Adds the Microsoft Entra ID provider to NextAuth alongside the existing credentials provider. Sign-in is restricted to Pelagia Marine's M365 tenant via the issuer URL; access is further gated by requiring a matching active user record in the DB (DB-managed roles remain unchanged). - auth.ts: add MicrosoftEntra provider, signIn callback (DB lookup), async jwt callback to populate id/role on first SSO sign-in - login-form.tsx: add primary "Sign in with Microsoft 365" button with Microsoft logo; credentials form kept as a fallback below a divider - prisma: make passwordHash nullable (migration applied) to allow SSO-only users without a local password - admin/users: password is now optional when creating a user — leave blank for SSO-only accounts - profile/actions: return a clear error if an SSO user (no passwordHash) attempts to use the change-password form - .env.example: document AZURE_AD_CLIENT_ID/SECRET/TENANT_ID Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
129 lines
4.4 KiB
TypeScript
129 lines
4.4 KiB
TypeScript
"use client";
|
|
|
|
import { useState } from "react";
|
|
import { signIn } from "next-auth/react";
|
|
import { useRouter, useSearchParams } from "next/navigation";
|
|
|
|
export function LoginForm() {
|
|
const [email, setEmail] = useState("");
|
|
const [password, setPassword] = useState("");
|
|
const [error, setError] = useState("");
|
|
const [loading, setLoading] = useState(false);
|
|
const [ssoLoading, setSsoLoading] = useState(false);
|
|
const router = useRouter();
|
|
const searchParams = useSearchParams();
|
|
const callbackUrl = searchParams.get("callbackUrl") ?? "/dashboard";
|
|
|
|
async function handleSso() {
|
|
setSsoLoading(true);
|
|
await signIn("microsoft-entra-id", { callbackUrl });
|
|
}
|
|
|
|
async function handleSubmit(e: React.FormEvent) {
|
|
e.preventDefault();
|
|
setLoading(true);
|
|
setError("");
|
|
|
|
const result = await signIn("credentials", {
|
|
email,
|
|
password,
|
|
redirect: false,
|
|
});
|
|
|
|
if (result?.error) {
|
|
setError("Invalid email or password. Please try again.");
|
|
setLoading(false);
|
|
} else {
|
|
router.push(callbackUrl);
|
|
router.refresh();
|
|
}
|
|
}
|
|
|
|
return (
|
|
<div className="space-y-5">
|
|
<button
|
|
type="button"
|
|
onClick={handleSso}
|
|
disabled={ssoLoading || loading}
|
|
className="w-full flex items-center justify-center gap-3 rounded-lg border border-neutral-300 bg-white px-4 py-2.5 text-sm font-medium text-neutral-700 hover:bg-neutral-50 focus:outline-none focus:ring-2 focus:ring-primary-500 focus:ring-offset-2 disabled:opacity-60 disabled:cursor-not-allowed transition-colors"
|
|
>
|
|
<MicrosoftLogo />
|
|
{ssoLoading ? "Redirecting…" : "Sign in with Microsoft 365"}
|
|
</button>
|
|
|
|
<div className="relative">
|
|
<div className="absolute inset-0 flex items-center">
|
|
<div className="w-full border-t border-neutral-200" />
|
|
</div>
|
|
<div className="relative flex justify-center text-xs">
|
|
<span className="bg-white px-3 text-neutral-400">or sign in with password</span>
|
|
</div>
|
|
</div>
|
|
|
|
<form onSubmit={handleSubmit} className="space-y-4">
|
|
<div>
|
|
<label
|
|
htmlFor="email"
|
|
className="block text-sm font-medium text-neutral-700 mb-1.5"
|
|
>
|
|
Email address
|
|
</label>
|
|
<input
|
|
id="email"
|
|
type="email"
|
|
autoComplete="email"
|
|
required
|
|
value={email}
|
|
onChange={(e) => setEmail(e.target.value)}
|
|
className="w-full rounded-lg border border-neutral-300 px-3 py-2.5 text-sm text-neutral-900 placeholder:text-neutral-400 focus:border-primary-500 focus:outline-none focus:ring-2 focus:ring-primary-500/20"
|
|
placeholder="you@pelagiamarine.com"
|
|
/>
|
|
</div>
|
|
|
|
<div>
|
|
<label
|
|
htmlFor="password"
|
|
className="block text-sm font-medium text-neutral-700 mb-1.5"
|
|
>
|
|
Password
|
|
</label>
|
|
<input
|
|
id="password"
|
|
type="password"
|
|
autoComplete="current-password"
|
|
required
|
|
value={password}
|
|
onChange={(e) => setPassword(e.target.value)}
|
|
className="w-full rounded-lg border border-neutral-300 px-3 py-2.5 text-sm text-neutral-900 placeholder:text-neutral-400 focus:border-primary-500 focus:outline-none focus:ring-2 focus:ring-primary-500/20"
|
|
placeholder="••••••••"
|
|
/>
|
|
</div>
|
|
|
|
{error && (
|
|
<p className="text-sm text-danger-700 bg-danger-50 rounded-lg px-3 py-2">
|
|
{error}
|
|
</p>
|
|
)}
|
|
|
|
<button
|
|
type="submit"
|
|
disabled={loading || ssoLoading}
|
|
className="w-full rounded-lg bg-primary-600 px-4 py-2.5 text-sm font-semibold text-white hover:bg-primary-700 focus:outline-none focus:ring-2 focus:ring-primary-500 focus:ring-offset-2 disabled:opacity-60 disabled:cursor-not-allowed transition-colors"
|
|
>
|
|
{loading ? "Signing in…" : "Sign in"}
|
|
</button>
|
|
</form>
|
|
</div>
|
|
);
|
|
}
|
|
|
|
function MicrosoftLogo() {
|
|
return (
|
|
<svg width="18" height="18" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">
|
|
<rect x="1" y="1" width="9" height="9" fill="#F25022" />
|
|
<rect x="11" y="1" width="9" height="9" fill="#7FBA00" />
|
|
<rect x="1" y="11" width="9" height="9" fill="#00A4EF" />
|
|
<rect x="11" y="11" width="9" height="9" fill="#FFB900" />
|
|
</svg>
|
|
);
|
|
}
|