MichilisandClaude Opus 5
733d2459df
Replace the hand-rolled JWT auth with Better Auth 1.6.25 httpOnly cookie sessions, validated against the database on every request so revocation, bans and role changes take effect immediately. Backend: - betterAuth.ts wires the Drizzle adapter, magic links, Google sign-in and the admin plugin; auth-schema.ts maps Better Auth's models onto the existing `users` table so user IDs and their foreign keys survive intact. - routes/auth.ts is gone; Better Auth serves the standard endpoints and authExt.ts carries the flows it doesn't cover. - auth.ts shrinks to session resolution and helpers; sessions/revocation in dashboard.ts now read and delete `auth_sessions` rows directly. - Schema adds the Better Auth core + admin columns (email_verified, image, banned, ban_reason, ban_expires), with migrations and tests. - rateLimit.ts resolves client IPs spoof-resistantly: proxy headers are only honoured from loopback/RFC1918 peers plus TRUSTED_PROXIES. - passwordPolicy.ts centralises password validation. - Bump drizzle-orm, drizzle-kit and better-sqlite3 to versions compatible with Better Auth. Frontend: - auth-client.ts plus a reworked AuthContext and api/client.ts move to cookie-based sessions; no more bearer tokens in requests or middleware. photo-api: - Validate Better Auth session cookies against the shared auth_sessions table instead of verifying JWTs; JWT_SECRET is no longer needed for user auth, and PHOTO_VIEW_SECRET now signs gallery view tokens. BETTER_AUTH_SECRET and BETTER_AUTH_URL are required in production; the deprecated JWT_SECRET stays only as the photo-api view-token fallback. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
158 lines
6.3 KiB
Bash
158 lines
6.3 KiB
Bash
# Database Configuration
|
|
# Use 'sqlite' or 'postgres'
|
|
DB_TYPE=sqlite
|
|
|
|
# For SQLite (relative or absolute path)
|
|
DATABASE_URL=./data/spanglish.db
|
|
|
|
# For PostgreSQL
|
|
# DATABASE_URL=postgresql://user:password@localhost:5432/spanglish
|
|
|
|
# Max PostgreSQL connections per instance (default 10). When running multiple
|
|
# replicas, keep DB_POOL_MAX * replicas below the Postgres max_connections limit.
|
|
# DB_POOL_MAX=10
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Horizontal scaling (all optional)
|
|
# ---------------------------------------------------------------------------
|
|
# Leave everything below UNSET to run as a single instance with in-memory
|
|
# backends and local-disk uploads (zero-config, identical to the original
|
|
# behavior). Set them to run multiple API replicas behind a load balancer.
|
|
#
|
|
# Note: running more than one instance requires DB_TYPE=postgres. SQLite is a
|
|
# single local file and cannot be shared safely across instances.
|
|
|
|
# Redis connection URL. When set, the cache, rate limiter, login lockout,
|
|
# pub/sub (real-time payment events), distributed locks, and the email hourly
|
|
# cap are shared across all instances. When unset, each instance uses in-memory
|
|
# equivalents.
|
|
#
|
|
# In production always set a password (requirepass on the server) and put it in
|
|
# the URL. Use the rediss:// scheme for TLS (handled natively by the client),
|
|
# and an optional /N path to select a DB index when sharing a Redis instance
|
|
# with other applications.
|
|
# REDIS_URL=redis://localhost:6379
|
|
# REDIS_URL=redis://:your-redis-password@redis.internal:6379
|
|
# REDIS_URL=rediss://:your-redis-password@redis.example.com:6380/1
|
|
|
|
# Optional S3-compatible object storage for media uploads (e.g. Garage, MinIO,
|
|
# AWS S3). When S3_ENDPOINT and S3_BUCKET are set, uploads go to the bucket and
|
|
# are shared across instances. When unset, uploads are written to ./uploads on
|
|
# local disk (the default).
|
|
# S3_ENDPOINT=https://garage.example.com
|
|
# S3_REGION=garage
|
|
# S3_BUCKET=spanglish-media
|
|
# S3_ACCESS_KEY_ID=
|
|
# S3_SECRET_ACCESS_KEY=
|
|
# Public base URL used to build fileUrl for stored objects (CDN or web endpoint).
|
|
# If unset, a path-style URL against S3_ENDPOINT/S3_BUCKET is used.
|
|
# S3_PUBLIC_URL=https://media.example.com
|
|
# Use path-style addressing (true for Garage/MinIO). Defaults to true.
|
|
# S3_FORCE_PATH_STYLE=true
|
|
|
|
# Better Auth session secret. REQUIRED in production, 32+ characters.
|
|
# Generate one with: openssl rand -base64 48
|
|
# Rotating it signs everyone out (cookie signatures invalidate).
|
|
BETTER_AUTH_SECRET=
|
|
|
|
# Public site origin Better Auth builds its URLs against (falls back to
|
|
# FRONTEND_URL when unset). E.g. https://spanglishcommunity.com
|
|
BETTER_AUTH_URL=
|
|
|
|
# Extra reverse-proxy IP prefixes allowed to set X-Real-IP / X-Forwarded-For
|
|
# (comma-separated, e.g. "172.20."). Loopback and RFC1918 ranges are always
|
|
# trusted; anything else is treated as a client and rate-limited by its
|
|
# actual socket address.
|
|
# TRUSTED_PROXIES=
|
|
|
|
# DEPRECATED: no longer used for API auth (Better Auth replaced the JWTs).
|
|
# Still read by photo-api as the fallback secret for gallery view tokens
|
|
# until PHOTO_VIEW_SECRET is set there; safe to remove after that.
|
|
JWT_SECRET=your-super-secret-key-change-in-production
|
|
|
|
# Google OAuth (optional - for Google Sign-In)
|
|
# Get your Client ID from: https://console.cloud.google.com/apis/credentials
|
|
# Note: The same Client ID should be used in frontend/.env
|
|
GOOGLE_CLIENT_ID=
|
|
# Only needed for the redirect OAuth flow; the Google Identity Services
|
|
# button (ID token sign-in) works with the Client ID alone.
|
|
GOOGLE_CLIENT_SECRET=
|
|
|
|
# Server Configuration
|
|
PORT=3001
|
|
API_URL=http://localhost:3001
|
|
FRONTEND_URL=http://localhost:3019
|
|
|
|
# Revalidation secret (shared with frontend for on-demand cache revalidation)
|
|
# Must match the REVALIDATE_SECRET in frontend/.env
|
|
REVALIDATE_SECRET=change-me-to-a-random-secret
|
|
|
|
# Payment Providers (optional)
|
|
STRIPE_SECRET_KEY=
|
|
STRIPE_WEBHOOK_SECRET=
|
|
MERCADOPAGO_ACCESS_TOKEN=
|
|
|
|
# LNbits Configuration (for Bitcoin Lightning payments)
|
|
# Get these from your LNbits instance
|
|
# URL should be like: https://lnbits.yourdomain.com or https://legend.lnbits.com
|
|
LNBITS_URL=
|
|
# Invoice/Read key from your LNbits wallet
|
|
LNBITS_API_KEY=
|
|
# Optional: webhook secret for additional verification
|
|
LNBITS_WEBHOOK_SECRET=
|
|
|
|
# Email Service
|
|
# Provider options: resend, smtp, console (console = log only, no actual email)
|
|
EMAIL_PROVIDER=console
|
|
EMAIL_FROM=
|
|
EMAIL_FROM_NAME=
|
|
|
|
# Resend Configuration (if EMAIL_PROVIDER=resend)
|
|
# Get your API key from https://resend.com
|
|
EMAIL_API_KEY=
|
|
# Alternative env name also supported:
|
|
# RESEND_API_KEY=
|
|
|
|
# SMTP Configuration (if EMAIL_PROVIDER=smtp)
|
|
# Works with any SMTP server: Gmail, SendGrid, Mailgun, Amazon SES, etc.
|
|
SMTP_HOST=mail.spango.lat
|
|
SMTP_PORT=465
|
|
SMTP_USER=
|
|
SMTP_PASS=
|
|
# Set to true for port 465 (implicit TLS), false for port 587 (STARTTLS)
|
|
SMTP_SECURE=true
|
|
# Set to false to allow self-signed certificates (not recommended for production)
|
|
SMTP_TLS_REJECT_UNAUTHORIZED=true
|
|
|
|
# Common SMTP examples:
|
|
# Gmail: SMTP_HOST=smtp.gmail.com, SMTP_PORT=587, use App Password for SMTP_PASS
|
|
# SendGrid: SMTP_HOST=smtp.sendgrid.net, SMTP_PORT=587, SMTP_USER=apikey, SMTP_PASS=your_api_key
|
|
# Mailgun: SMTP_HOST=smtp.mailgun.org, SMTP_PORT=587
|
|
# Amazon SES: SMTP_HOST=email-smtp.us-east-1.amazonaws.com, SMTP_PORT=587
|
|
|
|
# Email Queue Rate Limiting
|
|
# Maximum number of emails that can be sent per hour (default: 30)
|
|
# If the limit is reached, queued emails will pause and resume automatically
|
|
MAX_EMAILS_PER_HOUR=30
|
|
|
|
# Pending Booking Cleanup
|
|
# Pending bookings whose payment is still unpaid (not awaiting admin approval)
|
|
# are cancelled after this many minutes, freeing the seats (default: 30)
|
|
PENDING_BOOKING_TTL_MINUTES=30
|
|
# How often the cleanup job runs, in milliseconds (default: 300000 = 5 min)
|
|
PENDING_BOOKING_CLEANUP_INTERVAL_MS=300000
|
|
|
|
# Auto-Hold Sweep
|
|
# Bookings awaiting admin payment approval are put on hold (seat released) after
|
|
# this many hours with no confirmation (default: 72)
|
|
HOLD_THRESHOLD_HOURS=72
|
|
# How often the hold sweep job runs, in milliseconds (default: 900000 = 15 min)
|
|
HOLD_SWEEP_INTERVAL_MS=900000
|
|
|
|
# Ended-Event Payment Sweep
|
|
# Once an event is over, any unconfirmed payment (pending / pending_approval /
|
|
# on_hold) is auto-rejected and its ticket cancelled. No email is sent.
|
|
# How often this sweep runs, in milliseconds (default: 900000 = 15 min)
|
|
EVENT_END_SWEEP_INTERVAL_MS=900000
|
|
|