julian
64d5e45f11
Replace the dev-only token shim with real authentication. Backend: - @fastify/cookie; JWT carried in an HttpOnly + SameSite=Strict cookie (parking_token), read from the cookie not the Authorization header. - Double-submit CSRF: readable parking_csrf cookie + X-CSRF-Token header, both cross-checked against a csrf claim baked into the JWT; enforced on mutations. - Routes: POST /api/auth/login (bcrypt, constant-time-ish), POST logout, GET me. requireRole now verifies the cookie + CSRF + role. - seed-admin script (pnpm --filter @parking/server seed-admin) for the first admin; no bootstrap endpoint. - Removed SETUP_AUTH_BYPASS and catalog.authBypass entirely; setup endpoints use the cookie admin guard like everything else. Frontend: - apiFetch wrapper: credentials:'include' + X-CSRF-Token on mutations. - Login form; App gates on /api/auth/me and only shows setup to admins; logout. - Wizard token field removed (auth is the session cookie). Deploy: - deploy/nginx.conf: prod reverse proxy, SPA + /api same-origin, TLS, so the Secure cookies work. Dev stays same-origin via the Vite proxy. Verified (curl + browser): wrong pass -> 401; login sets cookies; me -> admin; assign without CSRF -> 403, with -> 201; no cookie -> 401; session persists across reload. wiki/local-jwt-auth updated.
21 lines
814 B
Bash
21 lines
814 B
Bash
# Copy this file to `.env` (same folder: apps/server/.env) and fill it in.
|
|
# The dev/start scripts load it automatically via Node's --env-file-if-exists.
|
|
#
|
|
# cp apps/server/.env.example apps/server/.env
|
|
#
|
|
# Required ----------------------------------------------------------------
|
|
# The server refuses to start without a strong JWT_SECRET (>=32 chars).
|
|
# Generate one with: openssl rand -hex 32
|
|
JWT_SECRET=
|
|
|
|
# Optional ----------------------------------------------------------------
|
|
# PORT=3000
|
|
# HOST=0.0.0.0 # interface to bind. 127.0.0.1 = loopback only.
|
|
# LOG_LEVEL=info
|
|
# DATABASE_URL=./parking.sqlite
|
|
# NODE_ENV=production # set in prod: makes auth cookies Secure (HTTPS-only)
|
|
|
|
# First admin (seed once): pnpm --filter @parking/server seed-admin
|
|
# ADMIN_USER=admin
|
|
# ADMIN_PASS=
|