Build Login

Task

Add the Login route using the same validation, password verification, and session creation boundaries.

Route

Create:

app/api/auth/login/route.ts

Implementation

const parsed = loginSchema.safeParse(await request.json());

if (!parsed.success) {
  return NextResponse.json({ error: "Invalid credentials" }, { status: 400 });
}

const { email, password } = parsed.data;

const user = await prisma.user.findUnique({
  where: { email },
});

if (!user || !(await verifyPassword(user.passwordHash, password))) {
  return NextResponse.json({ error: "Invalid credentials" }, { status: 401 });
}

On success, create the session with the helper from the previous lesson and return only safe user fields.

Use the prepared Login screen to call the endpoint and redirect the user to Home after successful authentication.

Do not reveal whether an email exists when credentials are invalid.

Test

Verify:

• valid credentials log in
• an incorrect password returns 401
• an unknown email returns the same 401 response
• the authenticated user can reach a protected page

Checkpoint

Login creates the same secure session used by registration and establishes the authenticated Readly experience.