Skip to content

Auth — session helpers + error page #498

Open
Feature
Open
Auth — session helpers + error page#498
Feature
Assignees
mzhang0213

Description

@adityapat24
adityapat24
opened on Jul 16, 2026

Context

Last sprint shipped auth routing, admin/user redirects, logout, and magic-link email delivery. What's left is the reusable session helpers every other endpoint needs, plus the friendly error page.

Tasks

Session helpers

  • Implement getSession() in src/lib/auth/session.ts that returns the typed Session (email, isAdmin) or null. Use NextAuth's getServerSession under the hood.
    • What this accomplishes: Any server component or route handler can call one function to know who's signed in. Encapsulates the NextAuth API so if it changes, only one file needs updating.
  • Implement requireUser() in src/lib/auth/guards.ts. Calls getSession(), returns the user if present, throws a typed error if not. The error should be catchable by route handlers and convertible to a 401 response.
    • What this accomplishes: One line at the top of any protected route handler enforces authentication. This is the helper every other ticket is waiting for.
  • Implement requireAdmin() in the same file. Calls requireUser(), then throws if the email doesn't end with @hackbeanpot.com. Converts to a 403 response in route handlers.
    • What this accomplishes: Same pattern for admin-only routes. Domain-based admin check keeps the rule dead simple.
  • Wire requireUser() into src/app/api/v1/user/route.ts (currently probably returns mock or unguarded data).
    • What this accomplishes: The endpoint the frontend uses to fetch the current user now actually returns real session data and correctly 401s when unauthed.

Session lifecycle

  • Confirm the logout flow (already shipped) actually invalidates the session in Mongo, not just the client cookie. Check the sessions collection after a logout to confirm the row is deleted.
    • What this accomplishes: Prevents the security bug where a "logged out" user's session token, if intercepted, would still be valid. Session invalidation on the server matters.
  • Confirm sessions have a reasonable expiration (e.g., 30 days). Set via NextAuth config session.maxAge if not already set.
    • What this accomplishes: Long-lived sessions mean users don't have to sign in every visit, but not so long that a stolen cookie is a lifetime problem.

Error page

  • src/app/auth/error/page.tsx reads the error query param and displays a specific message for each NextAuth error code (Verification = expired/reused link, EmailSignin = SMTP failure, AccessDenied = admin-only route, etc.). Include a "back to sign-in" link.
    • What this accomplishes: Users who hit an error (expired link, bad SMTP, etc.) see something useful instead of a cryptic code. Reduces support burden during application season.

Documentation

  • Add comments to getSession, requireUser, requireAdmin documenting return types, exceptions thrown, and one-line usage examples.
    • What this accomplishes: Every other ticket owner about to wire these in doesn't need to read the source or ping you to understand how they work.

Definition of done

  • getSession(), requireUser(), and requireAdmin() are exported and usable by any ticket.
  • The /api/v1/user endpoint uses requireUser() and returns the real session user.
  • Logout invalidates the session server-side (verified by checking the sessions collection).
  • The error page shows friendly messages for each error code.
  • Helpers are documented with comments.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

Feature

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
     blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Auth — session helpers + error page · Issue #498 · HackBeanpot/core · GitHub
    Skip to content
    Auth — session helpers + error page #498
    Open
    Feature
    Open
    Auth — session helpers + error page#498
    Feature
    Assignees
    mzhang0213
    Description
    @adityapat24
    adityapat24
    opened on Jul 16, 2026
    Context
    Last sprint shipped auth routing, admin/user redirects, logout, and magic-link email delivery. What's left is the reusable session helpers every other endpoint needs, plus the friendly error page.
    Tasks
    Session helpers
    •  Implement getSession() in src/lib/auth/session.ts that returns the typed Session (email, isAdmin) or null. Use NextAuth's getServerSession under the hood.

      • What this accomplishes: Any server component or route handler can call one function to know who's signed in. Encapsulates the NextAuth API so if it changes, only one file needs updating.
    •  Implement requireUser() in src/lib/auth/guards.ts. Calls getSession(), returns the user if present, throws a typed error if not. The error should be catchable by route handlers and convertible to a 401 response.

      • What this accomplishes: One line at the top of any protected route handler enforces authentication. This is the helper every other ticket is waiting for.
    •  Implement requireAdmin() in the same file. Calls requireUser(), then throws if the email doesn't end with @hackbeanpot.com. Converts to a 403 response in route handlers.

      • What this accomplishes: Same pattern for admin-only routes. Domain-based admin check keeps the rule dead simple.
    •  Wire requireUser() into src/app/api/v1/user/route.ts (currently probably returns mock or unguarded data).

      • What this accomplishes: The endpoint the frontend uses to fetch the current user now actually returns real session data and correctly 401s when unauthed.
    Session lifecycle
    •  Confirm the logout flow (already shipped) actually invalidates the session in Mongo, not just the client cookie. Check the sessions collection after a logout to confirm the row is deleted.

      • What this accomplishes: Prevents the security bug where a "logged out" user's session token, if intercepted, would still be valid. Session invalidation on the server matters.
    •  Confirm sessions have a reasonable expiration (e.g., 30 days). Set via NextAuth config session.maxAge if not already set.

      • What this accomplishes: Long-lived sessions mean users don't have to sign in every visit, but not so long that a stolen cookie is a lifetime problem.
    Error page
    • src/app/auth/error/page.tsx reads the error query param and displays a specific message for each NextAuth error code (Verification = expired/reused link, EmailSignin = SMTP failure, AccessDenied = admin-only route, etc.). Include a "back to sign-in" link.

      • What this accomplishes: Users who hit an error (expired link, bad SMTP, etc.) see something useful instead of a cryptic code. Reduces support burden during application season.
    Documentation
    •  Add comments to getSession, requireUser, requireAdmin documenting return types, exceptions thrown, and one-line usage examples.

      • What this accomplishes: Every other ticket owner about to wire these in doesn't need to read the source or ping you to understand how they work.
    Definition of done
    • getSession(), requireUser(), and requireAdmin() are exported and usable by any ticket.
    •  The /api/v1/user endpoint uses requireUser() and returns the real session user.
    •  Logout invalidates the session server-side (verified by checking the sessions collection).
    •  The error page shows friendly messages for each error code.
    •  Helpers are documented with comments.
    Metadata
    Metadata
    Assignees
    Labels
    No labels
    No labels
    Type
    Feature
    Projects
    No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions
      
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Auth — session helpers + error page · Issue #498 · HackBeanpot/core · GitHub
      Skip to content
      Auth — session helpers + error page #498
      Open
      Feature
      Open
      Auth — session helpers + error page#498
      Feature
      Assignees
      mzhang0213
      Description
      @adityapat24
      adityapat24
      opened on Jul 16, 2026
      Context
      Last sprint shipped auth routing, admin/user redirects, logout, and magic-link email delivery. What's left is the reusable session helpers every other endpoint needs, plus the friendly error page.
      Tasks
      Session helpers
      •  Implement getSession() in src/lib/auth/session.ts that returns the typed Session (email, isAdmin) or null. Use NextAuth's getServerSession under the hood.

        • What this accomplishes: Any server component or route handler can call one function to know who's signed in. Encapsulates the NextAuth API so if it changes, only one file needs updating.
      •  Implement requireUser() in src/lib/auth/guards.ts. Calls getSession(), returns the user if present, throws a typed error if not. The error should be catchable by route handlers and convertible to a 401 response.

        • What this accomplishes: One line at the top of any protected route handler enforces authentication. This is the helper every other ticket is waiting for.
      •  Implement requireAdmin() in the same file. Calls requireUser(), then throws if the email doesn't end with @hackbeanpot.com. Converts to a 403 response in route handlers.

        • What this accomplishes: Same pattern for admin-only routes. Domain-based admin check keeps the rule dead simple.
      •  Wire requireUser() into src/app/api/v1/user/route.ts (currently probably returns mock or unguarded data).

        • What this accomplishes: The endpoint the frontend uses to fetch the current user now actually returns real session data and correctly 401s when unauthed.
      Session lifecycle
      •  Confirm the logout flow (already shipped) actually invalidates the session in Mongo, not just the client cookie. Check the sessions collection after a logout to confirm the row is deleted.

        • What this accomplishes: Prevents the security bug where a "logged out" user's session token, if intercepted, would still be valid. Session invalidation on the server matters.
      •  Confirm sessions have a reasonable expiration (e.g., 30 days). Set via NextAuth config session.maxAge if not already set.

        • What this accomplishes: Long-lived sessions mean users don't have to sign in every visit, but not so long that a stolen cookie is a lifetime problem.
      Error page
      • src/app/auth/error/page.tsx reads the error query param and displays a specific message for each NextAuth error code (Verification = expired/reused link, EmailSignin = SMTP failure, AccessDenied = admin-only route, etc.). Include a "back to sign-in" link.

        • What this accomplishes: Users who hit an error (expired link, bad SMTP, etc.) see something useful instead of a cryptic code. Reduces support burden during application season.
      Documentation
      •  Add comments to getSession, requireUser, requireAdmin documenting return types, exceptions thrown, and one-line usage examples.

        • What this accomplishes: Every other ticket owner about to wire these in doesn't need to read the source or ping you to understand how they work.
      Definition of done
      • getSession(), requireUser(), and requireAdmin() are exported and usable by any ticket.
      •  The /api/v1/user endpoint uses requireUser() and returns the real session user.
      •  Logout invalidates the session server-side (verified by checking the sessions collection).
      •  The error page shows friendly messages for each error code.
      •  Helpers are documented with comments.
      Metadata
      Metadata
      Assignees
      Labels
      No labels
      No labels
      Type
      Feature
      Projects
      No projects
        Milestone
        No milestone
        Relationships
        None yet
        Development
        No branches or pull requests
        Issue actions
        
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Auth — session helpers + error page · Issue #498 · HackBeanpot/core · GitHub
        Skip to content
        Auth — session helpers + error page #498
        Open
        Feature
        Open
        Auth — session helpers + error page#498
        Feature
        Assignees
        mzhang0213
        Description
        @adityapat24
        adityapat24
        opened on Jul 16, 2026
        Context
        Last sprint shipped auth routing, admin/user redirects, logout, and magic-link email delivery. What's left is the reusable session helpers every other endpoint needs, plus the friendly error page.
        Tasks
        Session helpers
        •  Implement getSession() in src/lib/auth/session.ts that returns the typed Session (email, isAdmin) or null. Use NextAuth's getServerSession under the hood.

          • What this accomplishes: Any server component or route handler can call one function to know who's signed in. Encapsulates the NextAuth API so if it changes, only one file needs updating.
        •  Implement requireUser() in src/lib/auth/guards.ts. Calls getSession(), returns the user if present, throws a typed error if not. The error should be catchable by route handlers and convertible to a 401 response.

          • What this accomplishes: One line at the top of any protected route handler enforces authentication. This is the helper every other ticket is waiting for.
        •  Implement requireAdmin() in the same file. Calls requireUser(), then throws if the email doesn't end with @hackbeanpot.com. Converts to a 403 response in route handlers.

          • What this accomplishes: Same pattern for admin-only routes. Domain-based admin check keeps the rule dead simple.
        •  Wire requireUser() into src/app/api/v1/user/route.ts (currently probably returns mock or unguarded data).

          • What this accomplishes: The endpoint the frontend uses to fetch the current user now actually returns real session data and correctly 401s when unauthed.
        Session lifecycle
        •  Confirm the logout flow (already shipped) actually invalidates the session in Mongo, not just the client cookie. Check the sessions collection after a logout to confirm the row is deleted.

          • What this accomplishes: Prevents the security bug where a "logged out" user's session token, if intercepted, would still be valid. Session invalidation on the server matters.
        •  Confirm sessions have a reasonable expiration (e.g., 30 days). Set via NextAuth config session.maxAge if not already set.

          • What this accomplishes: Long-lived sessions mean users don't have to sign in every visit, but not so long that a stolen cookie is a lifetime problem.
        Error page
        • src/app/auth/error/page.tsx reads the error query param and displays a specific message for each NextAuth error code (Verification = expired/reused link, EmailSignin = SMTP failure, AccessDenied = admin-only route, etc.). Include a "back to sign-in" link.

          • What this accomplishes: Users who hit an error (expired link, bad SMTP, etc.) see something useful instead of a cryptic code. Reduces support burden during application season.
        Documentation
        •  Add comments to getSession, requireUser, requireAdmin documenting return types, exceptions thrown, and one-line usage examples.

          • What this accomplishes: Every other ticket owner about to wire these in doesn't need to read the source or ping you to understand how they work.
        Definition of done
        • getSession(), requireUser(), and requireAdmin() are exported and usable by any ticket.
        •  The /api/v1/user endpoint uses requireUser() and returns the real session user.
        •  Logout invalidates the session server-side (verified by checking the sessions collection).
        •  The error page shows friendly messages for each error code.
        •  Helpers are documented with comments.
        Metadata
        Metadata
        Assignees
        Labels
        No labels
        No labels
        Type
        Feature
        Projects
        No projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
Auth — session helpers + error page · Issue #498 · HackBeanpot/core · GitHub
          Skip to content
          Auth — session helpers + error page #498
          Open
          Feature
          Open
          Auth — session helpers + error page#498
          Feature
          Assignees
          mzhang0213
          Description
          @adityapat24
          adityapat24
          opened on Jul 16, 2026
          Context
          Last sprint shipped auth routing, admin/user redirects, logout, and magic-link email delivery. What's left is the reusable session helpers every other endpoint needs, plus the friendly error page.
          Tasks
          Session helpers
          •  Implement getSession() in src/lib/auth/session.ts that returns the typed Session (email, isAdmin) or null. Use NextAuth's getServerSession under the hood.

            • What this accomplishes: Any server component or route handler can call one function to know who's signed in. Encapsulates the NextAuth API so if it changes, only one file needs updating.
          •  Implement requireUser() in src/lib/auth/guards.ts. Calls getSession(), returns the user if present, throws a typed error if not. The error should be catchable by route handlers and convertible to a 401 response.

            • What this accomplishes: One line at the top of any protected route handler enforces authentication. This is the helper every other ticket is waiting for.
          •  Implement requireAdmin() in the same file. Calls requireUser(), then throws if the email doesn't end with @hackbeanpot.com. Converts to a 403 response in route handlers.

            • What this accomplishes: Same pattern for admin-only routes. Domain-based admin check keeps the rule dead simple.
          •  Wire requireUser() into src/app/api/v1/user/route.ts (currently probably returns mock or unguarded data).

            • What this accomplishes: The endpoint the frontend uses to fetch the current user now actually returns real session data and correctly 401s when unauthed.
          Session lifecycle
          •  Confirm the logout flow (already shipped) actually invalidates the session in Mongo, not just the client cookie. Check the sessions collection after a logout to confirm the row is deleted.

            • What this accomplishes: Prevents the security bug where a "logged out" user's session token, if intercepted, would still be valid. Session invalidation on the server matters.
          •  Confirm sessions have a reasonable expiration (e.g., 30 days). Set via NextAuth config session.maxAge if not already set.

            • What this accomplishes: Long-lived sessions mean users don't have to sign in every visit, but not so long that a stolen cookie is a lifetime problem.
          Error page
          • src/app/auth/error/page.tsx reads the error query param and displays a specific message for each NextAuth error code (Verification = expired/reused link, EmailSignin = SMTP failure, AccessDenied = admin-only route, etc.). Include a "back to sign-in" link.

            • What this accomplishes: Users who hit an error (expired link, bad SMTP, etc.) see something useful instead of a cryptic code. Reduces support burden during application season.
          Documentation
          •  Add comments to getSession, requireUser, requireAdmin documenting return types, exceptions thrown, and one-line usage examples.

            • What this accomplishes: Every other ticket owner about to wire these in doesn't need to read the source or ping you to understand how they work.
          Definition of done
          • getSession(), requireUser(), and requireAdmin() are exported and usable by any ticket.
          •  The /api/v1/user endpoint uses requireUser() and returns the real session user.
          •  Logout invalidates the session server-side (verified by checking the sessions collection).
          •  The error page shows friendly messages for each error code.
          •  Helpers are documented with comments.
          Metadata
          Metadata
          Assignees
          Labels
          No labels
          No labels
          Type
          Feature
          Projects
          No projects
            Milestone
            No milestone
            Relationships
            None yet
            Development
            No branches or pull requests
            Issue actions
            
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Auth — session helpers + error page · Issue #498 · HackBeanpot/core · GitHub
            Skip to content
            Auth — session helpers + error page #498
            Open
            Feature
            Open
            Auth — session helpers + error page#498
            Feature
            Assignees
            mzhang0213
            Description
            @adityapat24
            adityapat24
            opened on Jul 16, 2026
            Context
            Last sprint shipped auth routing, admin/user redirects, logout, and magic-link email delivery. What's left is the reusable session helpers every other endpoint needs, plus the friendly error page.
            Tasks
            Session helpers
            •  Implement getSession() in src/lib/auth/session.ts that returns the typed Session (email, isAdmin) or null. Use NextAuth's getServerSession under the hood.

              • What this accomplishes: Any server component or route handler can call one function to know who's signed in. Encapsulates the NextAuth API so if it changes, only one file needs updating.
            •  Implement requireUser() in src/lib/auth/guards.ts. Calls getSession(), returns the user if present, throws a typed error if not. The error should be catchable by route handlers and convertible to a 401 response.

              • What this accomplishes: One line at the top of any protected route handler enforces authentication. This is the helper every other ticket is waiting for.
            •  Implement requireAdmin() in the same file. Calls requireUser(), then throws if the email doesn't end with @hackbeanpot.com. Converts to a 403 response in route handlers.

              • What this accomplishes: Same pattern for admin-only routes. Domain-based admin check keeps the rule dead simple.
            •  Wire requireUser() into src/app/api/v1/user/route.ts (currently probably returns mock or unguarded data).

              • What this accomplishes: The endpoint the frontend uses to fetch the current user now actually returns real session data and correctly 401s when unauthed.
            Session lifecycle
            •  Confirm the logout flow (already shipped) actually invalidates the session in Mongo, not just the client cookie. Check the sessions collection after a logout to confirm the row is deleted.

              • What this accomplishes: Prevents the security bug where a "logged out" user's session token, if intercepted, would still be valid. Session invalidation on the server matters.
            •  Confirm sessions have a reasonable expiration (e.g., 30 days). Set via NextAuth config session.maxAge if not already set.

              • What this accomplishes: Long-lived sessions mean users don't have to sign in every visit, but not so long that a stolen cookie is a lifetime problem.
            Error page
            • src/app/auth/error/page.tsx reads the error query param and displays a specific message for each NextAuth error code (Verification = expired/reused link, EmailSignin = SMTP failure, AccessDenied = admin-only route, etc.). Include a "back to sign-in" link.

              • What this accomplishes: Users who hit an error (expired link, bad SMTP, etc.) see something useful instead of a cryptic code. Reduces support burden during application season.
            Documentation
            •  Add comments to getSession, requireUser, requireAdmin documenting return types, exceptions thrown, and one-line usage examples.

              • What this accomplishes: Every other ticket owner about to wire these in doesn't need to read the source or ping you to understand how they work.
            Definition of done
            • getSession(), requireUser(), and requireAdmin() are exported and usable by any ticket.
            •  The /api/v1/user endpoint uses requireUser() and returns the real session user.
            •  Logout invalidates the session server-side (verified by checking the sessions collection).
            •  The error page shows friendly messages for each error code.
            •  Helpers are documented with comments.
            Metadata
            Metadata
            Assignees
            Labels
            No labels
            No labels
            Type
            Feature
            Projects
            No projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Auth — session helpers + error page · Issue #498 · HackBeanpot/core · GitHub
              Skip to content
              Auth — session helpers + error page #498
              Open
              Feature
              Open
              Auth — session helpers + error page#498
              Feature
              Assignees
              mzhang0213
              Description
              @adityapat24
              adityapat24
              opened on Jul 16, 2026
              Context
              Last sprint shipped auth routing, admin/user redirects, logout, and magic-link email delivery. What's left is the reusable session helpers every other endpoint needs, plus the friendly error page.
              Tasks
              Session helpers
              •  Implement getSession() in src/lib/auth/session.ts that returns the typed Session (email, isAdmin) or null. Use NextAuth's getServerSession under the hood.

                • What this accomplishes: Any server component or route handler can call one function to know who's signed in. Encapsulates the NextAuth API so if it changes, only one file needs updating.
              •  Implement requireUser() in src/lib/auth/guards.ts. Calls getSession(), returns the user if present, throws a typed error if not. The error should be catchable by route handlers and convertible to a 401 response.

                • What this accomplishes: One line at the top of any protected route handler enforces authentication. This is the helper every other ticket is waiting for.
              •  Implement requireAdmin() in the same file. Calls requireUser(), then throws if the email doesn't end with @hackbeanpot.com. Converts to a 403 response in route handlers.

                • What this accomplishes: Same pattern for admin-only routes. Domain-based admin check keeps the rule dead simple.
              •  Wire requireUser() into src/app/api/v1/user/route.ts (currently probably returns mock or unguarded data).

                • What this accomplishes: The endpoint the frontend uses to fetch the current user now actually returns real session data and correctly 401s when unauthed.
              Session lifecycle
              •  Confirm the logout flow (already shipped) actually invalidates the session in Mongo, not just the client cookie. Check the sessions collection after a logout to confirm the row is deleted.

                • What this accomplishes: Prevents the security bug where a "logged out" user's session token, if intercepted, would still be valid. Session invalidation on the server matters.
              •  Confirm sessions have a reasonable expiration (e.g., 30 days). Set via NextAuth config session.maxAge if not already set.

                • What this accomplishes: Long-lived sessions mean users don't have to sign in every visit, but not so long that a stolen cookie is a lifetime problem.
              Error page
              • src/app/auth/error/page.tsx reads the error query param and displays a specific message for each NextAuth error code (Verification = expired/reused link, EmailSignin = SMTP failure, AccessDenied = admin-only route, etc.). Include a "back to sign-in" link.

                • What this accomplishes: Users who hit an error (expired link, bad SMTP, etc.) see something useful instead of a cryptic code. Reduces support burden during application season.
              Documentation
              •  Add comments to getSession, requireUser, requireAdmin documenting return types, exceptions thrown, and one-line usage examples.

                • What this accomplishes: Every other ticket owner about to wire these in doesn't need to read the source or ping you to understand how they work.
              Definition of done
              • getSession(), requireUser(), and requireAdmin() are exported and usable by any ticket.
              •  The /api/v1/user endpoint uses requireUser() and returns the real session user.
              •  Logout invalidates the session server-side (verified by checking the sessions collection).
              •  The error page shows friendly messages for each error code.
              •  Helpers are documented with comments.
              Metadata
              Metadata
              Assignees
              Labels
              No labels
              No labels
              Type
              Feature
              Projects
              No projects
                Milestone
                No milestone
                Relationships
                None yet
                Development
                No branches or pull requests
                Issue actions
                
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
Auth — session helpers + error page · Issue #498 · HackBeanpot/core · GitHub
                Skip to content
                Auth — session helpers + error page #498
                Open
                Feature
                Open
                Auth — session helpers + error page#498
                Feature
                Assignees
                mzhang0213
                Description
                @adityapat24
                adityapat24
                opened on Jul 16, 2026
                Context
                Last sprint shipped auth routing, admin/user redirects, logout, and magic-link email delivery. What's left is the reusable session helpers every other endpoint needs, plus the friendly error page.
                Tasks
                Session helpers
                •  Implement getSession() in src/lib/auth/session.ts that returns the typed Session (email, isAdmin) or null. Use NextAuth's getServerSession under the hood.

                  • What this accomplishes: Any server component or route handler can call one function to know who's signed in. Encapsulates the NextAuth API so if it changes, only one file needs updating.
                •  Implement requireUser() in src/lib/auth/guards.ts. Calls getSession(), returns the user if present, throws a typed error if not. The error should be catchable by route handlers and convertible to a 401 response.

                  • What this accomplishes: One line at the top of any protected route handler enforces authentication. This is the helper every other ticket is waiting for.
                •  Implement requireAdmin() in the same file. Calls requireUser(), then throws if the email doesn't end with @hackbeanpot.com. Converts to a 403 response in route handlers.

                  • What this accomplishes: Same pattern for admin-only routes. Domain-based admin check keeps the rule dead simple.
                •  Wire requireUser() into src/app/api/v1/user/route.ts (currently probably returns mock or unguarded data).

                  • What this accomplishes: The endpoint the frontend uses to fetch the current user now actually returns real session data and correctly 401s when unauthed.
                Session lifecycle
                •  Confirm the logout flow (already shipped) actually invalidates the session in Mongo, not just the client cookie. Check the sessions collection after a logout to confirm the row is deleted.

                  • What this accomplishes: Prevents the security bug where a "logged out" user's session token, if intercepted, would still be valid. Session invalidation on the server matters.
                •  Confirm sessions have a reasonable expiration (e.g., 30 days). Set via NextAuth config session.maxAge if not already set.

                  • What this accomplishes: Long-lived sessions mean users don't have to sign in every visit, but not so long that a stolen cookie is a lifetime problem.
                Error page
                • src/app/auth/error/page.tsx reads the error query param and displays a specific message for each NextAuth error code (Verification = expired/reused link, EmailSignin = SMTP failure, AccessDenied = admin-only route, etc.). Include a "back to sign-in" link.

                  • What this accomplishes: Users who hit an error (expired link, bad SMTP, etc.) see something useful instead of a cryptic code. Reduces support burden during application season.
                Documentation
                •  Add comments to getSession, requireUser, requireAdmin documenting return types, exceptions thrown, and one-line usage examples.

                  • What this accomplishes: Every other ticket owner about to wire these in doesn't need to read the source or ping you to understand how they work.
                Definition of done
                • getSession(), requireUser(), and requireAdmin() are exported and usable by any ticket.
                •  The /api/v1/user endpoint uses requireUser() and returns the real session user.
                •  Logout invalidates the session server-side (verified by checking the sessions collection).
                •  The error page shows friendly messages for each error code.
                •  Helpers are documented with comments.
                Metadata
                Metadata
                Assignees
                Labels
                No labels
                No labels
                Type
                Feature
                Projects
                No projects
                  Milestone
                  No milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions