Conversation
…dling, user profile updates are applied quickly to the relevant client components after the user saves profile changes fix: enhance chatbot UI and functionality with initial messages chore: remove unused login and register forms style: update layout and feedback popup design for better user experience
There was a problem hiding this comment.
Pull request overview
This PR cleans up legacy auth UI code while improving the user-facing UI (chatbot + dashboard profile display) and refining NextAuth/session + profile update behavior so profile edits can propagate into the active session.
Changes:
- Remove legacy login/register form implementations and an old login page artifact.
- Update the ChatBot UI (welcome message, styling, loader, input UX) and small accessibility improvements.
- Improve profile PATCH response handling and add NextAuth JWT callback support for client
session.update(...)flows.
Reviewed changes
Copilot reviewed 9 out of 10 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| package-lock.json | Updates resolved dependency versions (notably Next) and lock metadata. |
| components/dashboard/dashboard-client.tsx | Uses live useSession() data, adds avatar display, and updates profile-save flow to update the session. |
| components/contact/FeedbackPopup.tsx | Switches to local DialogTitle export and restructures dialog content/layout. |
| components/auth/register-form.tsx | Removes legacy register form implementation. |
| components/auth/login-form.tsx | Removes legacy login form implementation. |
| components/ChatBot.jsx | Modernizes chatbot UI and adds initial assistant welcome message + improved loading indicator/input area. |
| app/layout.tsx | Adds a custom data-scroll-behavior attribute to the root <html> element. |
| app/api/user/profile/route.ts | Returns the updated user fields after PATCH instead of the pre-update user object. |
| app/api/auth/[...nextauth]/route.ts | Adjusts JWT/session callbacks to support session updates and refresh admin data; refactors formatting. |
| app/(auth)/login/old.txt | Removes an outdated login page implementation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // Apply client-side session.update(...) payload immediately. | ||
| if (trigger === "update" && session) { | ||
| if (typeof session.name === "string") { | ||
| token.name = session.name; | ||
| } | ||
| if (typeof session.email === "string") { | ||
| token.email = session.email; | ||
| } |
There was a problem hiding this comment.
The jwt callback applies session.update(...) payloads directly to token.email. Since the client controls this payload, a user could potentially spoof session.user.email and any downstream authorization or DB lookups that rely on it. Consider ignoring client-provided email entirely (only allow updating display name), and/or always re-hydrate email from the DB using token.id for both users and admins.
There was a problem hiding this comment.
@copilot open a new pull request to apply changes based on this feedback
| debug: true, | ||
|
|
||
| secret: process.env.NEXTAUTH_SECRET, |
There was a problem hiding this comment.
debug: true in NextAuth can expose verbose internal details in logs and responses. Consider enabling this only in development (e.g., process.env.NODE_ENV === "development") to avoid leaking operational/security-relevant information in production.
There was a problem hiding this comment.
@copilot open a new pull request to apply changes based on this feedback
There was a problem hiding this comment.
@copilot open a new pull request to apply changes based on this feedback
| console.log("LOGIN ATTEMPT:", credentials); | ||
|
|
There was a problem hiding this comment.
The admin credentials authorize callback logs the full credentials object. This will include the plaintext password and can leak sensitive data into server logs. Remove this log line or log only non-sensitive fields (e.g., email + outcome) with appropriate redaction.
There was a problem hiding this comment.
@copilot open a new pull request to apply changes based on this feedback
| <div className="flex items-center gap-2"> | ||
| <input | ||
| type="text" | ||
| placeholder="Ask about vehicles, booking, or features..." | ||
| className="flex-1 bg-input/90 border border-cyan-300/30 rounded-xl px-4 py-3 text-sm text-foreground placeholder:text-muted-foreground focus:outline-none focus:border-cyan-400 focus:ring-2 focus:ring-cyan-400/30 transition-all" | ||
| value={input} | ||
| onChange={(e) => setInput(e.target.value)} | ||
| disabled={loading} | ||
| /> |
There was a problem hiding this comment.
The chat input relies on placeholder text only. For accessibility, add an explicit accessible name (e.g., aria-label or an associated <label>), especially since this is a primary interaction control.
There was a problem hiding this comment.
@copilot open a new pull request to apply changes based on this feedback
| const updatedUser = await prisma.user.update({ | ||
| where: { email: session.user?.email || undefined }, | ||
| data: { |
There was a problem hiding this comment.
This endpoint uses session.user.email as the identifier for findUnique/update. If session fields can be influenced (e.g., via session.update(...)), this increases the risk of cross-user access. Prefer using the immutable session.user.id (already set in the NextAuth session callback) for lookups/updates instead of email.
There was a problem hiding this comment.
@copilot open a new pull request to apply changes based on this feedback
|
@shammy911 I've opened a new pull request, #80, to work on those changes. Once the pull request is ready, I'll request review from you. |
|
@shammy911 I've opened a new pull request, #81, to work on those changes. Once the pull request is ready, I'll request review from you. |
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
- Remove token.email = session.email from session.update() handler; client-controlled email was being written directly to the JWT token, enabling session.user.email spoofing. - Add DB re-hydration of token.email for regular users (userType=user) using token.id, consistent with the existing pattern for admin/advisor. - Add a warning log when the user record is not found during re-hydration. Co-authored-by: shammy911 <180457932+shammy911@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
@shammy911 I've opened a new pull request, #82, to work on those changes. Once the pull request is ready, I'll request review from you. |
|
@shammy911 I've opened a new pull request, #83, to work on those changes. Once the pull request is ready, I'll request review from you. |
…min authorize callback Co-authored-by: shammy911 <180457932+shammy911@users.noreply.github.com>
|
@shammy911 I've opened a new pull request, #84, to work on those changes. Once the pull request is ready, I'll request review from you. |
Co-authored-by: shammy911 <180457932+shammy911@users.noreply.github.com>
Co-authored-by: shammy911 <180457932+shammy911@users.noreply.github.com>
|
@shammy911 I've opened a new pull request, #85, to work on those changes. Once the pull request is ready, I'll request review from you. |
Co-authored-by: shammy911 <180457932+shammy911@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Fix: JWT callback allows client-controlled email spoofing via session.update()
Remove plaintext password leak from admin auth log
Restrict NextAuth debug mode to development environment
fix(a11y): add aria-label to ChatBot input
Use session.user.id instead of email for profile lookups
This pull request primarily removes unused or outdated authentication-related files and introduces several UI and backend improvements. The largest changes include the deletion of legacy login forms, UI/UX enhancements to the chatbot component, and improvements to authentication/session handling and user profile updates.
Authentication cleanup:
app/(auth)/login/old.txtandcomponents/auth/login-form.tsxto eliminate redundant or outdated authentication code. [1] [2]ChatBot UI/UX improvements:
ChatBotcomponent with a new welcome message, modernized styling, improved message bubbles, a new loading indicator, and accessibility improvements (e.g., ARIA labels). [1] [2]Authentication/session logic improvements:
app/api/auth/[...nextauth]/route.tsto handle session updates from the client, always fetch the latest user role from the database, and ensure token fields are updated correctly. (app/api/auth/[...nextauth]/route.tsL135-R137, app/api/auth/[...nextauth]/route.tsR148-R157)User profile update response:
app/api/user/profile/route.tsto return the updated user data (with selected fields) after a profile update, instead of the old user data.Global UI improvement:
data-scroll-behavior="smooth"to the root HTML element inapp/layout.tsx.