });
diff --git a/app/page.tsx b/app/page.tsx
index 4508bc6..bfd314b 100644
--- a/app/page.tsx
+++ b/app/page.tsx
@@ -40,11 +40,21 @@ export default function LandingPage() {
         </div>
       </main>
 
-      <footer className="p-8 text-center text-foreground-muted/60 border-t border-primary/10">
-        <p className="mb-2">Contact: 647-781-8371</p>
-        <p className="font-script text-xl text-accent/80">
-          Blessings of peace, Baba Virtuehearts
-        </p>
+      <footer className="p-8 text-center text-foreground-muted/60 border-t border-primary/10 space-y-4">
+        <div>
+          <p className="mb-2">Contact: 647-781-8371</p>
+          <p className="font-script text-xl text-accent/80">
+            Blessings of peace, Baba Virtuehearts
+          </p>
+        </div>
+        <div>
+          <Link
+            href="/admin"
+            className="text-xs hover:text-accent transition-colors opacity-50 hover:opacity-100"
+          >
+            Admin Sanctuary
+          </Link>
+        </div>
       </footer>
     </div>
   );
diff --git a/dev_server.log b/dev_server.log
deleted file mode 100644
index 8f2a4bd..0000000
--- a/dev_server.log
+++ /dev/null
@@ -1,88 +0,0 @@
-
-> virtuehearts-reiki-training@0.1.0 dev
-> node scripts/init.js && next dev
-
---- Initializing Environment ---
-Environment file is already complete.
---- Initialization Complete ---
-   ▲ Next.js 15.1.6
-   - Local:        http://localhost:3000
-   - Network:      http://192.168.0.2:3000
-   - Environments: .env
-
- ✓ Starting...
- ✓ Ready in 1871ms
- ○ Compiling /login ...
- ✓ Compiled /login in 10.3s (718 modules)
- GET /login 200 in 11315ms
- ✓ Compiled in 1118ms (345 modules)
- GET /login? 200 in 106ms
- ○ Compiling /api/auth/[...nextauth] ...
- ✓ Compiled /api/auth/[...nextauth] in 2.6s (1033 modules)
- GET /api/auth/session 200 in 4851ms
- GET /login 200 in 160ms
- GET /api/auth/session 200 in 114ms
- GET /api/auth/providers 200 in 375ms
- GET /api/auth/csrf 200 in 81ms
-[next-auth][error][SIGNIN_OAUTH_ERROR]
-https://next-auth.js.org/errors#signin_oauth_error client_id is required {
-  error: {
-    message: 'client_id is required',
-    stack: 'TypeError: client_id is required\n' +
-      '    at new BaseClient (webpack-internal:///(rsc)/./node_modules/openid-client/lib/client.js:148:19)\n' +
-      '    at new Client (webpack-internal:///(rsc)/./node_modules/openid-client/lib/client.js:1673:13)\n' +
-      '    at openidClient (webpack-internal:///(rsc)/./node_modules/next-auth/core/lib/oauth/client.js:24:18)\n' +
-      '    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)\n' +
-      '    at async getAuthorizationUrl (webpack-internal:///(rsc)/./node_modules/next-auth/core/lib/oauth/authorization-url.js:58:18)\n' +
-      '    at async Object.signin (webpack-internal:///(rsc)/./node_modules/next-auth/core/routes/signin.js:31:24)\n' +
-      '    at async AuthHandler (webpack-internal:///(rsc)/./node_modules/next-auth/core/index.js:230:26)\n' +
-      '    at async NextAuthRouteHandler (webpack-internal:///(rsc)/./node_modules/next-auth/next/index.js:57:28)\n' +
-      '    at async NextAuth._args$ (webpack-internal:///(rsc)/./node_modules/next-auth/next/index.js:89:16)\n' +
-      '    at async AppRouteRouteModule.do (/app/node_modules/next/dist/compiled/next-server/app-route.runtime.dev.js:10:32847)\n' +
-      '    at async AppRouteRouteModule.handle (/app/node_modules/next/dist/compiled/next-server/app-route.runtime.dev.js:10:39868)\n' +
-      '    at async doRender (/app/node_modules/next/dist/server/base-server.js:1452:42)\n' +
-      '    at async responseGenerator (/app/node_modules/next/dist/server/base-server.js:1822:28)\n' +
-      '    at async DevServer.renderToResponseWithComponentsImpl (/app/node_modules/next/dist/server/base-server.js:1832:28)\n' +
-      '    at async DevServer.renderPageComponent (/app/node_modules/next/dist/server/base-server.js:2259:24)\n' +
-      '    at async DevServer.renderToResponseImpl (/app/node_modules/next/dist/server/base-server.js:2297:32)\n' +
-      '    at async DevServer.pipeImpl (/app/node_modules/next/dist/server/base-server.js:959:25)\n' +
-      '    at async NextNodeServer.handleCatchallRenderRequest (/app/node_modules/next/dist/server/next-server.js:281:17)\n' +
-      '    at async DevServer.handleRequestImpl (/app/node_modules/next/dist/server/base-server.js:853:17)\n' +
-      '    at async /app/node_modules/next/dist/server/dev/next-dev-server.js:371:20\n' +
-      '    at async Span.traceAsyncFn (/app/node_modules/next/dist/trace/trace.js:153:20)\n' +
-      '    at async DevServer.handleRequest (/app/node_modules/next/dist/server/dev/next-dev-server.js:368:24)\n' +
-      '    at async invokeRender (/app/node_modules/next/dist/server/lib/router-server.js:230:21)\n' +
-      '    at async handleRequest (/app/node_modules/next/dist/server/lib/router-server.js:408:24)\n' +
-      '    at async requestHandlerImpl (/app/node_modules/next/dist/server/lib/router-server.js:432:13)\n' +
-      '    at async Server.requestListener (/app/node_modules/next/dist/server/lib/start-server.js:146:13)',
-    name: 'TypeError'
-  },
-  providerId: 'google',
-  message: 'client_id is required'
-}
- POST /api/auth/signin/google 200 in 60ms
- GET /api/auth/error?error=OAuthSignin 302 in 29ms
- GET /api/auth/signin?error=OAuthSignin 302 in 19ms
- GET /login?callbackUrl=http%3A%2F%2Flocalhost%3A3000%2Fdashboard&error=OAuthSignin 200 in 54ms
- GET /api/auth/session 200 in 33ms
- GET /login 200 in 33ms
- GET /api/auth/session 200 in 29ms
- GET /api/auth/providers 200 in 13ms
- GET /api/auth/csrf 200 in 9ms
- POST /api/auth/callback/credentials 200 in 192ms
- GET /api/auth/session 200 in 18ms
- ○ Compiling /middleware ...
- ✓ Compiled /middleware in 1211ms (200 modules)
- ○ Compiling /dashboard ...
- ✓ Compiled /dashboard in 1166ms (1094 modules)
- GET /dashboard 200 in 1297ms
- ○ Compiling /admin ...
- ✓ Compiled /admin in 829ms (1124 modules)
- GET /api/user/progress 200 in 1206ms
- GET /admin 200 in 1204ms
- GET /api/auth/session 200 in 29ms
- ○ Compiling /api/admin/ai-settings ...
- ✓ Compiled /api/admin/ai-settings in 626ms (1128 modules)
- GET /api/admin/ai-settings 500 in 705ms
- GET /api/admin/users 200 in 846ms
- ✓ Compiled in 671ms (382 modules)
diff --git a/lib/auth.ts b/lib/auth.ts
index 29f28de..09c8058 100644
--- a/lib/auth.ts
+++ b/lib/auth.ts
@@ -23,10 +23,11 @@ export const authOptions: NextAuthOptions = {
           throw new Error("Invalid credentials");
         }
 
-        const isAdmin = credentials.email === process.env.ADMIN_EMAIL;
+        const normalizedEmail = credentials.email.toLowerCase();
+        const isAdmin = normalizedEmail === process.env.ADMIN_EMAIL?.toLowerCase();
         const adminPasswordEnv = process.env.ADMIN_PASSWORD;
 
-        const [existingUser] = await db.select().from(users).where(eq(users.email, credentials.email)).limit(1);
+        const [existingUser] = await db.select().from(users).where(eq(users.email, normalizedEmail)).limit(1);
         let user = existingUser;
 
         // 1. Try DB password first (important if changed via UI)
@@ -49,7 +50,7 @@ export const authOptions: NextAuthOptions = {
         if (isAdmin && adminPasswordEnv && credentials.password === adminPasswordEnv) {
           if (!user) {
             const [newUser] = await db.insert(users).values({
-              email: credentials.email,
+              email: normalizedEmail,
               password: await bcrypt.hash(adminPasswordEnv, 10),
               role: "ADMIN",
               status: "APPROVED",
@@ -91,12 +92,15 @@ export const authOptions: NextAuthOptions = {
   callbacks: {
     async signIn({ user, account }) {
       if (account?.provider === "google") {
-        const [existingUser] = await db.select().from(users).where(eq(users.email, user.email!)).limit(1);
+        const normalizedEmail = user.email?.toLowerCase();
+        if (!normalizedEmail) return false;
+
+        const [existingUser] = await db.select().from(users).where(eq(users.email, normalizedEmail)).limit(1);
 
         if (!existingUser) {
-          const isAdmin = user.email === process.env.ADMIN_EMAIL;
+          const isAdmin = normalizedEmail === process.env.ADMIN_EMAIL?.toLowerCase();
           await db.insert(users).values({
-            email: user.email!,
+            email: normalizedEmail,
             name: user.name,
             image: user.image,
             status: isAdmin ? "APPROVED" : "PENDING",
@@ -108,7 +112,8 @@ export const authOptions: NextAuthOptions = {
     },
     async jwt({ token, user }) {
       if (user) {
-        const [dbUser] = await db.select().from(users).where(eq(users.email, user.email!)).limit(1);
+        const normalizedEmail = user.email?.toLowerCase();
+        const [dbUser] = await db.select().from(users).where(eq(users.email, normalizedEmail!)).limit(1);
         if (dbUser) {
           token.id = dbUser.id;
           token.role = dbUser.role;
diff --git a/scripts/init.js b/scripts/init.js
index 72c173c..e755c01 100644
--- a/scripts/init.js
+++ b/scripts/init.js
@@ -13,7 +13,6 @@ function main() {
   }
 
   const defaultEnv = {
-    NEXTAUTH_URL: 'http://localhost:3000',
     NEXTAUTH_SECRET: crypto.randomBytes(32).toString('hex'),
     DATABASE_URL: 'file:./dev.db',
     ADMIN_EMAIL: 'admin@virtuehearts.org',