MichilisandClaude Opus 5
733d2459df
Replace the hand-rolled JWT auth with Better Auth 1.6.25 httpOnly cookie sessions, validated against the database on every request so revocation, bans and role changes take effect immediately. Backend: - betterAuth.ts wires the Drizzle adapter, magic links, Google sign-in and the admin plugin; auth-schema.ts maps Better Auth's models onto the existing `users` table so user IDs and their foreign keys survive intact. - routes/auth.ts is gone; Better Auth serves the standard endpoints and authExt.ts carries the flows it doesn't cover. - auth.ts shrinks to session resolution and helpers; sessions/revocation in dashboard.ts now read and delete `auth_sessions` rows directly. - Schema adds the Better Auth core + admin columns (email_verified, image, banned, ban_reason, ban_expires), with migrations and tests. - rateLimit.ts resolves client IPs spoof-resistantly: proxy headers are only honoured from loopback/RFC1918 peers plus TRUSTED_PROXIES. - passwordPolicy.ts centralises password validation. - Bump drizzle-orm, drizzle-kit and better-sqlite3 to versions compatible with Better Auth. Frontend: - auth-client.ts plus a reworked AuthContext and api/client.ts move to cookie-based sessions; no more bearer tokens in requests or middleware. photo-api: - Validate Better Auth session cookies against the shared auth_sessions table instead of verifying JWTs; JWT_SECRET is no longer needed for user auth, and PHOTO_VIEW_SECRET now signs gallery view tokens. BETTER_AUTH_SECRET and BETTER_AUTH_URL are required in production; the deprecated JWT_SECRET stays only as the photo-api view-token fallback. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
53 lines
1.4 KiB
JSON
53 lines
1.4 KiB
JSON
{
|
|
"name": "backend",
|
|
"version": "1.0.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "tsx watch src/index.ts",
|
|
"build": "tsc",
|
|
"test": "vitest run",
|
|
"start": "NODE_ENV=production node dist/index.js",
|
|
"db:generate": "drizzle-kit generate",
|
|
"db:migrate": "tsx src/db/migrate.ts",
|
|
"db:studio": "drizzle-kit studio",
|
|
"db:export": "tsx src/db/export.ts",
|
|
"db:import": "tsx src/db/import.ts"
|
|
},
|
|
"dependencies": {
|
|
"@aws-sdk/client-s3": "^3.1075.0",
|
|
"@hono/node-server": "^1.11.4",
|
|
"@hono/swagger-ui": "^0.4.0",
|
|
"@hono/zod-openapi": "^0.14.4",
|
|
"argon2": "^0.44.0",
|
|
"bcryptjs": "^2.4.3",
|
|
"better-auth": "1.6.25",
|
|
"better-sqlite3": "^12.11.1",
|
|
"dotenv": "^17.2.3",
|
|
"drizzle-orm": "^0.45.2",
|
|
"hono": "^4.4.7",
|
|
"ioredis": "^5.11.1",
|
|
"jose": "^5.4.0",
|
|
"moment-timezone": "^0.6.2",
|
|
"nanoid": "^5.0.7",
|
|
"nodemailer": "^7.0.13",
|
|
"pdfkit": "^0.17.2",
|
|
"pg": "^8.12.0",
|
|
"qrcode": "^1.5.4",
|
|
"zod": "^3.23.8"
|
|
},
|
|
"devDependencies": {
|
|
"@types/bcryptjs": "^2.4.6",
|
|
"@types/better-sqlite3": "^7.6.10",
|
|
"@types/node": "^20.14.9",
|
|
"@types/nodemailer": "^7.0.9",
|
|
"@types/pdfkit": "^0.17.4",
|
|
"@types/pg": "^8.11.6",
|
|
"@types/qrcode": "^1.5.6",
|
|
"drizzle-kit": "^0.31.10",
|
|
"ioredis-mock": "^8.13.1",
|
|
"tsx": "^4.15.7",
|
|
"typescript": "^5.5.2",
|
|
"vitest": "^4.1.10"
|
|
}
|
|
}
|