feat: add password change functionality and dependencies

src/app/api/auth/login/route.js

@@ -0,0 +1,47 @@
+import { NextResponse } from "next/server";
+import { getSettings, updateSettings } from "@/lib/localDb";
+import bcrypt from "bcryptjs";
+import { SignJWT } from "jose";
+import { cookies } from "next/headers";
+
+const SECRET = new TextEncoder().encode(
+  process.env.JWT_SECRET || "9router-default-secret-change-me"
+);
+
+export async function POST(request) {
+  try {
+    const { password } = await request.json();
+    const settings = await getSettings();
+
+    // Default password is '123456' if not set
+    const storedHash = settings.password;
+
+    let isValid = false;
+    if (!storedHash) {
+      isValid = password === "123456";
+    } else {
+      isValid = await bcrypt.compare(password, storedHash);
+    }
+
+    if (isValid) {
+      const token = await new SignJWT({ authenticated: true })
+        .setProtectedHeader({ alg: "HS256" })
+        .setExpirationTime("24h")
+        .sign(SECRET);
+
+      const cookieStore = await cookies();
+      cookieStore.set("auth_token", token, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === "production",
+        sameSite: "lax",
+        path: "/",
+      });
+
+      return NextResponse.json({ success: true });
+    }
+
+    return NextResponse.json({ error: "Invalid password" }, { status: 401 });
+  } catch (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+}

src/app/api/auth/logout/route.js

@@ -0,0 +1,8 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+
+export async function POST() {
+  const cookieStore = await cookies();
+  cookieStore.delete("auth_token");
+  return NextResponse.json({ success: true });
+}

src/app/api/settings/route.js

@@ -1,10 +1,13 @@
 import { NextResponse } from "next/server";
 import { getSettings, updateSettings } from "@/lib/localDb";
+import bcrypt from "bcryptjs";
 
 export async function GET() {
   try {
     const settings = await getSettings();
-    return NextResponse.json(settings);
+    // Don't return the password hash to the client
+    const { password, ...safeSettings } = settings;
+    return NextResponse.json(safeSettings);
   } catch (error) {
     console.log("Error getting settings:", error);
     return NextResponse.json({ error: error.message }, { status: 500 });
@@ -14,8 +17,37 @@ export async function GET() {
 export async function PATCH(request) {
   try {
     const body = await request.json();
+
+    // If updating password, hash it
+    if (body.newPassword) {
+      const settings = await getSettings();
+      const currentHash = settings.password;
+
+      // Verify current password if it exists
+      if (currentHash) {
+        if (!body.currentPassword) {
+          return NextResponse.json({ error: "Current password required" }, { status: 400 });
+        }
+        const isValid = await bcrypt.compare(body.currentPassword, currentHash);
+        if (!isValid) {
+          return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
+        }
+      } else {
+        // First time setting password, check if it matches default 123456
+        if (body.currentPassword !== "123456") {
+           return NextResponse.json({ error: "Invalid current password" }, { status: 401 });
+        }
+      }
+
+      const salt = await bcrypt.genSalt(10);
+      body.password = await bcrypt.hash(body.newPassword, salt);
+      delete body.newPassword;
+      delete body.currentPassword;
+    }
+
     const settings = await updateSettings(body);
-    return NextResponse.json(settings);
+    const { password, ...safeSettings } = settings;
+    return NextResponse.json(safeSettings);
   } catch (error) {
     console.log("Error updating settings:", error);
     return NextResponse.json({ error: error.message }, { status: 500 });