wedding-website/plans/milestone-02-auth-admin-shell.md

Milestone 02 — Google Auth and Admin Shell

Reference

Read plans/wedding-bootstrap-plan.md first. Also confirm the current Next.js/Auth.js setup before implementation because this project uses Next.js 16.

Goal

Add Google login restricted to the couple and create a protected /admin shell using shadcn/ui components only.

Scope

Implement only:

• Google OAuth authentication.
• Admin email allowlist via ADMIN_EMAILS.
• Route protection for /admin and /admin/*.
• Basic /admin dashboard shell.
• Sign-in/sign-out UI.
• shadcn/ui setup and required admin shell components.

Non-goals

Do not implement:

• Invitation creation forms.
• Invitation list/detail functionality.
• Guest invite pages.
• RSVP submission.
• MinIO uploads.
• Song/toast/message workflows.

Required constraints

• /admin and /admin/* require authenticated admin access.
• Only emails in ADMIN_EMAILS can access admin pages.
• Guest pages must not require login.
• Admin UI must use shadcn/ui components only.
• Do not introduce another admin component library.
• If a component is needed, add it through the shadcn workflow.

Implementation tasks

• Add/configure Auth.js/NextAuth Google provider.
• Add auth.ts or equivalent auth config.
• Add app/api/auth/[...nextauth]/route.ts or current-version equivalent.
• Add middleware or route-level protection for /admin.
• Add forbidden/unauthorized handling.
• Initialize shadcn/ui if not already initialized.
• Add required shadcn components for the admin shell, likely:
  • button
  • card
  • dropdown-menu
  • avatar or badge if useful
  • alert
• Create /admin page with basic dashboard placeholder cards.
• Add sign-in/sign-out controls.

Verification

Run:

npm run lint
npm run build

Manual checks:

• Unauthenticated user cannot access /admin.
• Allowed Google email can access /admin.
• Non-allowlisted Google email is denied.
• Public/guest routes remain accessible without login.
• Admin page uses only shadcn/ui components.

Acceptance criteria

• Admin auth works with Google OAuth and email allowlist.
• /admin is protected.
• Admin shell exists and builds.
• No non-shadcn admin UI component library was added.
• No future milestone features were implemented.