From 44a1d899243a847cc9bc5bb50c66ed450243cb73 Mon Sep 17 00:00:00 2001
From: NW <nw@softuniq.eu>
Date: Fri, 7 Aug 2026 14:51:45 +0100
Subject: [PATCH] fix: replace next/link with anchor tags in sidebar to stop
 404 RSC prefetch; set secure cookie by request protocol

---
 .env                                    |  4 +++-
 src/app/api/auth/login/route.ts         |  6 +++++-
 src/components/layout/admin-sidebar.tsx | 21 ++++++++++-----------
 3 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/.env b/.env
index 769ebf2..ff0fca6 100755
--- a/.env
+++ b/.env
@@ -1 +1,3 @@
-DATABASE_URL=file:/home/z/my-project/db/custom.db
+DATABASE_URL=file:/opt/Projects/telegram-shop/db/shop.db
+ADMIN_SECRET=shop_admin_2024_secure_token
+SUPER_ADMIN_SECRET=shop_superadmin_2024_secure_token
diff --git a/src/app/api/auth/login/route.ts b/src/app/api/auth/login/route.ts
index 89a9d59..038303e 100755
--- a/src/app/api/auth/login/route.ts
+++ b/src/app/api/auth/login/route.ts
@@ -40,12 +40,16 @@ export async function POST(request: NextRequest) {
 
     loginAttempts.delete(ip);
     const response = NextResponse.json({ ok: true });
+    // Secure cookie only when the request arrived over HTTPS.
+    // The admin panel is served over plain HTTP (LAN / Tor), where
+    // Secure cookies are silently dropped by browsers.
+    const proto = request.headers.get('x-forwarded-proto') || 'http';
     response.cookies.set('admin_token', authToken, {
       httpOnly: true,
       sameSite: 'lax',
       maxAge: 86400,
       path: '/',
-      secure: process.env.NODE_ENV === 'production',
+      secure: proto === 'https',
     });
     return response;
   } catch {
diff --git a/src/components/layout/admin-sidebar.tsx b/src/components/layout/admin-sidebar.tsx
index cf8a380..f38988b 100755
--- a/src/components/layout/admin-sidebar.tsx
+++ b/src/components/layout/admin-sidebar.tsx
@@ -1,6 +1,5 @@
 "use client";
 
-import Link from "next/link";
 import { useState, useEffect } from "react";
 import {
   LayoutDashboard,
@@ -164,7 +163,7 @@ export function AdminSidebar() {
                     tooltip={item.title}
                     className="[&[data-active='true']]:border-l-2 [&[data-active='true']]:border-l-sidebar-primary relative"
                   >
-                    <Link href={item.href}>
+                    <a href={item.href}>
                       <item.icon className="size-4 text-muted-foreground transition-colors group-hover/sidebar-menu-button:text-primary" />
                       <span>{item.title}</span>
                       {item.shortcut && (
@@ -172,7 +171,7 @@ export function AdminSidebar() {
                           {item.shortcut}
                         </kbd>
                       )}
-                    </Link>
+                    </a>
                   </SidebarMenuButton>
                   {item.badge && pendingCount > 0 && (
                     <SidebarMenuBadge className="bg-destructive text-destructive-foreground">
@@ -204,7 +203,7 @@ export function AdminSidebar() {
                     tooltip={item.title}
                     className="[&[data-active='true']]:border-l-2 [&[data-active='true']]:border-l-sidebar-primary relative"
                   >
-                    <Link href={item.href}>
+                    <a href={item.href}>
                       <item.icon className="size-4 text-muted-foreground transition-colors group-hover/sidebar-menu-button:text-primary" />
                       <span>{item.title}</span>
                       {item.shortcut && (
@@ -212,7 +211,7 @@ export function AdminSidebar() {
                           {item.shortcut}
                         </kbd>
                       )}
-                    </Link>
+                    </a>
                   </SidebarMenuButton>
                 </SidebarMenuItem>
               ))}
@@ -232,10 +231,10 @@ export function AdminSidebar() {
                     tooltip={item.title}
                     className="[&[data-active='true']]:border-l-2 [&[data-active='true']]:border-l-sidebar-primary relative"
                   >
-                    <Link href={item.href}>
+                    <a href={item.href}>
                       <item.icon className="size-4 text-muted-foreground transition-colors group-hover/sidebar-menu-button:text-primary" />
                       <span>{item.title}</span>
-                    </Link>
+                    </a>
                   </SidebarMenuButton>
                 </SidebarMenuItem>
               ))}
@@ -255,7 +254,7 @@ export function AdminSidebar() {
                     tooltip={item.title}
                     className="[&[data-active='true']]:border-l-2 [&[data-active='true']]:border-l-sidebar-primary relative"
                   >
-                    <Link href={item.href}>
+                    <a href={item.href}>
                       <item.icon className="size-4 text-muted-foreground transition-colors group-hover/sidebar-menu-button:text-primary" />
                       <span>{item.title}</span>
                       {item.shortcut && (
@@ -263,7 +262,7 @@ export function AdminSidebar() {
                           {item.shortcut}
                         </kbd>
                       )}
-                    </Link>
+                    </a>
                   </SidebarMenuButton>
                 </SidebarMenuItem>
               ))}
@@ -274,10 +273,10 @@ export function AdminSidebar() {
                     isActive={pathname.startsWith("/seed")}
                     tooltip="Danger Zone"
                   >
-                    <Link href="/seed">
+                    <a href="/seed">
                       <AlertTriangle className="size-4 text-destructive" />
                       <span className="text-destructive">Danger Zone</span>
-                    </Link>
+                    </a>
                   </SidebarMenuButton>
                 </SidebarMenuItem>
               )}