fix login and some errors while login

apps/dashboard/next.config.js

@@ -1,27 +1,6 @@
 /** @type {import('next').NextConfig} */
 
-const securityHeaders = [
-  { key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' },
-  { key: 'X-Content-Type-Options', value: 'nosniff' },
-  { key: 'X-Frame-Options', value: 'DENY' },
-  { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
-  { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
-  {
-    key: 'Content-Security-Policy',
-    value: [
-      "default-src 'self'",
-      "script-src 'self' 'unsafe-inline'",
-      "style-src 'self' 'unsafe-inline'",
-      "img-src 'self' data: blob: https:",
-      "font-src 'self' data:",
-      "connect-src 'self' https: wss:",
-      "frame-ancestors 'none'",
-      "base-uri 'self'",
-      "form-action 'self'",
-      "object-src 'none'",
-    ].join('; '),
-  },
-]
+const { buildSecurityHeaders, normalizeAssetPrefix } = require('../../config/nextSecurityHeaders')
 const toStoragePattern = (rawUrl) => {
   try {
     const u = new URL(rawUrl.replace(/\/api\/v1\/?$/, ''))
@@ -46,13 +25,16 @@ const storagePatterns = [
   .filter(Boolean)
   .filter((p, i, arr) => arr.findIndex((q) => q.hostname === p.hostname && q.port === p.port) === i)
 
+const DASHBOARD_BASE_PATH = '/dashboard'
+
 // In Docker dev the dashboard app runs on port 3001 while the marketplace proxy
 // is served from port 3000. When DASHBOARD_ASSET_PREFIX is set, Next should emit
 // absolute chunk URLs so /dashboard pages load their own JS/CSS from port 3001.
-const assetPrefix = process.env.DASHBOARD_ASSET_PREFIX || undefined
+const assetPrefix = normalizeAssetPrefix(process.env.DASHBOARD_ASSET_PREFIX, DASHBOARD_BASE_PATH)
+const securityHeaders = buildSecurityHeaders({ assetSources: [assetPrefix] })
 
 const nextConfig = {
-  basePath: '/dashboard',
+  basePath: DASHBOARD_BASE_PATH,
   ...(assetPrefix ? { assetPrefix } : {}),
   images: {
     remotePatterns: [

apps/dashboard/src/app/sign-in/[[...sign-in]]/SignInPageClient.tsx

@@ -218,8 +218,10 @@ function LocalSignInForm({
   const [showPassword, setShowPassword] = useState(false)
   const [loading, setLoading] = useState(false)
   const [error, setError] = useState<string | null>(null)
+  const requestedPortal = searchParams.get('portal')
   const adminNext = searchParams.get('next') || '/dashboard'
   const employeeRedirect = searchParams.get('redirect') || '/dashboard'
+  const preferAdminAuth = requestedPortal === 'admin'
 
   function redirectAdmin(token: string) {
     const hash = new URLSearchParams({ token, next: adminNext }).toString()
@@ -232,54 +234,71 @@ function LocalSignInForm({
     setError(null)
 
     try {
-      const empRes = await fetch(`${API_BASE}/auth/employee/login`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        credentials: 'include',
-        body: JSON.stringify({ email, password }),
-      })
-      const empJson = await empRes.json()
+      const tryAdminLogin = async () => {
+        const adminRes = await fetch(`${API_BASE}/admin/auth/login`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          credentials: 'include',
+          body: JSON.stringify({ email, password }),
+        })
+        const adminJson = await adminRes.json()
 
-      if (empRes.ok && empJson?.data?.employee) {
-        const targetPath = toPublicDashboardPath(employeeRedirect)
-        if (empJson?.data?.employee) {
-          localStorage.setItem(EMPLOYEE_PROFILE_KEY, JSON.stringify(empJson.data.employee))
-          const prefLang = empJson.data.employee?.preferredLanguage
-          if (prefLang === 'en' || prefLang === 'fr' || prefLang === 'ar') {
-            setLanguage(prefLang)
-            document.cookie = `rentaldrivego-language=${prefLang}; path=/; max-age=31536000; samesite=lax`
-          }
+        if (adminRes.ok && adminJson?.data?.admin) {
+          window.location.href = `${adminUrl}/dashboard`
+          return true
         }
-        window.dispatchEvent(new CustomEvent('rentaldrivego:auth-changed'))
-        notifyParent({ type: 'rentaldrivego:employee-login', path: targetPath })
-        // Use a document navigation here so the authenticated dashboard bootstraps
-        // from a fresh request after the token cookie and localStorage are set.
-        window.location.replace(targetPath)
+
+        if (adminRes.status === 401 && adminJson?.error === 'totp_required') {
+          setStep('totp')
+          return true
+        }
+
+        return false
+      }
+
+      const tryEmployeeLogin = async () => {
+        const empRes = await fetch(`${API_BASE}/auth/employee/login`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          credentials: 'include',
+          body: JSON.stringify({ email, password }),
+        })
+        const empJson = await empRes.json()
+
+        if (empRes.ok && empJson?.data?.employee) {
+          const targetPath = toPublicDashboardPath(employeeRedirect)
+          if (empJson?.data?.employee) {
+            localStorage.setItem(EMPLOYEE_PROFILE_KEY, JSON.stringify(empJson.data.employee))
+            const prefLang = empJson.data.employee?.preferredLanguage
+            if (prefLang === 'en' || prefLang === 'fr' || prefLang === 'ar') {
+              setLanguage(prefLang)
+              document.cookie = `rentaldrivego-language=${prefLang}; path=/; max-age=31536000; samesite=lax`
+            }
+          }
+          window.dispatchEvent(new CustomEvent('rentaldrivego:auth-changed'))
+          notifyParent({ type: 'rentaldrivego:employee-login', path: targetPath })
+          // Use a document navigation here so the authenticated dashboard bootstraps
+          // from a fresh request after the token cookie and localStorage are set.
+          window.location.replace(targetPath)
+          return true
+        }
+
+        if (empJson?.error === 'password_not_set') {
+          setError(dict.passwordNotSet)
+          return true
+        }
+
+        return false
+      }
+
+      if (preferAdminAuth) {
+        if (await tryAdminLogin()) return
+        setError(dict.invalidCredentials)
         return
       }
 
-      if (empJson?.error === 'password_not_set') {
-        setError(dict.passwordNotSet)
-        return
-      }
-
-      const adminRes = await fetch(`${API_BASE}/admin/auth/login`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        credentials: 'include',
-        body: JSON.stringify({ email, password }),
-      })
-      const adminJson = await adminRes.json()
-
-      if (adminRes.ok && adminJson?.data?.admin) {
-        window.location.href = `${adminUrl}/dashboard`
-        return
-      }
-
-      if (adminRes.status === 401 && adminJson?.error === 'totp_required') {
-        setStep('totp')
-        return
-      }
+      if (await tryEmployeeLogin()) return
+      if (await tryAdminLogin()) return
 
       setError(dict.invalidCredentials)
     } catch {

apps/dashboard/src/components/layout/PublicShell.tsx

@@ -1,6 +1,5 @@
-import * as React from "react";
 'use client'
-
+import * as React from "react";
 import PublicFooter from '@/components/layout/PublicFooter'
 import PublicHeader from '@/components/layout/PublicHeader'