A Strapi login page for Next.js

app/login/actions.ts

"use server";
import { cookies } from "next/headers";

const STRAPI_URL = process.env.STRAPI_URL ?? "http://localhost:1337";

type Result = { ok: boolean; error?: string };
// Strapi 5 answers { jwt, user } on success and { data: null, error: { status, name, message } } on failure.
type StrapiAuthResponse = {
  jwt?: string;
  user?: { id: number; username: string; email: string };
  error?: { status: number; name: string; message: string };
};

async function postAuth(path: string, body: Record<string, string>): Promise<Result> {
  let res: Response;
  try {
    res = await fetch(`${STRAPI_URL}/api${path}`, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify(body),
      cache: "no-store",
    });
  } catch {
    return { ok: false, error: "Can't reach the server. Try again." };
  }
  const data = (await res.json().catch(() => ({}))) as StrapiAuthResponse;
  if (!res.ok) return { ok: false, error: data.error?.message ?? "Something went wrong. Try again." };
  // With email confirmation on, register answers with the user and no JWT.
  if (!data.jwt) return { ok: false, error: "Check your inbox to confirm your email." };

  (await cookies()).set("strapi_jwt", data.jwt, {
    httpOnly: true, // the browser never reads the token
    secure: process.env.NODE_ENV === "production",
    sameSite: "lax",
    path: "/",
    maxAge: 60 * 60 * 24 * 7, // a week; Strapi's own JWT lasts 30 days by default
  });
  return { ok: true };
}

export async function signInAction(email: string, password: string): Promise<Result> {
  return postAuth("/auth/local", { identifier: email, password });
}

export async function signUpAction(name: string, email: string, password: string): Promise<Result> {
  // Strapi takes only username, email and password here by default.
  // The email doubles as the username so two people called Sam don't collide.
  // To keep the name too, see "Keeping the name from the sign-up card" below.
  return postAuth("/auth/local/register", { username: email, email, password });
}