Added user authentication with email and password #46

whlpatricia · 2025-11-22T04:16:48Z

Added user authentication with email and password. For now the tmp page displays the user token when signed in successfully.

vercel · 2025-11-22T04:16:57Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
trcc	Error			Nov 22, 2025 4:16am

Copilot

Pull request overview

This PR implements user authentication with email and password using Supabase, adding sign-in, sign-up, and email confirmation flows. However, there are several critical issues that need to be addressed, including incorrect file naming for Next.js middleware, incorrect import paths, missing error pages, and security vulnerabilities.

Key Changes

Added Supabase authentication functions for email/password sign-up and sign-in
Created a temporary login page with forms for testing authentication
Implemented email confirmation route handler for Supabase OTP verification
Added middleware (incorrectly named as proxy.ts) for session management and route protection

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
src/proxy.ts	Middleware entry point with incorrect naming and import path - should be middleware.ts
src/lib/client/supabase/proxy.ts	Session management middleware logic for protecting routes
src/lib/client/supabase/client.ts	Browser client initialization for Supabase
src/lib/client/supabase/auth.ts	Authentication functions for email/password sign-up and sign-in
src/app/login/page.tsx	Temporary UI for testing authentication flows
src/app/auth/confirm/route.ts	Email confirmation handler with open redirect vulnerability

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/app/login/page.tsx

Copilot · 2025-11-22T14:43:23Z

src/proxy.ts

@@ -0,0 +1,20 @@
+import { updateSession } from "@/lib/supabase/proxy";


The import path is incorrect. The file proxy.ts is located at src/lib/client/supabase/proxy.ts, not @/lib/supabase/proxy. This should be @/lib/client/supabase/proxy to match the actual file location.

Suggested change

import { updateSession } from "@/lib/supabase/proxy";

import { updateSession } from "@/lib/client/supabase/proxy";

Double check this

Copilot · 2025-11-22T14:43:24Z

src/proxy.ts

+import { updateSession } from "@/lib/supabase/proxy";
+import { type NextRequest } from "next/server";
+
+export async function proxy(request: NextRequest) {


This file should be named middleware.ts rather than proxy.ts and placed at the root of src/ directory. Next.js expects middleware to be exported from a file named middleware.ts at the root of the src directory (or project root). The exported function should also be named middleware instead of proxy.

Suggested change

export async function proxy(request: NextRequest) {

export async function middleware(request: NextRequest) {

Does the name proxy.ts for this file work? Because for the Next.js version (15.5.6) we're using it asks for the function to be called middleware. The newest version (16) of Next.js requires proxy.ts instead of middleware.ts, but in the version we're using this isn't used yet.

src/lib/client/supabase/auth.ts

Copilot · 2025-11-22T14:43:24Z

src/lib/client/supabase/auth.ts

+export async function signInWithEmail(email: string, password: string) {
+  const supabase = createClient();
+  const { data, error } = await supabase.auth.signInWithPassword({
+    email,
+    password,
+  });
+  return { data, error };
+}


Consider adding email format validation before calling the Supabase API. While the HTML input type="email" provides basic validation, additional checks in the auth functions would provide defense-in-depth and ensure consistent validation if these functions are called from other contexts.

We can ignore this for now for the same reason that we ignore the password checks. Performing these strength requirements checks on the frontend would provide faster feedback to the user.

Copilot · 2025-11-22T14:43:24Z

src/app/auth/confirm/route.ts

+  const next = searchParams.get('next') ?? '/'
+
+  if (token_hash && type) {
+    const supabase = await createClient()
+
+    const { error } = await supabase.auth.verifyOtp({
+      type,
+      token_hash,
+    })
+    if (!error) {
+      // redirect user to specified redirect URL or root of app
+      redirect(next)


The next parameter from search params is used directly for redirection without validation. This creates an open redirect vulnerability where attackers could craft malicious links to redirect users to external sites after authentication. Validate that the redirect URL is relative or on the same domain before using it.

This is good practice

Copilot · 2025-11-22T14:43:25Z

src/lib/client/supabase/auth.ts

+
+export async function signUpWithEmail(email: string, password: string) {
+  const supabase = createClient();
+  const { data, error } = await supabase.auth.signUp({ email, password });


The signUpWithEmail function should include an emailRedirectTo option to specify where users should be redirected after confirming their email. Without this, the confirmation link may not work correctly with the /auth/confirm route. Consider adding: options: { emailRedirectTo: ${window.location.origin}/auth/confirm }

Suggested change

const { data, error } = await supabase.auth.signUp({ email, password });

const { data, error } = await supabase.auth.signUp(

{ email, password },

{ emailRedirectTo: `${window.location.origin}/auth/confirm` }

);

Does the confirmation link work properly?

Copilot · 2025-11-22T14:43:25Z

src/app/auth/confirm/route.ts

+import { type EmailOtpType } from '@supabase/supabase-js'
+import { type NextRequest } from 'next/server'
+
+import { createClient } from '@/lib/client/supabase/server'
+import { redirect } from 'next/navigation'


Inconsistent quote style. This file uses single quotes while other files in the codebase use double quotes (e.g., src/lib/client/supabase/client.ts, src/lib/client/supabase/auth.ts). Consider using double quotes for consistency with the rest of the codebase.

I think this is also the errors Vercel points out. Make sure you're up-to-date with the latest main branch! There's code in the main branch that runs formatting/linting automatically for you before every commit.

Copilot · 2025-11-22T14:43:25Z

src/app/auth/confirm/route.ts

+  }
+
+  // redirect the user to an error page with some instructions
+  redirect('/auth/auth-code-error')


The route redirects to /auth/auth-code-error but this page doesn't exist in the codebase. This will result in a 404 error when email confirmation fails. You need to create the error page at src/app/auth/auth-code-error/page.tsx.

You can just create a very basic page

LeandroHamaguchi

This was one of the hardest tickets, and overall, great work Patricia!

LeandroHamaguchi · 2025-11-29T23:48:57Z

src/app/auth/confirm/route.ts

+  }
+
+  // redirect the user to an error page with some instructions
+  redirect('/auth/auth-code-error')


You can just create a very basic page

LeandroHamaguchi · 2025-11-30T00:23:41Z

src/lib/client/supabase/proxy.ts

We should use a different name for this file since it's the same as src/proxy.ts

LeandroHamaguchi · 2025-12-02T03:26:44Z

src/app/auth/confirm/route.ts

+import { type EmailOtpType } from '@supabase/supabase-js'
+import { type NextRequest } from 'next/server'
+
+import { createClient } from '@/lib/client/supabase/server'
+import { redirect } from 'next/navigation'


I think this is also the errors Vercel points out. Make sure you're up-to-date with the latest main branch! There's code in the main branch that runs formatting/linting automatically for you before every commit.

LeandroHamaguchi · 2025-12-02T03:27:10Z

src/app/auth/confirm/route.ts

+  const next = searchParams.get('next') ?? '/'
+
+  if (token_hash && type) {
+    const supabase = await createClient()
+
+    const { error } = await supabase.auth.verifyOtp({
+      type,
+      token_hash,
+    })
+    if (!error) {
+      // redirect user to specified redirect URL or root of app
+      redirect(next)


This is good practice

LeandroHamaguchi · 2025-12-02T03:27:53Z

src/lib/client/supabase/auth.ts

+
+export async function signUpWithEmail(email: string, password: string) {
+  const supabase = createClient();
+  const { data, error } = await supabase.auth.signUp({ email, password });


Does the confirmation link work properly?

LeandroHamaguchi · 2025-12-02T03:28:43Z

src/proxy.ts

@@ -0,0 +1,20 @@
+import { updateSession } from "@/lib/supabase/proxy";


Double check this

Added user authentication with email and password

b6d7e5d

whlpatricia linked an issue Nov 22, 2025 that may be closed by this pull request

BE 2 - Implement User Authentication with Email + Password #11

Open

ch-iv requested a review from Copilot November 22, 2025 14:39

Copilot started reviewing on behalf of ch-iv November 22, 2025 14:39 View session

Copilot finished reviewing on behalf of ch-iv November 22, 2025 14:42

Copilot AI reviewed Nov 22, 2025

View reviewed changes

LeandroHamaguchi requested changes Dec 2, 2025

View reviewed changes

		@@ -0,0 +1,20 @@
		import { updateSession } from "@/lib/supabase/proxy";

	import { updateSession } from "@/lib/supabase/proxy";
	import { updateSession } from "@/lib/client/supabase/proxy";

	export async function proxy(request: NextRequest) {
	export async function middleware(request: NextRequest) {

Added user authentication with email and password #46

Are you sure you want to change the base?

Added user authentication with email and password #46

Uh oh!

Conversation

whlpatricia commented Nov 22, 2025

Uh oh!

vercel bot commented Nov 22, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Key Changes

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Nov 22, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 22, 2025

Choose a reason for hiding this comment

Uh oh!

LeandroHamaguchi Nov 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Nov 22, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 22, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 22, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 22, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 22, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

LeandroHamaguchi left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

LeandroHamaguchi Nov 29, 2025 •

edited

Loading