feat: Google OAuth ile giris

- User modeline googleId (unique) eklendi - google start/callback API route'lari (state korumali, find-or-create) - Login/register sayfalarina Google butonu - docker-compose'a GOOGLE_CLIENT_ID/SECRET env gecisi - tsconfig.tsbuildinfo gitignore'a eklendi
2026-08-02 16:50:34 +03:00
parent 17319a1555
commit bf2fc272f2
12 changed files with 272 additions and 2 deletions
@@ -3,3 +3,8 @@ DATABASE_URL="postgresql://ht44@localhost:5432/winninghunter?schema=public"
 AUTH_COOKIE_NAME=wh_session
 AUTH_SESSION_DAYS=30
 ADMIN_EMAILS="admin@winninghunter.local"
+
+# Google OAuth (https://console.cloud.google.com/apis/credentials)
+# Authorized redirect URI: {NEXT_PUBLIC_APP_URL}/api/auth/google/callback
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
@@ -4,6 +4,11 @@ AUTH_COOKIE_NAME=wh_session
 AUTH_SESSION_DAYS=30
 ADMIN_EMAILS="admin@winninghunter.local"

+# Google OAuth (https://console.cloud.google.com/apis/credentials)
+# Authorized redirect URI: {NEXT_PUBLIC_APP_URL}/api/auth/google/callback
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+
 # For docker-compose
 POSTGRES_PASSWORD="change-this-long-random-password"
 PORT=3000
@@ -5,6 +5,7 @@ node_modules
 .DS_Store
 next-env.d.ts
 /prisma/dev.db
+tsconfig.tsbuildinfo

 MEMORY.md

@@ -0,0 +1,7 @@
+<!-- BEGIN:nextjs-agent-rules -->
+# This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` before writing any code. Heed deprecation notices.
+
+**Keep this block, including in commits.** It is part of the project's agent setup, maintained by `next dev` for every agent that works here. If it appears as an uncommitted change, that is intentional — commit it as-is. Do not remove it to clean up a diff; it will be regenerated.
+<!-- END:nextjs-agent-rules -->
@@ -0,0 +1 @@
+@AGENTS.md
@@ -27,6 +27,8 @@ services:
      AUTH_COOKIE_NAME: wh_session
      AUTH_SESSION_DAYS: 30
      ADMIN_EMAILS: admin@winninghunter.local
+      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
+      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
    ports:
      - "${PORT:-3000}:3000"
    command: sh -c "npx prisma db push && npm run start"
@@ -86,6 +86,7 @@ model User {
  id           String   @id @default(cuid())
  email        String   @unique
  passwordHash String?
+  googleId     String?  @unique
  name         String?
  avatarUrl    String?
  role         UserRole @default(USER)
@@ -0,0 +1,89 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import { UserRole } from "@prisma/client";
+import { prisma } from "@/lib/db";
+import { createSession } from "@/lib/auth/session";
+import { isConfiguredAdminEmail } from "@/lib/admin-emails";
+import { exchangeGoogleCode, fetchGoogleProfile, GOOGLE_STATE_COOKIE } from "@/lib/auth/google";
+
+function redirectToLogin(error: string) {
+  return NextResponse.redirect(
+    new URL(`/login?error=${encodeURIComponent(error)}`, process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000")
+  );
+}
+
+export async function GET(req: Request) {
+  const url = new URL(req.url);
+  const code = url.searchParams.get("code");
+  const state = url.searchParams.get("state");
+  const oauthError = url.searchParams.get("error");
+
+  if (oauthError) return redirectToLogin(oauthError);
+
+  const cookieStore = await cookies();
+  const expectedState = cookieStore.get(GOOGLE_STATE_COOKIE)?.value;
+  cookieStore.delete(GOOGLE_STATE_COOKIE);
+
+  if (!code || !state || !expectedState || state !== expectedState) {
+    return redirectToLogin("GOOGLE_STATE_MISMATCH");
+  }
+
+  let tokens;
+  try {
+    tokens = await exchangeGoogleCode(code);
+  } catch (err) {
+    console.error("[google/callback] token exchange failed:", err);
+    return redirectToLogin("GOOGLE_AUTH_FAILED");
+  }
+
+  let profile;
+  try {
+    profile = await fetchGoogleProfile(tokens.access_token);
+  } catch (err) {
+    console.error("[google/callback] profile fetch failed:", err);
+    return redirectToLogin("GOOGLE_AUTH_FAILED");
+  }
+
+  if (!profile.sub) return redirectToLogin("GOOGLE_AUTH_FAILED");
+
+  const email = (profile.email || "").trim().toLowerCase();
+  if (!email) return redirectToLogin("GOOGLE_EMAIL_REQUIRED");
+
+  const isAdmin = isConfiguredAdminEmail(email);
+  const plan = await prisma.plan.findUnique({ where: { code: isAdmin ? "PREMIUM" : "FREE" } });
+
+  let user = await prisma.user.findUnique({ where: { googleId: profile.sub } });
+  if (!user) {
+    user = await prisma.user.findUnique({ where: { email } });
+  }
+
+  if (!user) {
+    if (!plan) return redirectToLogin("PLAN_NOT_SEEDED");
+    user = await prisma.user.create({
+      data: {
+        email,
+        googleId: profile.sub,
+        name: profile.name || email.split("@")[0],
+        avatarUrl: profile.picture || null,
+        locale: profile.locale || "tr",
+        role: isAdmin ? UserRole.ADMIN : UserRole.USER,
+        subscription: { create: { planId: plan.id, status: "ACTIVE" } }
+      }
+    });
+  } else {
+    user = await prisma.user.update({
+      where: { id: user.id },
+      data: {
+        googleId: user.googleId || profile.sub,
+        name: user.name || profile.name || null,
+        avatarUrl: user.avatarUrl || profile.picture || null,
+        lastLoginAt: new Date()
+      }
+    });
+  }
+
+  await createSession(user.id);
+  return NextResponse.redirect(
+    new URL("/dashboard/ads", process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000")
+  );
+}
@@ -0,0 +1,32 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import { randomToken } from "@/lib/auth/crypto";
+import { googleAuthUrl, googleConfig, GOOGLE_STATE_COOKIE } from "@/lib/auth/google";
+
+export async function GET() {
+  const config = googleConfig();
+  if (!config) {
+    return NextResponse.redirect(
+      new URL("/login?error=GOOGLE_NOT_CONFIGURED", process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000")
+    );
+  }
+
+  const state = randomToken(16);
+  const cookieStore = await cookies();
+  cookieStore.set(GOOGLE_STATE_COOKIE, state, {
+    httpOnly: true,
+    sameSite: "lax",
+    secure: process.env.NODE_ENV === "production",
+    path: "/",
+    maxAge: 600
+  });
+
+  const authUrl = googleAuthUrl(state);
+  if (!authUrl) {
+    return NextResponse.redirect(
+      new URL("/login?error=GOOGLE_NOT_CONFIGURED", process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000")
+    );
+  }
+
+  return NextResponse.redirect(authUrl);
+}
@@ -2,6 +2,17 @@

 import { useState } from "react";

+function GoogleIcon() {
+  return (
+    <svg width="18" height="18" viewBox="0 0 48 48" aria-hidden="true">
+      <path fill="#EA4335" d="M24 9.5c3.54 0 6.71 1.22 9.21 3.6l6.85-6.85C35.9 2.38 30.47 0 24 0 14.62 0 6.51 5.38 2.56 13.22l7.98 6.19C12.43 13.72 17.74 9.5 24 9.5z" />
+      <path fill="#4285F4" d="M46.98 24.55c0-1.57-.15-3.09-.38-4.55H24v9.02h12.94c-.58 2.96-2.26 5.48-4.78 7.18l7.73 6c4.51-4.18 7.09-10.36 7.09-17.65z" />
+      <path fill="#FBBC05" d="M10.53 28.59c-.48-1.45-.76-2.99-.76-4.59s.27-3.14.76-4.59l-7.98-6.19C.92 16.46 0 20.12 0 24c0 3.88.92 7.54 2.56 10.78l7.97-6.19z" />
+      <path fill="#34A853" d="M24 48c6.48 0 11.93-2.13 15.89-5.81l-7.73-6c-2.15 1.45-4.92 2.3-8.16 2.3-6.26 0-11.57-4.22-13.47-9.91l-7.98 6.19C6.51 42.62 14.62 48 24 48z" />
+    </svg>
+  );
+}
+
 export default function LoginPage() {
  const [email, setEmail] = useState("");
  const [password, setPassword] = useState("");
@@ -67,7 +78,18 @@ export default function LoginPage() {
        
        {error && <div className="mt-4 rounded-xl bg-red-50 p-3 text-sm text-red-700">{error}</div>}

-        <button type="submit" className="mt-6 w-full rounded-xl bg-violet-700 px-4 py-3 font-bold text-white hover:bg-violet-800 transition">
+        <a href="/api/auth/google/start" className="mt-6 flex w-full items-center justify-center gap-3 rounded-xl border border-slate-200 bg-white px-4 py-3 font-semibold text-slate-700 transition hover:bg-slate-50">
+          <GoogleIcon />
+          Google ile devam et
+        </a>
+        
+        <div className="mt-4 flex items-center gap-3">
+          <div className="h-px flex-1 bg-slate-200" />
+          <span className="text-xs font-medium text-slate-400">veya</span>
+          <div className="h-px flex-1 bg-slate-200" />
+        </div>
+        
+        <button type="submit" className="mt-4 w-full rounded-xl bg-violet-700 px-4 py-3 font-bold text-white hover:bg-violet-800 transition">
          Giriş yap
        </button>

@@ -2,6 +2,17 @@

 import { useState } from "react";

+function GoogleIcon() {
+  return (
+    <svg width="18" height="18" viewBox="0 0 48 48" aria-hidden="true">
+      <path fill="#EA4335" d="M24 9.5c3.54 0 6.71 1.22 9.21 3.6l6.85-6.85C35.9 2.38 30.47 0 24 0 14.62 0 6.51 5.38 2.56 13.22l7.98 6.19C12.43 13.72 17.74 9.5 24 9.5z" />
+      <path fill="#4285F4" d="M46.98 24.55c0-1.57-.15-3.09-.38-4.55H24v9.02h12.94c-.58 2.96-2.26 5.48-4.78 7.18l7.73 6c4.51-4.18 7.09-10.36 7.09-17.65z" />
+      <path fill="#FBBC05" d="M10.53 28.59c-.48-1.45-.76-2.99-.76-4.59s.27-3.14.76-4.59l-7.98-6.19C.92 16.46 0 20.12 0 24c0 3.88.92 7.54 2.56 10.78l7.97-6.19z" />
+      <path fill="#34A853" d="M24 48c6.48 0 11.93-2.13 15.89-5.81l-7.73-6c-2.15 1.45-4.92 2.3-8.16 2.3-6.26 0-11.57-4.22-13.47-9.91l-7.98 6.19C6.51 42.62 14.62 48 24 48z" />
+    </svg>
+  );
+}
+
 export default function RegisterPage() {
  const [email, setEmail] = useState("");
  const [password, setPassword] = useState("");
@@ -55,7 +66,18 @@ export default function RegisterPage() {
        
        {error && <div className="mt-4 rounded-xl bg-red-50 p-3 text-sm text-red-700">{error}</div>}

-        <button className="mt-6 w-full rounded-xl bg-violet-700 px-4 py-3 font-bold text-white hover:bg-violet-800 transition">
+        <a href="/api/auth/google/start" className="mt-6 flex w-full items-center justify-center gap-3 rounded-xl border border-slate-200 bg-white px-4 py-3 font-semibold text-slate-700 transition hover:bg-slate-50">
+          <GoogleIcon />
+          Google ile devam et
+        </a>
+        
+        <div className="mt-4 flex items-center gap-3">
+          <div className="h-px flex-1 bg-slate-200" />
+          <span className="text-xs font-medium text-slate-400">veya</span>
+          <div className="h-px flex-1 bg-slate-200" />
+        </div>
+        
+        <button className="mt-4 w-full rounded-xl bg-violet-700 px-4 py-3 font-bold text-white hover:bg-violet-800 transition">
          Hesap oluştur
        </button>

@@ -0,0 +1,83 @@
+const GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
+const GOOGLE_USERINFO_URL = "https://openidconnect.googleapis.com/v1/userinfo";
+
+export const GOOGLE_STATE_COOKIE = "wh_google_oauth_state";
+
+export function googleConfig() {
+  const clientId = process.env.GOOGLE_CLIENT_ID;
+  const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
+  if (!clientId || !clientSecret) return null;
+  return { clientId, clientSecret };
+}
+
+export function googleRedirectUri() {
+  const appUrl = process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000";
+  return `${appUrl.replace(/\/$/, "")}/api/auth/google/callback`;
+}
+
+export function googleAuthUrl(state: string) {
+  const config = googleConfig();
+  if (!config) return null;
+  const params = new URLSearchParams({
+    client_id: config.clientId,
+    redirect_uri: googleRedirectUri(),
+    response_type: "code",
+    scope: "openid email profile",
+    access_type: "online",
+    prompt: "select_account",
+    state
+  });
+  return `${GOOGLE_AUTH_URL}?${params.toString()}`;
+}
+
+export type GoogleTokenResponse = {
+  access_token: string;
+  token_type: string;
+  expires_in: number;
+  id_token?: string;
+  scope?: string;
+};
+
+export async function exchangeGoogleCode(code: string) {
+  const config = googleConfig();
+  if (!config) throw new Error("GOOGLE_NOT_CONFIGURED");
+
+  const body = new URLSearchParams({
+    code,
+    client_id: config.clientId,
+    client_secret: config.clientSecret,
+    redirect_uri: googleRedirectUri(),
+    grant_type: "authorization_code"
+  });
+
+  const res = await fetch(GOOGLE_TOKEN_URL, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body
+  });
+
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`GOOGLE_TOKEN_EXCHANGE_FAILED: ${res.status} ${text.slice(0, 200)}`);
+  }
+
+  return (await res.json()) as GoogleTokenResponse;
+}
+
+export type GoogleProfile = {
+  sub: string;
+  email?: string;
+  email_verified?: boolean;
+  name?: string;
+  picture?: string;
+  locale?: string;
+};
+
+export async function fetchGoogleProfile(accessToken: string) {
+  const res = await fetch(GOOGLE_USERINFO_URL, {
+    headers: { authorization: `Bearer ${accessToken}` }
+  });
+  if (!res.ok) throw new Error(`GOOGLE_PROFILE_FAILED: ${res.status}`);
+  return (await res.json()) as GoogleProfile;
+}