NUTRITION TODAY
+ {nutrition.seedSwitchAlert && (
+
+ {nutrition.seedSwitchAlert}
+
+ )}
- 🌱 {nutrition.seeds}
- 🍽️ Carbs: {nutrition.carbRange}
diff --git a/src/lib/auth-middleware.test.ts b/src/lib/auth-middleware.test.ts
index 74ac96c..74189b8 100644
--- a/src/lib/auth-middleware.test.ts
+++ b/src/lib/auth-middleware.test.ts
@@ -79,6 +79,16 @@ describe("withAuth", () => {
get: vi.fn(),
};
+ // Helper to create mock request with headers
+ const createMockRequest = (
+ headers: Record = {},
+ ): NextRequest =>
+ ({
+ headers: {
+ get: vi.fn((name: string) => headers[name] ?? null),
+ },
+ }) as unknown as NextRequest;
+
beforeEach(() => {
vi.clearAllMocks();
mockCookies.mockResolvedValue(mockCookieStore);
@@ -91,7 +101,7 @@ describe("withAuth", () => {
const handler = vi.fn();
const wrappedHandler = withAuth(handler);
- const mockRequest = {} as NextRequest;
+ const mockRequest = createMockRequest();
const response = await wrappedHandler(mockRequest);
expect(response.status).toBe(401);
@@ -109,7 +119,7 @@ describe("withAuth", () => {
.mockResolvedValue(NextResponse.json({ data: "success" }));
const wrappedHandler = withAuth(handler);
- const mockRequest = {} as NextRequest;
+ const mockRequest = createMockRequest();
const response = await wrappedHandler(mockRequest);
expect(response.status).toBe(200);
@@ -128,7 +138,7 @@ describe("withAuth", () => {
const handler = vi.fn().mockResolvedValue(NextResponse.json({}));
const wrappedHandler = withAuth(handler);
- await wrappedHandler({} as NextRequest);
+ await wrappedHandler(createMockRequest());
expect(mockCreatePocketBaseClient).toHaveBeenCalled();
expect(mockCookies).toHaveBeenCalled();
@@ -146,7 +156,7 @@ describe("withAuth", () => {
const handler = vi.fn();
const wrappedHandler = withAuth(handler);
- const response = await wrappedHandler({} as NextRequest);
+ const response = await wrappedHandler(createMockRequest());
expect(response.status).toBe(401);
expect(handler).not.toHaveBeenCalled();
@@ -159,7 +169,7 @@ describe("withAuth", () => {
const handler = vi.fn().mockResolvedValue(NextResponse.json({}));
const wrappedHandler = withAuth(handler);
- const mockRequest = {} as NextRequest;
+ const mockRequest = createMockRequest();
const mockParams = { id: "123" };
await wrappedHandler(mockRequest, { params: mockParams });
@@ -176,7 +186,7 @@ describe("withAuth", () => {
const handler = vi.fn().mockRejectedValue(new Error("Handler error"));
const wrappedHandler = withAuth(handler);
- const response = await wrappedHandler({} as NextRequest);
+ const response = await wrappedHandler(createMockRequest());
expect(response.status).toBe(500);
const body = await response.json();
@@ -196,7 +206,7 @@ describe("withAuth", () => {
const handler = vi.fn();
const wrappedHandler = withAuth(handler);
- await wrappedHandler({} as NextRequest);
+ await wrappedHandler(createMockRequest());
expect(mockLogger.warn).toHaveBeenCalledWith(
expect.objectContaining({ reason: "not_authenticated" }),
@@ -204,6 +214,76 @@ describe("withAuth", () => {
);
});
+ it("logs auth failure with IP address from x-forwarded-for header", async () => {
+ mockIsAuthenticated.mockReturnValue(false);
+
+ const handler = vi.fn();
+ const wrappedHandler = withAuth(handler);
+
+ const mockRequest = {
+ headers: {
+ get: vi.fn((name: string) =>
+ name === "x-forwarded-for" ? "192.168.1.100" : null,
+ ),
+ },
+ } as unknown as NextRequest;
+
+ await wrappedHandler(mockRequest);
+
+ expect(mockLogger.warn).toHaveBeenCalledWith(
+ expect.objectContaining({
+ reason: "not_authenticated",
+ ip: "192.168.1.100",
+ }),
+ expect.stringContaining("Auth failure"),
+ );
+ });
+
+ it("logs auth failure with IP address from x-real-ip header when x-forwarded-for not present", async () => {
+ mockIsAuthenticated.mockReturnValue(false);
+
+ const handler = vi.fn();
+ const wrappedHandler = withAuth(handler);
+
+ const mockRequest = {
+ headers: {
+ get: vi.fn((name: string) =>
+ name === "x-real-ip" ? "10.0.0.1" : null,
+ ),
+ },
+ } as unknown as NextRequest;
+
+ await wrappedHandler(mockRequest);
+
+ expect(mockLogger.warn).toHaveBeenCalledWith(
+ expect.objectContaining({
+ reason: "not_authenticated",
+ ip: "10.0.0.1",
+ }),
+ expect.stringContaining("Auth failure"),
+ );
+ });
+
+ it("logs auth failure with unknown IP when no IP headers present", async () => {
+ mockIsAuthenticated.mockReturnValue(false);
+
+ const handler = vi.fn();
+ const wrappedHandler = withAuth(handler);
+
+ const mockRequest = {
+ headers: {
+ get: vi.fn(() => null),
+ },
+ } as unknown as NextRequest;
+
+ await wrappedHandler(mockRequest);
+
+ expect(mockLogger.warn).toHaveBeenCalledWith(
+ expect.objectContaining({ reason: "not_authenticated", ip: "unknown" }),
+ expect.stringContaining("Auth failure"),
+ );
+ });
+
it("logs auth failure when getCurrentUser returns null", async () => {
mockIsAuthenticated.mockReturnValue(true);
mockGetCurrentUser.mockReturnValue(null);
@@ -211,7 +291,7 @@ describe("withAuth", () => {
const handler = vi.fn();
const wrappedHandler = withAuth(handler);
- await wrappedHandler({} as NextRequest);
+ await wrappedHandler(createMockRequest());
expect(mockLogger.warn).toHaveBeenCalledWith(
expect.objectContaining({ reason: "user_not_found" }),
@@ -227,7 +307,7 @@ describe("withAuth", () => {
const handler = vi.fn().mockRejectedValue(testError);
const wrappedHandler = withAuth(handler);
- await wrappedHandler({} as NextRequest);
+ await wrappedHandler(createMockRequest());
expect(mockLogger.error).toHaveBeenCalledWith(
expect.objectContaining({
diff --git a/src/lib/auth-middleware.ts b/src/lib/auth-middleware.ts
index 6f9c305..e4a9aff 100644
--- a/src/lib/auth-middleware.ts
+++ b/src/lib/auth-middleware.ts
@@ -42,6 +42,23 @@ export type AuthenticatedHandler = (
* });
* ```
*/
+/**
+ * Extracts client IP address from request headers.
+ * Checks x-forwarded-for and x-real-ip headers, returns "unknown" if neither present.
+ */
+function getClientIp(request: NextRequest): string {
+ const forwardedFor = request.headers.get("x-forwarded-for");
+ if (forwardedFor) {
+ // x-forwarded-for can contain multiple IPs; first one is the client
+ return forwardedFor.split(",")[0].trim();
+ }
+ const realIp = request.headers.get("x-real-ip");
+ if (realIp) {
+ return realIp;
+ }
+ return "unknown";
+}
+
export function withAuth(
handler: AuthenticatedHandler,
): (request: NextRequest, context?: { params?: T }) => Promise {
@@ -57,16 +74,19 @@ export function withAuth(
const cookieStore = await cookies();
loadAuthFromCookies(pb, cookieStore);
+ // Get client IP for logging
+ const ip = getClientIp(request);
+
// Check if the user is authenticated
if (!isAuthenticated(pb)) {
- logger.warn({ reason: "not_authenticated" }, "Auth failure");
+ logger.warn({ reason: "not_authenticated", ip }, "Auth failure");
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
}
// Get the current user
const user = getCurrentUser(pb);
if (!user) {
- logger.warn({ reason: "user_not_found" }, "Auth failure");
+ logger.warn({ reason: "user_not_found", ip }, "Auth failure");
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
}
diff --git a/src/types/index.ts b/src/types/index.ts
index f880fc7..d0c60d7 100644
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -101,4 +101,5 @@ export interface NutritionGuidance {
seeds: string;
carbRange: string;
ketoGuidance: string;
+ seedSwitchAlert?: string | null;
}