From 047e580da0663a23ca71b465c904c5c41a2100b6 Mon Sep 17 00:00:00 2001
From: Dominik Klarkowski <dominik.klarkowski@codecanfly.com>
Date: Thu, 18 Jun 2026 11:02:31 +0200
Subject: [PATCH] init

---
 .idea/dataSources.xml                    |  17 ++++
 .idea/db-forest-config.xml               |   2 +-
 app/ai/actions.ts                        |   7 +-
 app/api/auth/[...nextauth]/route.ts      |   3 +
 app/layout.tsx                           |   7 +-
 app/login/page.tsx                       |  36 ++++++++
 app/page.tsx                             |   9 +-
 app/running/[id]/page.tsx                |  82 ++++++++++++------
 app/running/actions.ts                   |  43 ++++++----
 app/running/page.tsx                     |   4 +-
 app/settings/actions.ts                  |  28 +++++++
 app/settings/garmin-credentials-form.tsx |  58 +++++++++++++
 app/settings/page.tsx                    |  59 +++++++++----
 app/strength/[id]/page.tsx               |  14 ++--
 app/strength/import/actions.ts           |   4 +-
 app/strength/page.tsx                    |   4 +-
 auth.ts                                  |  34 ++++++++
 components/elevation-chart.tsx           | 102 +++++++++++++++++++----
 components/nav.tsx                       |  17 +++-
 components/run-metric-chart.tsx          |  17 +++-
 components/sign-out-button.tsx           |  18 ++++
 lib/ai/claude.ts                         |  39 ++++++---
 lib/garmin/client.ts                     |  57 ++++++-------
 lib/models/analysis.ts                   |  27 +++---
 lib/models/garmin-auth.ts                |  48 ++++++++---
 lib/models/running.ts                    |  45 ++++++----
 lib/models/strength.ts                   |  19 +++--
 lib/session.ts                           |   8 ++
 middleware.ts                            |  23 +++++
 package.json                             |   1 +
 pnpm-lock.yaml                           |  76 +++++++++++++++++
 types/next-auth.d.ts                     |  16 ++++
 32 files changed, 735 insertions(+), 189 deletions(-)
 create mode 100644 .idea/dataSources.xml
 create mode 100644 app/api/auth/[...nextauth]/route.ts
 create mode 100644 app/login/page.tsx
 create mode 100644 app/settings/actions.ts
 create mode 100644 app/settings/garmin-credentials-form.tsx
 create mode 100644 auth.ts
 create mode 100644 components/sign-out-button.tsx
 create mode 100644 lib/session.ts
 create mode 100644 middleware.ts
 create mode 100644 types/next-auth.d.ts

diff --git a/.idea/dataSources.xml b/.idea/dataSources.xml
new file mode 100644
index 0000000..324637b
--- /dev/null
+++ b/.idea/dataSources.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="DataSourceManagerImpl" format="xml" multifile-model="true">
+    <data-source source="LOCAL" name="@localhost" uuid="42f0cf9c-c76e-4f63-bced-ee4de72b5936">
+      <driver-ref>mongo.4</driver-ref>
+      <synchronize>true</synchronize>
+      <jdbc-driver>com.dbschema.MongoJdbcDriver</jdbc-driver>
+      <jdbc-url>mongodb://localhost:27017/?authSource=admin</jdbc-url>
+      <jdbc-additional-properties>
+        <property name="com.intellij.clouds.kubernetes.db.host.port" />
+        <property name="com.intellij.clouds.kubernetes.db.enabled" value="false" />
+        <property name="com.intellij.clouds.kubernetes.db.container.port" />
+      </jdbc-additional-properties>
+      <working-dir>$ProjectFileDir$</working-dir>
+    </data-source>
+  </component>
+</project>
\ No newline at end of file
diff --git a/.idea/db-forest-config.xml b/.idea/db-forest-config.xml
index 612e11a..f5db96b 100644
--- a/.idea/db-forest-config.xml
+++ b/.idea/db-forest-config.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
   <component name="db-tree-configuration">
-    <option name="data" value="----------------------------------------&#10;1:0:cad974ec-67a1-45af-aa5e-0f2afd65b89b&#10;2:0:25e55397-437c-4c68-99f5-2d21fbba46d2&#10;3:0:d401f651-e4ab-4ff5-9655-e2b6c0b396dc&#10;4:0:ec87ba30-ade3-4e14-8f35-5c06f6cf8662&#10;5:0:e9fca1ad-1d37-4a8c-a7b4-95d6a736484c&#10;6:0:c4b8376d-a287-4fa4-bc44-2d2fac1cd37b&#10;7:0:66be42c8-917f-4bb8-ae8d-4016f762e870&#10;8:0:0b74125a-9a07-4cfa-afd4-c5fccf1496b4&#10;9:0:07d79dcf-bacf-49b0-936e-5cb4c251b3e1&#10;10:0:986e8611-b865-4ec3-8cb6-92fc42c283a7&#10;11:0:70ccb5fc-6aef-4cd5-9f4b-ccbea8e185c6&#10;12:0:d2358406-bd5f-4030-a822-5a1c2f653b55&#10;13:0:52d85314-8e9f-4e42-bd9d-f146df941871&#10;14:0:07d72045-e35c-4264-b612-a64c58c635d7&#10;15:0:c05a40be-4e30-4606-bc06-511d9b109dbb&#10;16:0:810ba5f7-c9cc-4010-a3c3-195abacabb8e&#10;17:0:5da9a988-52c5-4bcf-b758-1677ab67bf26&#10;18:0:7d0a6ab5-b6df-4898-afec-cad19b908728&#10;19:0:bd763ebe-280e-49f8-a248-fcd7c4c8d712&#10;20:0:233739c2-121e-45b9-be8b-613eadecd69f&#10;21:0:e8230f4d-40da-406b-a7ca-bf59ada3230a&#10;22:0:02b1616a-5718-42d3-a31e-22f9f32e5333&#10;23:0:1e611642-8fd8-44d0-876b-9c8c2b4ba00c&#10;" />
+    <option name="data" value="----------------------------------------&#10;1:0:cad974ec-67a1-45af-aa5e-0f2afd65b89b&#10;2:0:25e55397-437c-4c68-99f5-2d21fbba46d2&#10;3:0:d401f651-e4ab-4ff5-9655-e2b6c0b396dc&#10;4:0:ec87ba30-ade3-4e14-8f35-5c06f6cf8662&#10;5:0:e9fca1ad-1d37-4a8c-a7b4-95d6a736484c&#10;6:0:c4b8376d-a287-4fa4-bc44-2d2fac1cd37b&#10;7:0:66be42c8-917f-4bb8-ae8d-4016f762e870&#10;8:0:0b74125a-9a07-4cfa-afd4-c5fccf1496b4&#10;9:0:07d79dcf-bacf-49b0-936e-5cb4c251b3e1&#10;10:0:986e8611-b865-4ec3-8cb6-92fc42c283a7&#10;11:0:70ccb5fc-6aef-4cd5-9f4b-ccbea8e185c6&#10;12:0:d2358406-bd5f-4030-a822-5a1c2f653b55&#10;13:0:52d85314-8e9f-4e42-bd9d-f146df941871&#10;14:0:07d72045-e35c-4264-b612-a64c58c635d7&#10;15:0:c05a40be-4e30-4606-bc06-511d9b109dbb&#10;16:0:810ba5f7-c9cc-4010-a3c3-195abacabb8e&#10;17:0:5da9a988-52c5-4bcf-b758-1677ab67bf26&#10;18:0:7d0a6ab5-b6df-4898-afec-cad19b908728&#10;19:0:bd763ebe-280e-49f8-a248-fcd7c4c8d712&#10;20:0:233739c2-121e-45b9-be8b-613eadecd69f&#10;21:0:e8230f4d-40da-406b-a7ca-bf59ada3230a&#10;22:0:02b1616a-5718-42d3-a31e-22f9f32e5333&#10;23:0:1e611642-8fd8-44d0-876b-9c8c2b4ba00c&#10;24:0:42f0cf9c-c76e-4f63-bced-ee4de72b5936&#10;" />
   </component>
 </project>
\ No newline at end of file
diff --git a/app/ai/actions.ts b/app/ai/actions.ts
index 9d0b617..324df8a 100644
--- a/app/ai/actions.ts
+++ b/app/ai/actions.ts
@@ -2,6 +2,7 @@
 
 import { revalidatePath } from "next/cache";
 import { generateAnalysis, generateDashboardAnalysis } from "@/lib/ai/claude";
+import { getCurrentUserId } from "@/lib/session";
 import type { AiAnalysisTargetType } from "@/lib/models/analysis";
 
 export type GenerateAnalysisState = { error: string } | { success: true } | null;
@@ -10,8 +11,9 @@ export async function generateAnalysisAction(
   targetType: AiAnalysisTargetType,
   targetId: string
 ): Promise<GenerateAnalysisState> {
+  const userId = await getCurrentUserId();
   try {
-    await generateAnalysis(targetType, targetId);
+    await generateAnalysis(userId, targetType, targetId);
   } catch (error) {
     return { error: error instanceof Error ? error.message : "Nie udało się wygenerować analizy." };
   }
@@ -22,8 +24,9 @@ export async function generateAnalysisAction(
 }
 
 export async function generateDashboardAnalysisAction(): Promise<GenerateAnalysisState> {
+  const userId = await getCurrentUserId();
   try {
-    await generateDashboardAnalysis();
+    await generateDashboardAnalysis(userId);
   } catch (error) {
     return { error: error instanceof Error ? error.message : "Nie udało się wygenerować analizy." };
   }
diff --git a/app/api/auth/[...nextauth]/route.ts b/app/api/auth/[...nextauth]/route.ts
new file mode 100644
index 0000000..86c9f3d
--- /dev/null
+++ b/app/api/auth/[...nextauth]/route.ts
@@ -0,0 +1,3 @@
+import { handlers } from "@/auth";
+
+export const { GET, POST } = handlers;
diff --git a/app/layout.tsx b/app/layout.tsx
index b3c0654..7b1677f 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -1,6 +1,7 @@
 import type { Metadata } from "next";
 import { Geist, Geist_Mono } from "next/font/google";
 import { Nav } from "@/components/nav";
+import { auth } from "@/auth";
 import "./globals.css";
 
 const geistSans = Geist({
@@ -18,18 +19,20 @@ export const metadata: Metadata = {
   description: "Analiza treningów biegowych i siłowych",
 };
 
-export default function RootLayout({
+export default async function RootLayout({
   children,
 }: Readonly<{
   children: React.ReactNode;
 }>) {
+  const session = await auth();
+
   return (
     <html
       lang="pl"
       className={`${geistSans.variable} ${geistMono.variable} h-full antialiased`}
     >
       <body className="min-h-full flex flex-col bg-bg text-fg">
-        <Nav />
+        {session && <Nav />}
         <main className="mx-auto w-full max-w-5xl flex-1 px-4 py-6 sm:px-6">
           {children}
         </main>
diff --git a/app/login/page.tsx b/app/login/page.tsx
new file mode 100644
index 0000000..0567980
--- /dev/null
+++ b/app/login/page.tsx
@@ -0,0 +1,36 @@
+import { signIn } from "@/auth";
+
+export default function LoginPage() {
+  return (
+    <div className="flex min-h-screen flex-col items-center justify-center gap-10">
+      <div className="flex flex-col items-center gap-4">
+        {/* eslint-disable-next-line @next/next/no-img-element */}
+        <img
+          src="/logo.svg"
+          alt="KNUR"
+          width={160}
+          height={160}
+          className="rounded-3xl shadow-2xl ring-2 ring-surface"
+        />
+        <h1 className="text-3xl font-bold tracking-tight text-fg">KNUR</h1>
+        <p className="text-sm text-fg/50">
+          Książka Notowań Udźwigów i Rezultatów
+        </p>
+      </div>
+
+      <form
+        action={async () => {
+          "use server";
+          await signIn("keycloak", { redirectTo: "/" });
+        }}
+      >
+        <button
+          type="submit"
+          className="rounded-lg bg-accent px-8 py-3 text-sm font-semibold text-white transition-opacity hover:opacity-90"
+        >
+          Zaloguj
+        </button>
+      </form>
+    </div>
+  );
+}
diff --git a/app/page.tsx b/app/page.tsx
index 0f4642e..93fd473 100644
--- a/app/page.tsx
+++ b/app/page.tsx
@@ -8,14 +8,17 @@ import { formatDateShort, formatDistance, formatDuration, formatPace } from "@/l
 import { getDashboardAnalysis, serializeAnalysis } from "@/lib/models/analysis";
 import { listRunningActivities } from "@/lib/models/running";
 import { listStrengthWorkouts } from "@/lib/models/strength";
+import { getCurrentUserId } from "@/lib/session";
 
 export const dynamic = "force-dynamic";
 
 export default async function Home() {
+  const userId = await getCurrentUserId();
+
   const [runs, strengthWorkouts, dashboardAnalysis] = await Promise.all([
-    listRunningActivities(),
-    listStrengthWorkouts(),
-    getDashboardAnalysis(),
+    listRunningActivities(userId),
+    listStrengthWorkouts(userId),
+    getDashboardAnalysis(userId),
   ]);
 
   const weekStart = startOfWeek(new Date(), { weekStartsOn: 1 });
diff --git a/app/running/[id]/page.tsx b/app/running/[id]/page.tsx
index 1ecd352..7aa7582 100644
--- a/app/running/[id]/page.tsx
+++ b/app/running/[id]/page.tsx
@@ -20,24 +20,29 @@ import {
   type RunMetrics,
   type RunningActivity,
 } from "@/lib/models/running";
+import { getCurrentUserId } from "@/lib/session";
 
 export const dynamic = "force-dynamic";
 
-// hasRoute may be undefined for activities synced before the field was added,
-// even if routePoints are already in the DB.
 function mayHaveRoute(activity: RunningActivity): boolean {
   return Boolean(activity.hasRoute) || Boolean(activity.routePoints?.length);
 }
 
-async function RouteMapFetcher({ activity }: { activity: RunningActivity }) {
+async function RouteMapFetcher({
+  activity,
+  userId,
+}: {
+  activity: RunningActivity;
+  userId: string;
+}) {
   let routePoints = activity.routePoints;
 
   if ((!routePoints || !activity.elevationProfile) && mayHaveRoute(activity)) {
     try {
-      const client = await getAuthorizedClient();
+      const client = await getAuthorizedClient(userId);
       const result = await fetchActivityRoutePoints(client, activity.garminActivityId);
       if (result) {
-        await setRunningActivityRoutePoints(activity.garminActivityId, result.points, result.elevationProfile);
+        await setRunningActivityRoutePoints(userId, activity.garminActivityId, result.points, result.elevationProfile);
         routePoints = result.points;
       }
     } catch {
@@ -62,15 +67,21 @@ function hasValidElevation(profile: number[] | undefined): boolean {
   return Array.isArray(profile) && profile.some((v) => v > 0);
 }
 
-async function ElevationFetcher({ activity }: { activity: RunningActivity }) {
+async function ElevationFetcher({
+  activity,
+  userId,
+}: {
+  activity: RunningActivity;
+  userId: string;
+}) {
   let elevationProfile = activity.elevationProfile;
 
   if (!hasValidElevation(elevationProfile) && mayHaveRoute(activity)) {
     try {
-      const client = await getAuthorizedClient();
+      const client = await getAuthorizedClient(userId);
       const result = await fetchActivityRoutePoints(client, activity.garminActivityId);
       if (result) {
-        await setRunningActivityRoutePoints(activity.garminActivityId, result.points, result.elevationProfile);
+        await setRunningActivityRoutePoints(userId, activity.garminActivityId, result.points, result.elevationProfile);
         elevationProfile = result.elevationProfile;
       }
     } catch {
@@ -80,14 +91,23 @@ async function ElevationFetcher({ activity }: { activity: RunningActivity }) {
 
   if (!elevationProfile || elevationProfile.length < 2) return null;
 
-  const data = elevationProfile
+  const elevData = elevationProfile
     .map((altM, i) => ({
       distanceKm: Math.round((i / elevationProfile!.length) * activity.distanceM / 10) / 100,
       altM,
     }))
     .filter((p) => p.altM > 0);
 
-  if (data.length < 2) return null;
+  if (elevData.length < 2) return null;
+
+  // Merge pace by fractional position (both arrays span the same run, different sample counts)
+  const paceSrc = activity.runMetrics?.paceSec;
+  const data = elevData.map((ep, i) => {
+    if (!paceSrc || paceSrc.length === 0) return ep;
+    const pi = Math.min(Math.round((i / elevData.length) * paceSrc.length), paceSrc.length - 1);
+    const v = paceSrc[pi];
+    return { ...ep, paceSec: v > 0 && v < 1800 ? v : undefined };
+  });
 
   return <ElevationChart data={data} />;
 }
@@ -102,18 +122,27 @@ function toChartData(
     .filter((p) => p.value > 0);
 }
 
-async function RunMetricsFetcher({ activity }: { activity: RunningActivity }) {
+async function RunMetricsFetcher({
+  activity,
+  userId,
+}: {
+  activity: RunningActivity;
+  userId: string;
+}) {
   let metrics: RunMetrics | undefined = activity.runMetrics;
 
   const missingCadence = activity.avgCadence && !metrics?.cadenceSpm;
   const missingGcb = activity.avgGroundContactBalanceLeftPct && !metrics?.gcbLeftPct;
+  // Re-fetch if paceSec missing or was computed from integer-rounded speeds (< 15 unique values = rounding artifact)
+  const validPace = metrics?.paceSec?.filter((v) => v > 0) ?? [];
+  const missingPace = validPace.length === 0 || new Set(validPace).size < 15;
 
-  if ((!metrics || missingCadence || missingGcb) && mayHaveRoute(activity)) {
+  if ((!metrics || missingCadence || missingGcb || missingPace) && mayHaveRoute(activity)) {
     try {
-      const client = await getAuthorizedClient();
+      const client = await getAuthorizedClient(userId);
       const fetched = await fetchActivityRunMetrics(client, activity.garminActivityId);
       if (fetched) {
-        await setRunningActivityMetrics(activity.garminActivityId, fetched);
+        await setRunningActivityMetrics(userId, activity.garminActivityId, fetched);
         metrics = fetched;
       }
     } catch {
@@ -125,7 +154,6 @@ async function RunMetricsFetcher({ activity }: { activity: RunningActivity }) {
 
   const { hrBpm, gcbLeftPct } = metrics;
 
-  // Fall back to evenly-spaced distances if Garmin didn't provide them
   const maxDist = Math.max(...metrics.distanceKm);
   const distanceKm =
     maxDist > 0
@@ -151,12 +179,7 @@ async function RunMetricsFetcher({ activity }: { activity: RunningActivity }) {
   return (
     <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
       {hrData.length > 1 && (
-        <RunMetricChart
-          data={hrData}
-          label="Tętno"
-          unit="bpm"
-          color="var(--color-accent)"
-        />
+        <RunMetricChart data={hrData} label="Tętno" unit="bpm" color="var(--color-accent)" />
       )}
       {gcbData.length > 1 && <GcbChart data={gcbData} />}
     </div>
@@ -175,13 +198,14 @@ export default async function RunningActivityPage({
   params: Promise<{ id: string }>;
 }) {
   const { id } = await params;
-  const activity = await getRunningActivity(id);
+  const userId = await getCurrentUserId();
+  const activity = await getRunningActivity(userId, id);
 
   if (!activity) {
     notFound();
   }
 
-  const analysis = await getLatestAnalysisForTarget("running", activity._id);
+  const analysis = await getLatestAnalysisForTarget(userId, "running", activity._id);
 
   return (
     <div className="flex flex-col gap-6">
@@ -192,7 +216,7 @@ export default async function RunningActivityPage({
 
       <section className="grid grid-cols-3 gap-4">
         <Suspense fallback={<MapSkeleton />}>
-          <RouteMapFetcher activity={activity} />
+          <RouteMapFetcher activity={activity} userId={userId} />
         </Suspense>
 
         <StatCard highlight label="Dystans" value={formatDistance(activity.distanceM)} />
@@ -238,14 +262,18 @@ export default async function RunningActivityPage({
       </section>
 
       <Suspense fallback={null}>
-        <ElevationFetcher activity={activity} />
+        <ElevationFetcher activity={activity} userId={userId} />
       </Suspense>
 
       <Suspense fallback={null}>
-        <RunMetricsFetcher activity={activity} />
+        <RunMetricsFetcher activity={activity} userId={userId} />
       </Suspense>
 
-      <AiAnalysisCard targetType="running" targetId={activity._id.toString()} analysis={analysis ? serializeAnalysis(analysis) : null} />
+      <AiAnalysisCard
+        targetType="running"
+        targetId={activity._id.toString()}
+        analysis={analysis ? serializeAnalysis(analysis) : null}
+      />
     </div>
   );
 }
diff --git a/app/running/actions.ts b/app/running/actions.ts
index 72c6d4c..e1a4a65 100644
--- a/app/running/actions.ts
+++ b/app/running/actions.ts
@@ -4,6 +4,7 @@ import { revalidatePath } from "next/cache";
 import type { GarminConnect } from "garmin-connect";
 import {
   GarminLoginRequiredError,
+  GarminCredentialsMissingError,
   beginGarminLogin,
   completeGarminMfaLogin,
   fetchActivityRoutePoints,
@@ -23,19 +24,20 @@ import {
   saveOauth1Token,
   savePendingMfaState,
 } from "@/lib/models/garmin-auth";
+import { getCurrentUserId } from "@/lib/session";
 
 export type SyncGarminState = { error: string } | { success: string } | { mfaRequired: true } | null;
 
-async function syncWithClient(client: GarminConnect): Promise<SyncGarminState> {
-  const since = await getLastSyncAt();
+async function syncWithClient(userId: string, client: GarminConnect): Promise<SyncGarminState> {
+  const since = await getLastSyncAt(userId);
   const activities = await fetchRunningActivities(client);
   const newCount = activities.filter((activity) => !since || activity.startTime > since).length;
 
   for (const activity of activities) {
-    await upsertRunningActivity(activity);
+    await upsertRunningActivity(userId, activity);
   }
 
-  await setLastSyncAt(new Date());
+  await setLastSyncAt(userId, new Date());
 
   revalidatePath("/running");
   revalidatePath("/settings");
@@ -45,39 +47,45 @@ async function syncWithClient(client: GarminConnect): Promise<SyncGarminState> {
 }
 
 export async function syncGarminActivities(): Promise<SyncGarminState> {
+  const userId = await getCurrentUserId();
+
   try {
-    const client = await getAuthorizedClient();
-    return await syncWithClient(client);
+    const client = await getAuthorizedClient(userId);
+    return await syncWithClient(userId, client);
   } catch (error) {
+    if (error instanceof GarminCredentialsMissingError) {
+      return { error: error.message };
+    }
     if (!(error instanceof GarminLoginRequiredError)) {
       return { error: error instanceof Error ? error.message : "Synchronizacja z Garmin nie powiodła się." };
     }
   }
 
   try {
-    const result = await beginGarminLogin();
+    const result = await beginGarminLogin(userId);
     if ("mfaRequired" in result) {
-      await savePendingMfaState(result.pendingState);
+      await savePendingMfaState(userId, result.pendingState);
       return { mfaRequired: true };
     }
-    await saveOauth1Token(result.oauth1Token);
-    return await syncWithClient(result.client);
+    await saveOauth1Token(userId, result.oauth1Token);
+    return await syncWithClient(userId, result.client);
   } catch (error) {
     return { error: error instanceof Error ? error.message : "Logowanie do Garmin nie powiodło się." };
   }
 }
 
 export async function submitGarminMfaCode(code: string): Promise<SyncGarminState> {
-  const pending = await getPendingMfaState();
+  const userId = await getCurrentUserId();
+  const pending = await getPendingMfaState(userId);
   if (!pending) {
     return { error: "Sesja logowania do Garmin wygasła. Kliknij \"Synchronizuj z Garmin\" ponownie." };
   }
 
   try {
     const result = await completeGarminMfaLogin(pending, code);
-    await saveOauth1Token(result.oauth1Token);
-    await clearPendingMfaState();
-    return await syncWithClient(result.client);
+    await saveOauth1Token(userId, result.oauth1Token);
+    await clearPendingMfaState(userId);
+    return await syncWithClient(userId, result.client);
   } catch (error) {
     return { error: error instanceof Error ? error.message : "Weryfikacja kodu MFA nie powiodła się." };
   }
@@ -86,12 +94,13 @@ export async function submitGarminMfaCode(code: string): Promise<SyncGarminState
 export type LoadRouteState = { error: string } | { success: true } | null;
 
 export async function loadActivityRoute(activityMongoId: string): Promise<LoadRouteState> {
-  const activity = await getRunningActivity(activityMongoId);
+  const userId = await getCurrentUserId();
+  const activity = await getRunningActivity(userId, activityMongoId);
   if (!activity) return { error: "Nie znaleziono aktywności." };
 
   let client: GarminConnect;
   try {
-    client = await getAuthorizedClient();
+    client = await getAuthorizedClient(userId);
   } catch {
     return { error: "Brak połączenia z Garmin Connect. Wykonaj synchronizację." };
   }
@@ -99,7 +108,7 @@ export async function loadActivityRoute(activityMongoId: string): Promise<LoadRo
   try {
     const result = await fetchActivityRoutePoints(client, activity.garminActivityId);
     if (!result) return { error: "Brak danych GPS dla tej aktywności." };
-    await setRunningActivityRoutePoints(activity.garminActivityId, result.points, result.elevationProfile);
+    await setRunningActivityRoutePoints(userId, activity.garminActivityId, result.points, result.elevationProfile);
     revalidatePath(`/running/${activityMongoId}`);
     return { success: true };
   } catch (error) {
diff --git a/app/running/page.tsx b/app/running/page.tsx
index 9fb381a..28a5ba3 100644
--- a/app/running/page.tsx
+++ b/app/running/page.tsx
@@ -4,11 +4,13 @@ import { EmptyState } from "@/components/empty-state";
 import { SyncButton } from "@/components/sync-button";
 import { formatDateShort, formatDistance, formatDuration, formatPace } from "@/lib/format";
 import { listRunningActivities } from "@/lib/models/running";
+import { getCurrentUserId } from "@/lib/session";
 
 export const dynamic = "force-dynamic";
 
 export default async function RunningPage() {
-  const activities = await listRunningActivities();
+  const userId = await getCurrentUserId();
+  const activities = await listRunningActivities(userId);
 
   return (
     <div className="flex flex-col gap-6">
diff --git a/app/settings/actions.ts b/app/settings/actions.ts
new file mode 100644
index 0000000..fcd8ef5
--- /dev/null
+++ b/app/settings/actions.ts
@@ -0,0 +1,28 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { saveGarminCredentials } from "@/lib/models/garmin-auth";
+import { getCurrentUserId } from "@/lib/session";
+
+export type SaveGarminCredentialsState = { error: string } | { success: true } | null;
+
+export async function saveGarminCredentialsAction(
+  _prevState: SaveGarminCredentialsState,
+  formData: FormData
+): Promise<SaveGarminCredentialsState> {
+  const email = formData.get("email");
+  const password = formData.get("password");
+
+  if (typeof email !== "string" || !email.includes("@")) {
+    return { error: "Podaj prawidłowy adres e-mail." };
+  }
+  if (typeof password !== "string" || password.length < 1) {
+    return { error: "Podaj hasło." };
+  }
+
+  const userId = await getCurrentUserId();
+  await saveGarminCredentials(userId, email.trim(), password);
+
+  revalidatePath("/settings");
+  return { success: true };
+}
diff --git a/app/settings/garmin-credentials-form.tsx b/app/settings/garmin-credentials-form.tsx
new file mode 100644
index 0000000..ef6e8b6
--- /dev/null
+++ b/app/settings/garmin-credentials-form.tsx
@@ -0,0 +1,58 @@
+"use client";
+
+import { useActionState } from "react";
+import { saveGarminCredentialsAction, type SaveGarminCredentialsState } from "./actions";
+
+export function GarminCredentialsForm({ savedEmail }: { savedEmail: string | null }) {
+  const [state, action, pending] = useActionState<SaveGarminCredentialsState, FormData>(
+    saveGarminCredentialsAction,
+    null
+  );
+
+  return (
+    <form action={action} className="flex flex-col gap-3">
+      <div className="flex flex-col gap-1.5">
+        <label htmlFor="garmin-email" className="text-sm text-fg/70">
+          E-mail Garmin Connect
+        </label>
+        <input
+          id="garmin-email"
+          name="email"
+          type="email"
+          defaultValue={savedEmail ?? ""}
+          placeholder="twoj@email.com"
+          required
+          className="rounded-md border border-muted/40 bg-bg px-3 py-2 text-sm text-fg placeholder:text-fg/30 focus:border-accent/60 focus:outline-none"
+        />
+      </div>
+      <div className="flex flex-col gap-1.5">
+        <label htmlFor="garmin-password" className="text-sm text-fg/70">
+          Hasło Garmin Connect
+        </label>
+        <input
+          id="garmin-password"
+          name="password"
+          type="password"
+          placeholder="••••••••"
+          required
+          className="rounded-md border border-muted/40 bg-bg px-3 py-2 text-sm text-fg placeholder:text-fg/30 focus:border-accent/60 focus:outline-none"
+        />
+      </div>
+
+      {state && "error" in state && (
+        <p className="text-sm text-red-400">{state.error}</p>
+      )}
+      {state && "success" in state && (
+        <p className="text-sm text-accent">Zapisano dane logowania.</p>
+      )}
+
+      <button
+        type="submit"
+        disabled={pending}
+        className="self-start rounded-md bg-accent px-4 py-2 text-sm font-semibold text-white transition-opacity hover:opacity-90 disabled:opacity-50"
+      >
+        {pending ? "Zapisywanie…" : "Zapisz"}
+      </button>
+    </form>
+  );
+}
diff --git a/app/settings/page.tsx b/app/settings/page.tsx
index 0a8d40c..f81794d 100644
--- a/app/settings/page.tsx
+++ b/app/settings/page.tsx
@@ -2,22 +2,30 @@ import { CheckCircle2, XCircle } from "lucide-react";
 import { SyncButton } from "@/components/sync-button";
 import { formatDate } from "@/lib/format";
 import { getLastSyncAt } from "@/lib/models/running";
+import { getGarminCredentials, getSavedOauth1Token } from "@/lib/models/garmin-auth";
+import { getCurrentUserId } from "@/lib/session";
+import { GarminCredentialsForm } from "./garmin-credentials-form";
 
 export const dynamic = "force-dynamic";
 
-function ConfigRow({ label, configured }: { label: string; configured: boolean }) {
+function StatusRow({ label, ok, okLabel = "Skonfigurowano", failLabel = "Brak konfiguracji" }: {
+  label: string;
+  ok: boolean;
+  okLabel?: string;
+  failLabel?: string;
+}) {
   return (
     <div className="flex items-center justify-between rounded-lg border border-muted/40 bg-surface p-4">
       <span className="text-fg">{label}</span>
-      {configured ? (
+      {ok ? (
         <span className="flex items-center gap-1.5 text-sm text-fg/70">
           <CheckCircle2 size={16} className="text-accent" />
-          Skonfigurowano
+          {okLabel}
         </span>
       ) : (
         <span className="flex items-center gap-1.5 text-sm text-fg/50">
           <XCircle size={16} />
-          Brak w .env.local
+          {failLabel}
         </span>
       )}
     </div>
@@ -25,31 +33,52 @@ function ConfigRow({ label, configured }: { label: string; configured: boolean }
 }
 
 export default async function SettingsPage() {
-  const lastSyncAt = await getLastSyncAt();
-
-  const mongoConfigured = Boolean(process.env.MONGODB_URI);
-  const garminConfigured = Boolean(process.env.GARMIN_EMAIL && process.env.GARMIN_PASSWORD);
-  const claudeConfigured = Boolean(process.env.ANTHROPIC_API_KEY);
+  const userId = await getCurrentUserId();
+  const [lastSyncAt, garminCreds, garminToken] = await Promise.all([
+    getLastSyncAt(userId),
+    getGarminCredentials(userId),
+    getSavedOauth1Token(userId),
+  ]);
 
   return (
     <div className="flex flex-col gap-6">
       <div>
         <h1 className="text-2xl font-bold text-fg">Ustawienia</h1>
-        <p className="mt-1 text-sm text-fg/60">Status konfiguracji i synchronizacja Garmin.</p>
+        <p className="mt-1 text-sm text-fg/60">Konfiguracja konta i synchronizacja Garmin.</p>
       </div>
 
       <section className="flex flex-col gap-3">
-        <h2 className="text-lg font-semibold text-fg">Konfiguracja</h2>
-        <ConfigRow label="MongoDB" configured={mongoConfigured} />
-        <ConfigRow label="Garmin Connect" configured={garminConfigured} />
-        <ConfigRow label="Claude API" configured={claudeConfigured} />
+        <h2 className="text-lg font-semibold text-fg">Status</h2>
+<StatusRow label="MongoDB" ok={Boolean(process.env.MONGODB_URI)} />
+        <StatusRow
+          label="Garmin Connect — token sesji"
+          ok={Boolean(garminToken)}
+          okLabel="Aktywny (synchronizacja działa)"
+          failLabel="Brak tokenu — wymagane logowanie"
+        />
+        <StatusRow
+          label="Garmin Connect — dane logowania"
+          ok={Boolean(garminCreds)}
+          okLabel={`Zapisano (${garminCreds?.email})`}
+          failLabel="Brak — potrzebne gdy token wygaśnie"
+        />
+        <StatusRow label="Claude API" ok={Boolean(process.env.ANTHROPIC_API_KEY)} />
+      </section>
+
+      <section className="flex flex-col gap-3">
+        <h2 className="text-lg font-semibold text-fg">Konto Garmin Connect</h2>
+        <div className="rounded-lg border border-muted/40 bg-surface p-4">
+          <GarminCredentialsForm savedEmail={garminCreds?.email ?? null} />
+        </div>
       </section>
 
       <section className="flex flex-col gap-3">
         <h2 className="text-lg font-semibold text-fg">Synchronizacja z Garmin</h2>
         <div className="flex items-center justify-between rounded-lg border border-muted/40 bg-surface p-4">
           <span className="text-sm text-fg/70">
-            {lastSyncAt ? `Ostatnia synchronizacja: ${formatDate(lastSyncAt)}` : "Jeszcze nie zsynchronizowano"}
+            {lastSyncAt
+              ? `Ostatnia synchronizacja: ${formatDate(lastSyncAt)}`
+              : "Jeszcze nie zsynchronizowano"}
           </span>
           <SyncButton />
         </div>
diff --git a/app/strength/[id]/page.tsx b/app/strength/[id]/page.tsx
index 5ed5124..6a07266 100644
--- a/app/strength/[id]/page.tsx
+++ b/app/strength/[id]/page.tsx
@@ -6,6 +6,7 @@ import { formatDate, formatDateShort } from "@/lib/format";
 import { getLatestAnalysisForTarget, serializeAnalysis } from "@/lib/models/analysis";
 import { getStrengthWorkout, listStrengthWorkouts } from "@/lib/models/strength";
 import { exerciseE1rm, getExerciseHistory } from "@/lib/strength/stats";
+import { getCurrentUserId } from "@/lib/session";
 
 export const dynamic = "force-dynamic";
 
@@ -17,14 +18,15 @@ export default async function StrengthWorkoutPage({
   params: Promise<{ id: string }>;
 }) {
   const { id } = await params;
-  const workout = await getStrengthWorkout(id);
+  const userId = await getCurrentUserId();
+  const workout = await getStrengthWorkout(userId, id);
 
   if (!workout) {
     notFound();
   }
 
-  const analysis = await getLatestAnalysisForTarget("strength", workout._id);
-  const allWorkouts = await listStrengthWorkouts();
+  const analysis = await getLatestAnalysisForTarget(userId, "strength", workout._id);
+  const allWorkouts = await listStrengthWorkouts(userId);
   const pastWorkouts = allWorkouts.filter((w) => w.date <= workout.date);
 
   const exercisesWithHistory = workout.exercises.map((exercise) => ({
@@ -73,9 +75,9 @@ export default async function StrengthWorkoutPage({
       {exercisesWithHistory.some(({ history }) => history.length >= 2) ? (
         <div className="flex flex-col gap-3">
           <h2 className="flex items-center gap-1.5 text-sm font-semibold text-fg/70">
-              Postęp ćwiczeń
-              <InfoTooltip text="Wolumen (ciężar × powtórzenia) i maksymalny ciężar na tle poprzednich sesji z tym samym ćwiczeniem." />
-            </h2>
+            Postęp ćwiczeń
+            <InfoTooltip text="Wolumen (ciężar × powtórzenia) i maksymalny ciężar na tle poprzednich sesji z tym samym ćwiczeniem." />
+          </h2>
           <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
             {exercisesWithHistory
               .filter(({ history }) => history.length >= 2)
diff --git a/app/strength/import/actions.ts b/app/strength/import/actions.ts
index 080e2ea..33494d2 100644
--- a/app/strength/import/actions.ts
+++ b/app/strength/import/actions.ts
@@ -4,6 +4,7 @@ import { redirect } from "next/navigation";
 import { revalidatePath } from "next/cache";
 import { parseStrongShareText } from "@/lib/strong/parser";
 import { upsertStrengthWorkout } from "@/lib/models/strength";
+import { getCurrentUserId } from "@/lib/session";
 
 export type ImportStrongWorkoutState = { error: string } | null;
 
@@ -27,8 +28,9 @@ export async function importStrongWorkout(
     return { error: "Nie znaleziono żadnego treningu w podanym tekście." };
   }
 
+  const userId = await getCurrentUserId();
   for (const workout of workouts) {
-    await upsertStrengthWorkout(workout);
+    await upsertStrengthWorkout(userId, workout);
   }
 
   revalidatePath("/strength");
diff --git a/app/strength/page.tsx b/app/strength/page.tsx
index 3fbd8ec..036a3f4 100644
--- a/app/strength/page.tsx
+++ b/app/strength/page.tsx
@@ -5,13 +5,15 @@ import { VolumeChart } from "@/components/volume-chart";
 import { formatDateShort } from "@/lib/format";
 import { listStrengthWorkouts } from "@/lib/models/strength";
 import { workoutVolumeKg } from "@/lib/strength/stats";
+import { getCurrentUserId } from "@/lib/session";
 
 export const dynamic = "force-dynamic";
 
 const VOLUME_CHART_LIMIT = 12;
 
 export default async function StrengthPage() {
-  const workouts = await listStrengthWorkouts();
+  const userId = await getCurrentUserId();
+  const workouts = await listStrengthWorkouts(userId);
 
   const volumeData = workouts
     .slice(0, VOLUME_CHART_LIMIT)
diff --git a/auth.ts b/auth.ts
new file mode 100644
index 0000000..06da78f
--- /dev/null
+++ b/auth.ts
@@ -0,0 +1,34 @@
+import NextAuth from "next-auth";
+import Keycloak from "next-auth/providers/keycloak";
+
+export const { handlers, signIn, signOut, auth } = NextAuth({
+  providers: [
+    Keycloak({
+      clientId: process.env.KEYCLOAK_CLIENT_ID!,
+      clientSecret: process.env.KEYCLOAK_CLIENT_SECRET!,
+      issuer: process.env.KEYCLOAK_ISSUER!,
+    }),
+  ],
+  callbacks: {
+    authorized({ auth }) {
+      return !!auth;
+    },
+    jwt({ token, account }) {
+      if (account) {
+        // providerAccountId = Keycloak sub UUID, guaranteed on every login
+        token.keycloakId = account.providerAccountId;
+        token.accessToken = account.access_token;
+        token.idToken = account.id_token;
+      }
+      return token;
+    },
+    session({ session, token }) {
+      session.user.id = (token.keycloakId ?? token.sub) as string;
+      session.idToken = token.idToken as string | undefined;
+      return session;
+    },
+  },
+  pages: {
+    signIn: "/login",
+  },
+});
diff --git a/components/elevation-chart.tsx b/components/elevation-chart.tsx
index ec6c57b..42e24d3 100644
--- a/components/elevation-chart.tsx
+++ b/components/elevation-chart.tsx
@@ -1,13 +1,31 @@
 "use client";
 
-import { useEffect, useState } from "react";
-import { Area, AreaChart, CartesianGrid, ResponsiveContainer, Tooltip, XAxis, YAxis } from "recharts";
+import { useEffect, useId, useState } from "react";
+import {
+  Area,
+  CartesianGrid,
+  ComposedChart,
+  Line,
+  ResponsiveContainer,
+  Tooltip,
+  XAxis,
+  YAxis,
+} from "recharts";
+
+type Point = { distanceKm: number; altM: number; paceSec?: number };
 
 type Props = {
-  data: { distanceKm: number; altM: number }[];
+  data: Point[];
 };
 
+function fmtPace(sec: number): string {
+  const m = Math.floor(sec / 60);
+  const s = Math.round(sec % 60);
+  return `${m}:${s.toString().padStart(2, "0")} /km`;
+}
+
 export function ElevationChart({ data }: Props) {
+  const uid = useId();
   const [mounted, setMounted] = useState(false);
   useEffect(() => setMounted(true), []);
 
@@ -18,15 +36,37 @@ export function ElevationChart({ data }: Props) {
   const altitudes = data.map((p) => p.altM);
   const minAlt = Math.min(...altitudes);
   const maxAlt = Math.max(...altitudes);
-  const pad = Math.max(5, Math.round((maxAlt - minAlt) * 0.15));
+  const altPad = Math.max(5, Math.round((maxAlt - minAlt) * 0.15));
+
+  const pacePoints = data.map((p) => p.paceSec).filter((v): v is number => v != null && v > 0);
+  const hasPace = pacePoints.length > 5;
+  const minPace = hasPace ? Math.min(...pacePoints) : 0;
+  const maxPace = hasPace ? Math.max(...pacePoints) : 0;
+  const pacePad = Math.max(5, Math.round((maxPace - minPace) * 0.15));
+
+  const tooltipStyle = {
+    background: "var(--color-bg)",
+    border: "1px solid var(--color-muted)",
+    borderRadius: 8,
+    fontSize: 12,
+    color: "var(--color-fg)",
+  };
 
   return (
     <div className="rounded-lg border border-muted/40 bg-surface p-4">
-      <div className="mb-2 text-sm text-fg/60">Profil wysokości</div>
+      <div className="mb-2 flex items-center gap-4 text-sm text-fg/60">
+        <span>Profil wysokości</span>
+        {hasPace && (
+          <span className="flex items-center gap-1">
+            <span className="inline-block h-0.5 w-4" style={{ background: "var(--color-sand)" }} />
+            Tempo
+          </span>
+        )}
+      </div>
       <ResponsiveContainer width="100%" height={110}>
-        <AreaChart data={data} margin={{ top: 4, right: 8, left: 0, bottom: 0 }}>
+        <ComposedChart data={data} margin={{ top: 4, right: hasPace ? 52 : 8, left: 0, bottom: 0 }}>
           <defs>
-            <linearGradient id="elevGradient" x1="0" y1="0" x2="0" y2="1">
+            <linearGradient id={`elev-${uid}`} x1="0" y1="0" x2="0" y2="1">
               <stop offset="5%" stopColor="var(--color-accent)" stopOpacity={0.25} />
               <stop offset="95%" stopColor="var(--color-accent)" stopOpacity={0} />
             </linearGradient>
@@ -41,33 +81,59 @@ export function ElevationChart({ data }: Props) {
             interval={Math.max(0, Math.floor(data.length / 5) - 1)}
           />
           <YAxis
+            yAxisId="elev"
             stroke="var(--color-fg)"
             opacity={0.5}
             fontSize={11}
             width={44}
             tickFormatter={(v) => `${Math.round(v)} m`}
-            domain={[minAlt - pad, maxAlt + pad]}
+            domain={[minAlt - altPad, maxAlt + altPad]}
           />
+          {hasPace && (
+            <YAxis
+              yAxisId="pace"
+              orientation="right"
+              reversed
+              stroke="var(--color-sand)"
+              opacity={0.5}
+              fontSize={11}
+              width={50}
+              tickFormatter={fmtPace}
+              domain={[minPace - pacePad, maxPace + pacePad]}
+            />
+          )}
           <Tooltip
-            contentStyle={{
-              background: "var(--color-bg)",
-              border: "1px solid var(--color-muted)",
-              borderRadius: 8,
-              fontSize: 12,
-              color: "var(--color-fg)",
+            contentStyle={tooltipStyle}
+            formatter={(value, name) => {
+              if (name === "altM") return [`${Math.round(Number(value))} m n.p.m.`, "Wysokość"];
+              if (name === "paceSec") return [fmtPace(Number(value)), "Tempo"];
+              return [value, name];
             }}
-            formatter={(value) => [`${Math.round(Number(value))} m n.p.m.`, "Wysokość"]}
-            labelFormatter={(label) => `${Number(label).toFixed(2)} km`}
+            labelFormatter={(l) => `${Number(l).toFixed(2)} km`}
           />
           <Area
+            yAxisId="elev"
             type="monotone"
             dataKey="altM"
+            name="altM"
             stroke="var(--color-accent)"
             strokeWidth={2}
-            fill="url(#elevGradient)"
+            fill={`url(#elev-${uid})`}
             dot={false}
           />
-        </AreaChart>
+          {hasPace && (
+            <Line
+              yAxisId="pace"
+              type="monotone"
+              dataKey="paceSec"
+              name="paceSec"
+              stroke="var(--color-sand)"
+              strokeWidth={1.5}
+              dot={false}
+              connectNulls={false}
+            />
+          )}
+        </ComposedChart>
       </ResponsiveContainer>
     </div>
   );
diff --git a/components/nav.tsx b/components/nav.tsx
index a447f96..254832f 100644
--- a/components/nav.tsx
+++ b/components/nav.tsx
@@ -1,5 +1,7 @@
 import Link from "next/link";
 import { Activity, Dumbbell, LayoutDashboard, Settings } from "lucide-react";
+import { auth, signOut } from "@/auth";
+import { SignOutButton } from "./sign-out-button";
 
 const links = [
   { href: "/", label: "Panel", icon: LayoutDashboard },
@@ -8,7 +10,14 @@ const links = [
   { href: "/settings", label: "Ustawienia", icon: Settings },
 ];
 
-export function Nav() {
+export async function Nav() {
+  const session = await auth();
+
+  const signOutAction = async () => {
+    "use server";
+    await signOut({ redirectTo: "/login" });
+  };
+
   return (
     <header className="border-b border-muted/40 bg-surface">
       <div className="mx-auto flex max-w-5xl items-center justify-between px-4 py-3 sm:px-6">
@@ -39,6 +48,12 @@ export function Nav() {
               <span className="hidden sm:inline">{label}</span>
             </Link>
           ))}
+          {session?.user?.name && (
+            <span className="hidden px-2 text-xs text-fg/40 sm:inline">
+              {session.user.name}
+            </span>
+          )}
+          <SignOutButton action={signOutAction} />
         </nav>
       </div>
     </header>
diff --git a/components/run-metric-chart.tsx b/components/run-metric-chart.tsx
index e0c1b00..220ff87 100644
--- a/components/run-metric-chart.tsx
+++ b/components/run-metric-chart.tsx
@@ -20,6 +20,8 @@ type Props = {
   color?: string;
   referenceLine?: number;
   decimals?: number;
+  format?: "pace";
+  reversed?: boolean;
 };
 
 export function RunMetricChart({
@@ -29,6 +31,8 @@ export function RunMetricChart({
   color = "var(--color-accent)",
   referenceLine,
   decimals = 0,
+  format,
+  reversed = false,
 }: Props) {
   const uid = useId();
   const gradId = `grad-${uid.replace(/:/g, "")}`;
@@ -43,8 +47,14 @@ export function RunMetricChart({
   const min = Math.min(...values);
   const max = Math.max(...values);
   const pad = Math.max(1, Math.round((max - min) * 0.15));
-  const fmt = (v: number) =>
-    decimals > 0 ? `${Number(v).toFixed(decimals)} ${unit}` : `${Math.round(v)} ${unit}`;
+  const fmt = (v: number) => {
+    if (format === "pace") {
+      const m = Math.floor(v / 60);
+      const s = Math.round(v % 60);
+      return `${m}:${s.toString().padStart(2, "0")} /km`;
+    }
+    return decimals > 0 ? `${Number(v).toFixed(decimals)} ${unit}` : `${Math.round(v)} ${unit}`;
+  };
 
   return (
     <div className="rounded-lg border border-muted/40 bg-surface p-4">
@@ -72,7 +82,8 @@ export function RunMetricChart({
             fontSize={11}
             width={50}
             tickFormatter={fmt}
-            domain={[min - pad, max + pad]}
+            domain={reversed ? [max + pad, min - pad] : [min - pad, max + pad]}
+            reversed={reversed}
           />
           <Tooltip
             contentStyle={{
diff --git a/components/sign-out-button.tsx b/components/sign-out-button.tsx
new file mode 100644
index 0000000..851ac93
--- /dev/null
+++ b/components/sign-out-button.tsx
@@ -0,0 +1,18 @@
+"use client";
+
+import { LogOut } from "lucide-react";
+
+export function SignOutButton({ action }: { action: () => Promise<void> }) {
+  return (
+    <form action={action}>
+      <button
+        type="submit"
+        className="flex items-center gap-1.5 rounded-md px-2.5 py-1.5 text-sm font-medium text-fg/80 transition-colors hover:bg-bg hover:text-accent sm:px-3"
+        title="Wyloguj się"
+      >
+        <LogOut size={16} />
+        <span className="hidden sm:inline">Wyloguj</span>
+      </button>
+    </form>
+  );
+}
diff --git a/lib/ai/claude.ts b/lib/ai/claude.ts
index e183789..8f4a8a1 100644
--- a/lib/ai/claude.ts
+++ b/lib/ai/claude.ts
@@ -28,9 +28,15 @@ Jeśli podano dane z poprzednich treningów, odnieś się do progresu (np. zmian
 type PreviousRun = { run: RunningActivity; analysis: AiAnalysis | null };
 type PreviousWorkout = { workout: StrengthWorkout; analysis: AiAnalysis | null };
 
+function secToMinKm(sec: number): string {
+  const m = Math.floor(sec / 60);
+  const s = Math.round(sec % 60);
+  return `${m}:${s.toString().padStart(2, "0")} min/km`;
+}
+
 function buildRunMetricsSummary(metrics: RunMetrics, totalDistanceM: number): string[] {
-  const { distanceKm, hrBpm, gcbLeftPct } = metrics;
-  if (!hrBpm && !gcbLeftPct) return [];
+  const { distanceKm, hrBpm, gcbLeftPct, paceSec } = metrics;
+  if (!hrBpm && !gcbLeftPct && !paceSec) return [];
   const n = distanceKm.length;
   if (n < 8) return [];
 
@@ -60,6 +66,11 @@ function buildRunMetricsSummary(metrics: RunMetrics, totalDistanceM: number): st
       const a = avg(vals);
       if (a !== null) parts.push(`HR śr. ${a} bpm`);
     }
+    if (paceSec) {
+      const vals = idx.map((i) => paceSec[i]).filter((v) => v > 0 && v < 1800);
+      const a = avg(vals);
+      if (a !== null) parts.push(`tempo śr. ${secToMinKm(a)}`);
+    }
     if (gcbLeftPct) {
       const vals = idx.map((i) => gcbLeftPct[i]).filter((v) => v > 0);
       if (vals.length > 0) {
@@ -184,6 +195,7 @@ function parseAnalysisResponse(text: string): { summary: string; tips: string[]
 }
 
 export async function generateAnalysis(
+  userId: string,
   targetType: AiAnalysisTargetType,
   targetId: string
 ): Promise<AiAnalysis> {
@@ -194,28 +206,28 @@ export async function generateAnalysis(
 
   let prompt: string;
   if (targetType === "running") {
-    const activity = await getRunningActivity(targetId);
+    const activity = await getRunningActivity(userId, targetId);
     if (!activity) throw new Error("Nie znaleziono biegu.");
-    const previousRuns = (await listRunningActivities())
+    const previousRuns = (await listRunningActivities(userId))
       .filter((run) => run.startTime < activity.startTime)
       .slice(0, PREVIOUS_RUNS_LIMIT);
     const previousRunsWithAnalysis: PreviousRun[] = await Promise.all(
       previousRuns.map(async (run) => ({
         run,
-        analysis: await getLatestAnalysisForTarget("running", run._id),
+        analysis: await getLatestAnalysisForTarget(userId, "running", run._id),
       }))
     );
     prompt = buildRunningPrompt(activity, previousRunsWithAnalysis);
   } else {
-    const workout = await getStrengthWorkout(targetId);
+    const workout = await getStrengthWorkout(userId, targetId);
     if (!workout) throw new Error("Nie znaleziono treningu.");
-    const previousWorkouts = (await listStrengthWorkouts())
+    const previousWorkouts = (await listStrengthWorkouts(userId))
       .filter((previous) => previous.date < workout.date)
       .slice(0, PREVIOUS_WORKOUTS_LIMIT);
     const previousWorkoutsWithAnalysis: PreviousWorkout[] = await Promise.all(
       previousWorkouts.map(async (previous) => ({
         workout: previous,
-        analysis: await getLatestAnalysisForTarget("strength", previous._id),
+        analysis: await getLatestAnalysisForTarget(userId, "strength", previous._id),
       }))
     );
     prompt = buildStrengthPrompt(workout, previousWorkoutsWithAnalysis);
@@ -234,6 +246,7 @@ export async function generateAnalysis(
   const { summary, tips } = parseAnalysisResponse(text);
 
   return saveAiAnalysis({
+    userId,
     targetType,
     targetId: new ObjectId(targetId),
     summary,
@@ -332,18 +345,18 @@ function buildDashboardPrompt(
   return lines.join("\n");
 }
 
-export async function generateDashboardAnalysis(): Promise<AiAnalysis> {
+export async function generateDashboardAnalysis(userId: string): Promise<AiAnalysis> {
   const apiKey = process.env.ANTHROPIC_API_KEY;
   if (!apiKey) throw new Error("Brak klucza ANTHROPIC_API_KEY w konfiguracji.");
 
   const [runs, workouts] = await Promise.all([
-    listRunningActivities().then((r) => r.slice(0, DASHBOARD_RUNS_LIMIT)),
-    listStrengthWorkouts().then((w) => w.slice(0, DASHBOARD_WORKOUTS_LIMIT)),
+    listRunningActivities(userId).then((r) => r.slice(0, DASHBOARD_RUNS_LIMIT)),
+    listStrengthWorkouts(userId).then((w) => w.slice(0, DASHBOARD_WORKOUTS_LIMIT)),
   ]);
 
   let wellness: DayWellness[] = [];
   try {
-    const garminClient = await getAuthorizedClient();
+    const garminClient = await getAuthorizedClient(userId);
     wellness = await fetchRecentWellness(garminClient, DASHBOARD_WELLNESS_DAYS);
   } catch {
     // Wellness data not available, proceed without it
@@ -361,5 +374,5 @@ export async function generateDashboardAnalysis(): Promise<AiAnalysis> {
   const textBlock = message.content.find((b) => b.type === "text");
   const text = textBlock && textBlock.type === "text" ? textBlock.text : "";
   const { summary, tips } = parseAnalysisResponse(text);
-  return saveDashboardAnalysis(summary, tips, model);
+  return saveDashboardAnalysis(userId, summary, tips, model);
 }
diff --git a/lib/garmin/client.ts b/lib/garmin/client.ts
index c44462f..4249cbb 100644
--- a/lib/garmin/client.ts
+++ b/lib/garmin/client.ts
@@ -2,7 +2,7 @@ import { GarminConnect } from "garmin-connect";
 import type { IActivity } from "garmin-connect/dist/garmin/types/activity";
 import type { IOauth1Token } from "garmin-connect/dist/garmin/types";
 import type { RoutePoint, RunMetrics, RunningActivityInput } from "@/lib/models/running";
-import { getSavedOauth1Token } from "@/lib/models/garmin-auth";
+import { getGarminCredentials, getSavedOauth1Token } from "@/lib/models/garmin-auth";
 import { completeMfaAndGetTicket, loginAndGetTicket, type GarminPendingMfa } from "@/lib/garmin/sso";
 
 const FETCH_LIMIT = 50;
@@ -13,6 +13,12 @@ export class GarminLoginRequiredError extends Error {
   }
 }
 
+export class GarminCredentialsMissingError extends Error {
+  constructor() {
+    super("Brak danych logowania do Garmin Connect. Skonfiguruj je w Ustawieniach.");
+  }
+}
+
 function parseGarminDate(value: string): Date {
   return new Date(`${value.replace(" ", "T")}Z`);
 }
@@ -154,7 +160,6 @@ export async function fetchActivityRunMetrics(
   const step = Math.max(1, Math.floor(rows.length / MAX));
   const sampled = rows.filter((_, i) => i % step === 0 || i === rows.length - 1);
 
-  // Try several known Garmin distance metric keys
   const distKey = ["directDistance", "sumDistance", "directCumulativeDistance"].find(
     (k) => sampled.some((row) => get(row, k) !== null && get(row, k)! > 0)
   );
@@ -172,24 +177,21 @@ export async function fetchActivityRunMetrics(
     return values.some((v) => v > 0) ? values : undefined;
   };
 
+  const speedSeries = series("directSpeed", 3);
+  const paceSec = speedSeries
+    ? speedSeries.map((v) => (v > 0.5 ? Math.round(1000 / v) : 0))
+    : undefined;
+
   return {
     distanceKm,
     hrBpm: series("directHeartRate"),
     cadenceSpm: series("directDoubleCadence"),
     gctMs: series("directGroundContactTime"),
     gcbLeftPct: series("directGroundContactBalanceLeft", 1),
+    paceSec,
   };
 }
 
-function getCredentials(): { username: string; password: string } {
-  const username = process.env.GARMIN_EMAIL;
-  const password = process.env.GARMIN_PASSWORD;
-  if (!username || !password) {
-    throw new Error("Brak danych logowania do Garmin Connect (GARMIN_EMAIL / GARMIN_PASSWORD).");
-  }
-  return { username, password };
-}
-
 async function exchangeOauth1Token(client: GarminConnect, oauth1Token: IOauth1Token): Promise<void> {
   const http = client.client;
   if (!http.OAUTH_CONSUMER) {
@@ -205,12 +207,8 @@ async function exchangeOauth1Token(client: GarminConnect, oauth1Token: IOauth1To
   await http.exchange({ oauth, token: oauth1Token });
 }
 
-/**
- * Returns a client authenticated using a previously saved OAuth1 token
- * (long-lived, survives across syncs) - no MFA needed if it's still valid.
- */
-export async function getAuthorizedClient(): Promise<GarminConnect> {
-  const saved = await getSavedOauth1Token();
+export async function getAuthorizedClient(userId: string): Promise<GarminConnect> {
+  const saved = await getSavedOauth1Token(userId);
   if (!saved) {
     throw new GarminLoginRequiredError();
   }
@@ -232,16 +230,16 @@ async function establishClientFromTicket(ticket: string): Promise<{ client: Garm
   return { client, oauth1Token: oauth1.token };
 }
 
-/**
- * Starts a fresh SSO login using env credentials. If the account requires
- * MFA, returns the pending state needed to complete it via
- * `completeGarminMfaLogin` once the user supplies the emailed code.
- */
-export async function beginGarminLogin(): Promise<
-  { client: GarminConnect; oauth1Token: IOauth1Token } | { mfaRequired: true; pendingState: GarminPendingMfa }
+export async function beginGarminLogin(
+  userId: string
+): Promise<
+  | { client: GarminConnect; oauth1Token: IOauth1Token }
+  | { mfaRequired: true; pendingState: GarminPendingMfa }
 > {
-  const { username, password } = getCredentials();
-  const result = await loginAndGetTicket(username, password);
+  const creds = await getGarminCredentials(userId);
+  if (!creds) throw new GarminCredentialsMissingError();
+
+  const result = await loginAndGetTicket(creds.email, creds.password);
   if ("mfaRequired" in result) return result;
   return establishClientFromTicket(result.ticket);
 }
@@ -254,14 +252,7 @@ export async function completeGarminMfaLogin(
   return establishClientFromTicket(ticket);
 }
 
-/**
- * Returns all recent running activities (mapped), regardless of `since` -
- * callers should upsert all of them so previously-synced activities get
- * backfilled with newly added metric fields, but can use `since` to decide
- * which ones are "new" for reporting purposes.
- */
 export async function fetchRunningActivities(client: GarminConnect): Promise<RunningActivityInput[]> {
   const activities = await client.getActivities(0, FETCH_LIMIT);
-
   return activities.filter(isRunningActivity).map(mapActivity);
 }
diff --git a/lib/models/analysis.ts b/lib/models/analysis.ts
index 6b1eace..6471f01 100644
--- a/lib/models/analysis.ts
+++ b/lib/models/analysis.ts
@@ -4,6 +4,7 @@ import { getDb } from "@/lib/db";
 export type AiAnalysisTargetType = "running" | "strength" | "dashboard";
 
 export type AiAnalysisInput = {
+  userId: string;
   targetType: AiAnalysisTargetType;
   targetId: ObjectId;
   summary: string;
@@ -40,6 +41,8 @@ export function serializeAnalysis(analysis: AiAnalysis): SerializedAiAnalysis {
 
 const COLLECTION = "ai_analyses";
 
+const DASHBOARD_TARGET_ID = new ObjectId("000000000000000000000001");
+
 async function getCollection() {
   const db = await getDb();
   return db.collection<AiAnalysis>(COLLECTION);
@@ -53,32 +56,34 @@ export async function saveAiAnalysis(input: AiAnalysisInput): Promise<AiAnalysis
 }
 
 export async function getLatestAnalysisForTarget(
+  userId: string,
   targetType: AiAnalysisTargetType,
   targetId: ObjectId
 ): Promise<AiAnalysis | null> {
   const collection = await getCollection();
-  return collection.findOne({ targetType, targetId }, { sort: { createdAt: -1 } });
+  return collection.findOne({ userId, targetType, targetId }, { sort: { createdAt: -1 } });
 }
 
-export async function getLatestAnalysis(): Promise<AiAnalysis | null> {
-  const collection = await getCollection();
-  return collection.findOne({}, { sort: { createdAt: -1 } });
-}
-
-const DASHBOARD_TARGET_ID = new ObjectId("000000000000000000000001");
-
-export async function getDashboardAnalysis(): Promise<AiAnalysis | null> {
+export async function getDashboardAnalysis(userId: string): Promise<AiAnalysis | null> {
   const collection = await getCollection();
   return collection.findOne(
-    { targetType: "dashboard", targetId: DASHBOARD_TARGET_ID },
+    { userId, targetType: "dashboard", targetId: DASHBOARD_TARGET_ID },
     { sort: { createdAt: -1 } }
   );
 }
 
 export async function saveDashboardAnalysis(
+  userId: string,
   summary: string,
   tips: string[],
   model: string
 ): Promise<AiAnalysis> {
-  return saveAiAnalysis({ targetType: "dashboard", targetId: DASHBOARD_TARGET_ID, summary, tips, model });
+  return saveAiAnalysis({
+    userId,
+    targetType: "dashboard",
+    targetId: DASHBOARD_TARGET_ID,
+    summary,
+    tips,
+    model,
+  });
 }
diff --git a/lib/models/garmin-auth.ts b/lib/models/garmin-auth.ts
index 67f3954..31edaac 100644
--- a/lib/models/garmin-auth.ts
+++ b/lib/models/garmin-auth.ts
@@ -4,37 +4,61 @@ import type { GarminPendingMfa } from "@/lib/garmin/sso";
 
 const AUTH_COLLECTION = "garmin_auth";
 const PENDING_COLLECTION = "garmin_login_pending";
+const CREDENTIALS_COLLECTION = "garmin_credentials";
 
-type GarminAuthDoc = { _id: "tokens"; oauth1Token: IOauth1Token; updatedAt: Date };
-type GarminPendingDoc = { _id: "pending"; state: GarminPendingMfa; createdAt: Date };
+type GarminAuthDoc = { _id: string; oauth1Token: IOauth1Token; updatedAt: Date };
+type GarminPendingDoc = { _id: string; state: GarminPendingMfa; createdAt: Date };
+type GarminCredentialsDoc = { _id: string; email: string; password: string };
 
-export async function getSavedOauth1Token(): Promise<IOauth1Token | null> {
+export async function getSavedOauth1Token(userId: string): Promise<IOauth1Token | null> {
   const db = await getDb();
-  const doc = await db.collection<GarminAuthDoc>(AUTH_COLLECTION).findOne({ _id: "tokens" });
+  const doc = await db.collection<GarminAuthDoc>(AUTH_COLLECTION).findOne({ _id: userId });
   return doc?.oauth1Token ?? null;
 }
 
-export async function saveOauth1Token(oauth1Token: IOauth1Token): Promise<void> {
+export async function saveOauth1Token(userId: string, oauth1Token: IOauth1Token): Promise<void> {
   const db = await getDb();
   await db
     .collection<GarminAuthDoc>(AUTH_COLLECTION)
-    .updateOne({ _id: "tokens" }, { $set: { oauth1Token, updatedAt: new Date() } }, { upsert: true });
+    .updateOne({ _id: userId }, { $set: { oauth1Token, updatedAt: new Date() } }, { upsert: true });
 }
 
-export async function savePendingMfaState(state: GarminPendingMfa): Promise<void> {
+export async function savePendingMfaState(userId: string, state: GarminPendingMfa): Promise<void> {
   const db = await getDb();
   await db
     .collection<GarminPendingDoc>(PENDING_COLLECTION)
-    .updateOne({ _id: "pending" }, { $set: { state, createdAt: new Date() } }, { upsert: true });
+    .updateOne({ _id: userId }, { $set: { state, createdAt: new Date() } }, { upsert: true });
 }
 
-export async function getPendingMfaState(): Promise<GarminPendingMfa | null> {
+export async function getPendingMfaState(userId: string): Promise<GarminPendingMfa | null> {
   const db = await getDb();
-  const doc = await db.collection<GarminPendingDoc>(PENDING_COLLECTION).findOne({ _id: "pending" });
+  const doc = await db.collection<GarminPendingDoc>(PENDING_COLLECTION).findOne({ _id: userId });
   return doc?.state ?? null;
 }
 
-export async function clearPendingMfaState(): Promise<void> {
+export async function clearPendingMfaState(userId: string): Promise<void> {
   const db = await getDb();
-  await db.collection<GarminPendingDoc>(PENDING_COLLECTION).deleteOne({ _id: "pending" });
+  await db.collection<GarminPendingDoc>(PENDING_COLLECTION).deleteOne({ _id: userId });
+}
+
+export async function getGarminCredentials(
+  userId: string
+): Promise<{ email: string; password: string } | null> {
+  const db = await getDb();
+  const doc = await db
+    .collection<GarminCredentialsDoc>(CREDENTIALS_COLLECTION)
+    .findOne({ _id: userId });
+  if (!doc) return null;
+  return { email: doc.email, password: doc.password };
+}
+
+export async function saveGarminCredentials(
+  userId: string,
+  email: string,
+  password: string
+): Promise<void> {
+  const db = await getDb();
+  await db
+    .collection<GarminCredentialsDoc>(CREDENTIALS_COLLECTION)
+    .updateOne({ _id: userId }, { $set: { email, password } }, { upsert: true });
 }
diff --git a/lib/models/running.ts b/lib/models/running.ts
index 2a33042..f45a19a 100644
--- a/lib/models/running.ts
+++ b/lib/models/running.ts
@@ -40,10 +40,12 @@ export type RunMetrics = {
   cadenceSpm?: number[];
   gctMs?: number[];
   gcbLeftPct?: number[];
+  paceSec?: number[];
 };
 
 export type RunningActivity = RunningActivityInput & {
   _id: ObjectId;
+  userId: string;
   createdAt: Date;
   routePoints?: RoutePoint[];
   elevationProfile?: number[];
@@ -56,60 +58,73 @@ const SYNC_STATE_COLLECTION = "sync_state";
 async function getCollection() {
   const db = await getDb();
   const collection = db.collection<RunningActivity>(COLLECTION);
-  await collection.createIndex({ garminActivityId: 1 }, { unique: true });
+  await collection.createIndex({ userId: 1, garminActivityId: 1 }, { unique: true });
   return collection;
 }
 
-export async function upsertRunningActivity(activity: RunningActivityInput): Promise<void> {
+export async function upsertRunningActivity(
+  userId: string,
+  activity: RunningActivityInput
+): Promise<void> {
   const collection = await getCollection();
   await collection.updateOne(
-    { garminActivityId: activity.garminActivityId },
+    { userId, garminActivityId: activity.garminActivityId },
     {
-      $set: activity,
+      $set: { ...activity, userId },
       $setOnInsert: { createdAt: new Date() },
     },
     { upsert: true }
   );
 }
 
-export async function listRunningActivities(): Promise<RunningActivity[]> {
+export async function listRunningActivities(userId: string): Promise<RunningActivity[]> {
   const collection = await getCollection();
-  return collection.find().sort({ startTime: -1 }).toArray();
+  return collection.find({ userId }).sort({ startTime: -1 }).toArray();
 }
 
-export async function getRunningActivity(id: string): Promise<RunningActivity | null> {
+export async function getRunningActivity(
+  userId: string,
+  id: string
+): Promise<RunningActivity | null> {
   const collection = await getCollection();
-  return collection.findOne({ _id: new ObjectId(id) });
+  return collection.findOne({ _id: new ObjectId(id), userId });
 }
 
 export async function setRunningActivityMetrics(
+  userId: string,
   garminActivityId: number,
   metrics: RunMetrics
 ): Promise<void> {
   const collection = await getCollection();
-  await collection.updateOne({ garminActivityId }, { $set: { runMetrics: metrics } });
+  await collection.updateOne({ userId, garminActivityId }, { $set: { runMetrics: metrics } });
 }
 
 export async function setRunningActivityRoutePoints(
+  userId: string,
   garminActivityId: number,
   points: RoutePoint[],
   elevationProfile: number[]
 ): Promise<void> {
   const collection = await getCollection();
-  await collection.updateOne({ garminActivityId }, { $set: { routePoints: points, elevationProfile } });
+  await collection.updateOne(
+    { userId, garminActivityId },
+    { $set: { routePoints: points, elevationProfile } }
+  );
 }
 
-type SyncState = { _id: "garmin"; lastSyncAt: Date };
+type SyncState = { _id: string; lastSyncAt: Date };
 
-export async function getLastSyncAt(): Promise<Date | null> {
+export async function getLastSyncAt(userId: string): Promise<Date | null> {
   const db = await getDb();
-  const state = await db.collection<SyncState>(SYNC_STATE_COLLECTION).findOne({ _id: "garmin" });
+  const state = await db
+    .collection<SyncState>(SYNC_STATE_COLLECTION)
+    .findOne({ _id: userId });
   return state?.lastSyncAt ?? null;
 }
 
-export async function setLastSyncAt(date: Date): Promise<void> {
+export async function setLastSyncAt(userId: string, date: Date): Promise<void> {
   const db = await getDb();
   await db
     .collection<SyncState>(SYNC_STATE_COLLECTION)
-    .updateOne({ _id: "garmin" }, { $set: { lastSyncAt: date } }, { upsert: true });
+    .updateOne({ _id: userId }, { $set: { lastSyncAt: date } }, { upsert: true });
 }
diff --git a/lib/models/strength.ts b/lib/models/strength.ts
index 409744f..bce1a5d 100644
--- a/lib/models/strength.ts
+++ b/lib/models/strength.ts
@@ -29,6 +29,7 @@ export type StrengthWorkoutInput = z.infer<typeof strengthWorkoutSchema>;
 
 export type StrengthWorkout = StrengthWorkoutInput & {
   _id: ObjectId;
+  userId: string;
   createdAt: Date;
 };
 
@@ -37,30 +38,34 @@ const COLLECTION = "strength_workouts";
 async function getCollection() {
   const db = await getDb();
   const collection = db.collection<StrengthWorkout>(COLLECTION);
-  await collection.createIndex({ sourceKey: 1 }, { unique: true });
+  await collection.createIndex({ userId: 1, sourceKey: 1 }, { unique: true });
   return collection;
 }
 
 export async function upsertStrengthWorkout(
+  userId: string,
   workout: StrengthWorkoutInput
 ): Promise<void> {
   const collection = await getCollection();
   await collection.updateOne(
-    { sourceKey: workout.sourceKey },
+    { userId, sourceKey: workout.sourceKey },
     {
-      $set: workout,
+      $set: { ...workout, userId },
       $setOnInsert: { createdAt: new Date() },
     },
     { upsert: true }
   );
 }
 
-export async function listStrengthWorkouts(): Promise<StrengthWorkout[]> {
+export async function listStrengthWorkouts(userId: string): Promise<StrengthWorkout[]> {
   const collection = await getCollection();
-  return collection.find().sort({ date: -1 }).toArray();
+  return collection.find({ userId }).sort({ date: -1 }).toArray();
 }
 
-export async function getStrengthWorkout(id: string): Promise<StrengthWorkout | null> {
+export async function getStrengthWorkout(
+  userId: string,
+  id: string
+): Promise<StrengthWorkout | null> {
   const collection = await getCollection();
-  return collection.findOne({ _id: new ObjectId(id) });
+  return collection.findOne({ _id: new ObjectId(id), userId });
 }
diff --git a/lib/session.ts b/lib/session.ts
new file mode 100644
index 0000000..c4d51ac
--- /dev/null
+++ b/lib/session.ts
@@ -0,0 +1,8 @@
+import { auth } from "@/auth";
+
+export async function getCurrentUserId(): Promise<string> {
+  const session = await auth();
+  const id = session?.user?.id;
+  if (!id) throw new Error("Użytkownik nie jest zalogowany.");
+  return id;
+}
diff --git a/middleware.ts b/middleware.ts
new file mode 100644
index 0000000..bbed6e0
--- /dev/null
+++ b/middleware.ts
@@ -0,0 +1,23 @@
+import { auth } from "@/auth";
+import { NextResponse } from "next/server";
+
+export default auth((req) => {
+  const isAuthenticated = !!req.auth;
+  const { pathname } = req.nextUrl;
+
+  if (!isAuthenticated && pathname !== "/login") {
+    return NextResponse.redirect(new URL("/login", req.url));
+  }
+
+  if (isAuthenticated && pathname === "/login") {
+    return NextResponse.redirect(new URL("/", req.url));
+  }
+
+  return NextResponse.next();
+});
+
+export const config = {
+  matcher: [
+    "/((?!api/auth|_next/static|_next/image|favicon.ico|icon.svg|logo.svg|public/).*)",
+  ],
+};
diff --git a/package.json b/package.json
index 8e563b9..f08aa18 100644
--- a/package.json
+++ b/package.json
@@ -18,6 +18,7 @@
     "lucide-react": "^1.18.0",
     "mongodb": "^7.3.0",
     "next": "16.2.9",
+    "next-auth": "5.0.0-beta.31",
     "react": "19.2.4",
     "react-dom": "19.2.4",
     "react-leaflet": "^5.0.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5b8f32a..0715565 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -35,6 +35,9 @@ importers:
       next:
         specifier: 16.2.9
         version: 16.2.9(@babel/core@7.29.7)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      next-auth:
+        specifier: 5.0.0-beta.31
+        version: 5.0.0-beta.31(next@16.2.9(@babel/core@7.29.7)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)
       react:
         specifier: 19.2.4
         version: 19.2.4
@@ -91,6 +94,20 @@ packages:
       zod:
         optional: true
 
+  '@auth/core@0.41.2':
+    resolution: {integrity: sha512-Hx5MNBxN2fJTbJKGUKAA0wca43D0Akl3TvufY54Gn8lop7F+34vU1zA1pn0vQfIoVuLIrpfc2nkyjwIaPJMW7w==}
+    peerDependencies:
+      '@simplewebauthn/browser': ^9.0.1
+      '@simplewebauthn/server': ^9.0.2
+      nodemailer: ^7.0.7
+    peerDependenciesMeta:
+      '@simplewebauthn/browser':
+        optional: true
+      '@simplewebauthn/server':
+        optional: true
+      nodemailer:
+        optional: true
+
   '@babel/code-frame@7.29.7':
     resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
     engines: {node: '>=6.9.0'}
@@ -464,6 +481,9 @@ packages:
     resolution: {integrity: sha512-nn5ozdjYQpUCZlWGuxcJY/KpxkWQs4DcbMCmKojjyrYDEAGy4Ce19NN4v5MduafTwJlbKc99UA8YhSVqq9yPZA==}
     engines: {node: '>=12.4.0'}
 
+  '@panva/hkdf@1.2.1':
+    resolution: {integrity: sha512-6oclG6Y3PiDFcoyk8srjLfVKyMfVCKJ27JwNPViuXziFpmdz+MZnZN/aKY0JGXgYuO/VghU0jcOAZgWXZ1Dmrw==}
+
   '@react-leaflet/core@3.0.0':
     resolution: {integrity: sha512-3EWmekh4Nz+pGcr+xjf0KNyYfC3U2JjnkWsh0zcqaexYqmmB5ZhH37kz41JXGmKzpaMZCnPofBBm64i+YrEvGQ==}
     peerDependencies:
@@ -1598,6 +1618,9 @@ packages:
     resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
     hasBin: true
 
+  jose@6.2.3:
+    resolution: {integrity: sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==}
+
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
@@ -1832,6 +1855,22 @@ packages:
   natural-compare@1.4.0:
     resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
 
+  next-auth@5.0.0-beta.31:
+    resolution: {integrity: sha512-1OBgCKPzo+S7UWWMp3xgvGvIJ0OpV7B3vR4ZDRqD9a4Ch+OT6dakLXG9ivhtmIWVa71nTSXattOHyCg8sNi8/Q==}
+    peerDependencies:
+      '@simplewebauthn/browser': ^9.0.1
+      '@simplewebauthn/server': ^9.0.2
+      next: ^14.0.0-0 || ^15.0.0 || ^16.0.0
+      nodemailer: ^7.0.7
+      react: ^18.2.0 || ^19.0.0
+    peerDependenciesMeta:
+      '@simplewebauthn/browser':
+        optional: true
+      '@simplewebauthn/server':
+        optional: true
+      nodemailer:
+        optional: true
+
   next@16.2.9:
     resolution: {integrity: sha512-MEOJiq/UvuezAdqVSceHbqDgZt1kDw2tpGVOlsdIoJsQdbN2JY2hpVG4xnXGkbdJUOEWhnRfiu/O4Hpc9Juwww==}
     engines: {node: '>=20.9.0'}
@@ -1864,6 +1903,9 @@ packages:
   oauth-1.0a@2.2.6:
     resolution: {integrity: sha512-6bkxv3N4Gu5lty4viIcIAnq5GbxECviMBeKR3WX/q87SPQ8E8aursPZUtsXDnxCs787af09WPRBLqYrf/lwoYQ==}
 
+  oauth4webapi@3.8.6:
+    resolution: {integrity: sha512-iwemM91xz8nryHti2yTmg5fhyEMVOkOXwHNqbvcATjyajb5oQxCQzrNOA6uElRHuMhQQTKUyFKV9y/CNyg25BQ==}
+
   object-assign@4.1.1:
     resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
     engines: {node: '>=0.10.0'}
@@ -1950,6 +1992,14 @@ packages:
     resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==}
     engines: {node: ^10 || ^12 || >=14}
 
+  preact-render-to-string@6.5.11:
+    resolution: {integrity: sha512-ubnauqoGczeGISiOh6RjX0/cdaF8v/oDXIjO85XALCQjwQP+SB4RDXXtvZ6yTYSjG+PC1QRP2AhPgCEsM2EvUw==}
+    peerDependencies:
+      preact: '>=10'
+
+  preact@10.24.3:
+    resolution: {integrity: sha512-Z2dPnBnMUfyQfSQ+GBdsGa16hz35YmLmtTLhM169uW944hYL6xzTYkJjC07j+Wosz733pMWx0fgON3JNw1jJQA==}
+
   prelude-ls@1.2.1:
     resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
     engines: {node: '>= 0.8.0'}
@@ -2338,6 +2388,14 @@ snapshots:
     optionalDependencies:
       zod: 4.4.3
 
+  '@auth/core@0.41.2':
+    dependencies:
+      '@panva/hkdf': 1.2.1
+      jose: 6.2.3
+      oauth4webapi: 3.8.6
+      preact: 10.24.3
+      preact-render-to-string: 6.5.11(preact@10.24.3)
+
   '@babel/code-frame@7.29.7':
     dependencies:
       '@babel/helper-validator-identifier': 7.29.7
@@ -2694,6 +2752,8 @@ snapshots:
 
   '@nolyfill/is-core-module@1.0.39': {}
 
+  '@panva/hkdf@1.2.1': {}
+
   '@react-leaflet/core@3.0.0(leaflet@1.9.4)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
       leaflet: 1.9.4
@@ -3969,6 +4029,8 @@ snapshots:
 
   jiti@2.7.0: {}
 
+  jose@6.2.3: {}
+
   js-tokens@4.0.0: {}
 
   js-yaml@4.2.0:
@@ -4139,6 +4201,12 @@ snapshots:
 
   natural-compare@1.4.0: {}
 
+  next-auth@5.0.0-beta.31(next@16.2.9(@babel/core@7.29.7)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4):
+    dependencies:
+      '@auth/core': 0.41.2
+      next: 16.2.9(@babel/core@7.29.7)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+
   next@16.2.9(@babel/core@7.29.7)(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
     dependencies:
       '@next/env': 16.2.9
@@ -4174,6 +4242,8 @@ snapshots:
 
   oauth-1.0a@2.2.6: {}
 
+  oauth4webapi@3.8.6: {}
+
   object-assign@4.1.1: {}
 
   object-inspect@1.13.4: {}
@@ -4269,6 +4339,12 @@ snapshots:
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
+  preact-render-to-string@6.5.11(preact@10.24.3):
+    dependencies:
+      preact: 10.24.3
+
+  preact@10.24.3: {}
+
   prelude-ls@1.2.1: {}
 
   prop-types@15.8.1:
diff --git a/types/next-auth.d.ts b/types/next-auth.d.ts
new file mode 100644
index 0000000..04401ae
--- /dev/null
+++ b/types/next-auth.d.ts
@@ -0,0 +1,16 @@
+import "next-auth";
+import "next-auth/jwt";
+
+declare module "next-auth" {
+  interface Session {
+    idToken?: string;
+  }
+}
+
+declare module "next-auth/jwt" {
+  interface JWT {
+    keycloakId?: string;
+    idToken?: string;
+    accessToken?: string;
+  }
+}