[adrientab]

Describe your changes

Added volunteer login and sessions. A volunteer logs in with the email and cell phone saved when they were approved. If the pair matches an ACTIVE volunteer, they get a signed, httpOnly session cookie that holds only their id and lasts 7 days. Added requireVolunteer() so later endpoints can find out which volunteer is calling, the same way requireAdmin() works for admins. Unknown emails, wrong phones, and INACTIVE volunteers all get the same 401 message, so the login form can't be used to find out which emails belong to volunteers.

Partner: @nirvaango

Related Issue

Closes #40

Files changed

• src/lib/volunteer-session.ts: creates, reads, and clears the volunteer_session cookie. Signs a JWT holding { volunteerId } with VOLUNTEER_SESSION_SECRET using jose (HS256, 7 days). The cookie is httpOnly, secure in production only, and sameSite: "lax". getVolunteerSessionId() returns null for a missing, tampered, malformed, or expired token, and throws if the secret is missing.
• src/lib/volunteer-auth.ts: requireVolunteer() reads the session and checks the database on every call. Returns { volunteerId } for an ACTIVE volunteer, 401 for no session or a deleted volunteer, and 403 for an INACTIVE one.
• src/app/api/auth/volunteer/login/route.ts: POST endpoint. Validates the body (400 if bad), normalizes the email and phone with normalizeEmail / normalizeCellPhone, looks the volunteer up by the email_cellPhone key, and sets the session cookie. Returns { volunteer: { id, firstName } }.
• src/app/api/auth/volunteer/logout/route.ts: POST endpoint that clears the session cookie and returns { ok: true }.

How to test

Run npx prisma db seed, add VOLUNTEER_SESSION_SECRET from Dev Resources to .env, and run npm run dev. Then add a temporary GET /api/volunteer-test route that calls requireVolunteer() (code is in the ticket) and test in Postman:

• Not logged in: GET /api/volunteer-test → 401
• Success: login with " Active.Volunteer@Example.com " and "(617) 555-0101" → 200 with { volunteer: { id, firstName } } and an HttpOnly volunteer_session cookie
• Logged in: GET /api/volunteer-test → 200 { volunteerId: "test-volunteer-active" }
• Logout: POST /api/auth/volunteer/logout → 200, then GET /api/volunteer-test → 401
• Wrong phone: active.volunteer@example.com with 6175550199 → 401 Email or cell phone is incorrect.
• Unknown email: nobody@example.com → 401, same message
• Inactive volunteer: inactive.volunteer@example.com with 6175550102 → 401, same message, no cookie
• Bad bodies: missing cellPhone, cellPhone as a number, body not JSON → 400 each
• Tampered cookie: edit the cookie value in Postman's Cookies window → 401
• Deactivated after login: set the volunteer to INACTIVE in Prisma Studio → 403

Screenshots

1. Not logged in → 401

2. Login → 200 + HttpOnly cookie

3. Logged in → 200

4. Logout → 200, then test route → 401

5. Wrong phone → 401

6. Unknown email → 401

7. Inactive volunteer → 401, no cookie

8. Bad bodies → 400
<img width="721" height="491" alt="Screenshot 2026-11-10 at 11 37 18 PM" src="https://github.com/user-attachments/assets/ae96030e-0

17a-43cf-a519-fd8fa5e3ac51" />

9. Tampered cookie

→ 401

10. INACTIVE after login → 403

Estimated Hours Spent

3 hours

Checklist before requesting a review

• Satisfies all Deliverables
• Tested thoroughly
• No unused dependencies
• Requested review from Natalie

[natphua]

Amazing work guys! No comments from me here - you did everything perfectly 😁

Thanks for being thorough with the PR and adding all the screenshots too; it really helps. Keep up the good work and I hope you were able to learn a lot about session cookies lol