Authentication

# Comma-separated (recommended)
ADMIN_WALLETS="0x123...,0x456..."

# JSON array
ADMIN_WALLETS='["0x123...","0x456..."]'

CREATE TABLE users (
  id                     CHAR(26) PRIMARY KEY,
  address                TEXT NOT NULL UNIQUE,          -- Primary wallet address
  username               TEXT,                          -- Optional display name
  email                  TEXT NOT NULL,                 -- Auto-generated or custom
  email_verified         BOOLEAN DEFAULT FALSE,         -- Email verification status
  two_factor_enabled     BOOLEAN DEFAULT FALSE,         -- 2FA status
  image                  TEXT,                          -- Profile image path
  settings               JSONB,                         -- User preferences
  affiliate_code         TEXT,                          -- User's referral code
  referred_by_user_id    CHAR(26),                      -- Referrer user ID
  created_at             TIMESTAMPTZ DEFAULT NOW(),
  updated_at             TIMESTAMPTZ DEFAULT NOW()
);

CREATE TABLE wallets (
  id          CHAR(26) PRIMARY KEY,
  user_id     CHAR(26) NOT NULL REFERENCES users(id),
  address     TEXT NOT NULL,                    -- Wallet address
  chain_id    INTEGER NOT NULL,                 -- Network chain ID
  is_primary  BOOLEAN DEFAULT FALSE,            -- Primary wallet flag
  created_at  TIMESTAMPTZ NOT NULL
);

CREATE TABLE sessions (
  id         CHAR(26) PRIMARY KEY,
  user_id    CHAR(26) NOT NULL REFERENCES users(id),
  token      TEXT NOT NULL UNIQUE,              -- Session token
  expires_at TIMESTAMPTZ NOT NULL,              -- Expiration time
  ip_address TEXT,                              -- Client IP
  user_agent TEXT,                              -- Browser info
  created_at TIMESTAMPTZ DEFAULT NOW(),
  updated_at TIMESTAMPTZ DEFAULT NOW()
);

CREATE TABLE two_factors (
  id           CHAR(26) PRIMARY KEY,
  user_id      CHAR(26) NOT NULL REFERENCES users(id),
  secret       TEXT NOT NULL,                   -- TOTP secret
  backup_codes TEXT NOT NULL,                   -- JSON array of codes
);

// 1. User clicks "Connect Wallet"
<w3m-button />

// 2. AppKit shows wallet options
// User selects wallet and approves connection

// 3. Backend generates SIWE message
const message = generateSiweMessage({
  domain: SIWE_DOMAIN,
  address: walletAddress,
  statement: 'Sign in to Kuest Prediction Market',
  nonce: randomNonce,
})

// 4. User signs message in wallet
const signature = await walletClient.signMessage({ message })

// 5. Backend verifies signature
const isValid = await publicClient.verifyMessage({
  message,
  signature,
  address,
})

// 6. Create session
if (isValid) {
  const session = await auth.api.createSession({ userId })
}

// 1-5. Same as standard flow

// 6. Check if 2FA is enabled
if (user.two_factor_enabled) {
  // Delete the session
  await deleteSession(sessionToken)
  
  // Store temporary verification token
  await createVerificationValue({
    identifier: '2fa-' + randomId,
    value: userId,
    expiresAt: Date.now() + 3 * 60 * 1000, // 3 minutes
  })
  
  // Redirect to 2FA page
  return { twoFactorRedirect: true }
}

// 7. User enters TOTP code
const isValidTotp = verifyTotp(code, secret)

// 8. Create session after successful 2FA
if (isValidTotp) {
  await createSession({ userId })
  
  // Optionally set trusted device cookie
  if (trustDevice) {
    setTrustedDeviceCookie(userId, sessionToken)
  }
}

// Set cookie with HMAC signature
const token = await createHMAC().sign(
  secret,
  `${userId}!${sessionToken}`
)

setCookie('trust_device', `${token}!${sessionToken}`, {
  maxAge: 720 * 60 * 60, // 30 days
  httpOnly: true,
  secure: true,
  sameSite: 'lax',
})

// On next login, verify cookie
const [token, sessionToken] = cookie.split('!')
const expected = await createHMAC().sign(secret, `${userId}!${sessionToken}`)

if (token === expected) {
  // Skip 2FA for this device
}

// When user clicks referral link
// Cookie is set: platform_affiliate={affiliateCode: "ABC123", timestamp: Date.now()}

// On user creation
databaseHooks: {
  user: {
    create: {
      async after(user, ctx) {
        const referral = parseAffiliateCookie(ctx.getCookie('platform_affiliate'))
        
        if (referral?.affiliateCode) {
          // Look up affiliate
          const affiliate = await getAffiliateByCode(referral.affiliateCode)
          
          // Record referral
          await recordReferral({
            user_id: user.id,
            affiliate_user_id: affiliate.id,
          })
          
          // Clear cookie
          ctx.setCookie('platform_affiliate', '', { maxAge: 0 })
        }
      },
    },
  },
}

import { auth } from '@/lib/auth'
import { headers } from 'next/headers'

export default async function Page() {
  const session = await auth.api.getSession({
    headers: await headers(),
  })
  
  if (!session) {
    return <div>Please sign in</div>
  }
  
  return <div>Welcome {session.user.address}</div>
}

'use client'

import { useSession } from '@/hooks/use-session'

export function ProfileButton() {
  const { data: session, isPending } = useSession()
  
  if (isPending) {
    return <Skeleton />
  }
  
  if (!session) {
    return <w3m-button />
  }
  
  return <UserMenu user={session.user} />
}