Replace the hand-rolled JWT auth with Better Auth 1.6.25 httpOnly cookie sessions, validated against the database on every request so revocation, bans and role changes take effect immediately. Backend: - betterAuth.ts wires the Drizzle adapter, magic links, Google sign-in and the admin plugin; auth-schema.ts maps Better Auth's models onto the existing `users` table so user IDs and their foreign keys survive intact. - routes/auth.ts is gone; Better Auth serves the standard endpoints and authExt.ts carries the flows it doesn't cover. - auth.ts shrinks to session resolution and helpers; sessions/revocation in dashboard.ts now read and delete `auth_sessions` rows directly. - Schema adds the Better Auth core + admin columns (email_verified, image, banned, ban_reason, ban_expires), with migrations and tests. - rateLimit.ts resolves client IPs spoof-resistantly: proxy headers are only honoured from loopback/RFC1918 peers plus TRUSTED_PROXIES. - passwordPolicy.ts centralises password validation. - Bump drizzle-orm, drizzle-kit and better-sqlite3 to versions compatible with Better Auth. Frontend: - auth-client.ts plus a reworked AuthContext and api/client.ts move to cookie-based sessions; no more bearer tokens in requests or middleware. photo-api: - Validate Better Auth session cookies against the shared auth_sessions table instead of verifying JWTs; JWT_SECRET is no longer needed for user auth, and PHOTO_VIEW_SECRET now signs gallery view tokens. BETTER_AUTH_SECRET and BETTER_AUTH_URL are required in production; the deprecated JWT_SECRET stays only as the photo-api view-token fallback. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
130 lines
3.5 KiB
Go
130 lines
3.5 KiB
Go
// Package config loads photo-api configuration from the environment,
|
|
// following the backend's convention of a per-service .env file with
|
|
// ad-hoc defaults (backend/src/index.ts uses dotenv the same way).
|
|
package config
|
|
|
|
import (
|
|
"bufio"
|
|
"fmt"
|
|
"os"
|
|
"strconv"
|
|
"strings"
|
|
)
|
|
|
|
type Config struct {
|
|
Port int
|
|
DBType string // "postgres" | "sqlite", same convention as backend DB_TYPE
|
|
DatabaseURL string
|
|
// ViewTokenSecret signs the hour-bucketed gallery view tokens
|
|
// (viewtoken.go). PHOTO_VIEW_SECRET, falling back to the legacy
|
|
// JWT_SECRET during the Better Auth migration.
|
|
ViewTokenSecret string
|
|
|
|
StoragePath string
|
|
S3Endpoint string
|
|
S3Region string
|
|
S3Bucket string
|
|
S3AccessKeyID string
|
|
S3SecretKey string
|
|
S3ForcePathStyle bool
|
|
|
|
MaxUploadMB int
|
|
WorkerConcurrency int
|
|
FrontendURL string
|
|
HeicConverter string // optional explicit converter command; autodetected when empty
|
|
}
|
|
|
|
// S3Enabled mirrors backend/src/lib/storage.ts: S3 is active when both
|
|
// S3_ENDPOINT and S3_BUCKET are set.
|
|
func (c Config) S3Enabled() bool {
|
|
return c.S3Endpoint != "" && c.S3Bucket != ""
|
|
}
|
|
|
|
func Load() (Config, error) {
|
|
loadDotenv(".env")
|
|
|
|
cfg := Config{
|
|
Port: envInt("PORT", 3003),
|
|
DBType: strings.ToLower(env("DB_TYPE", "sqlite")),
|
|
DatabaseURL: env("DATABASE_URL", ""),
|
|
ViewTokenSecret: env("PHOTO_VIEW_SECRET", env("JWT_SECRET", "")),
|
|
StoragePath: env("STORAGE_PATH", "./data/photos"),
|
|
S3Endpoint: env("S3_ENDPOINT", ""),
|
|
S3Region: env("S3_REGION", "auto"),
|
|
S3Bucket: env("S3_BUCKET", ""),
|
|
S3AccessKeyID: env("S3_ACCESS_KEY_ID", ""),
|
|
S3SecretKey: env("S3_SECRET_ACCESS_KEY", ""),
|
|
S3ForcePathStyle: envBool("S3_FORCE_PATH_STYLE", true),
|
|
MaxUploadMB: envInt("MAX_UPLOAD_MB", 50),
|
|
WorkerConcurrency: envInt("WORKER_CONCURRENCY", 2),
|
|
FrontendURL: strings.TrimRight(env("FRONTEND_URL", "http://localhost:3000"), "/"),
|
|
HeicConverter: env("HEIC_CONVERTER", ""),
|
|
}
|
|
|
|
if cfg.DBType != "postgres" && cfg.DBType != "sqlite" {
|
|
return cfg, fmt.Errorf("DB_TYPE must be postgres or sqlite, got %q", cfg.DBType)
|
|
}
|
|
if cfg.DatabaseURL == "" {
|
|
return cfg, fmt.Errorf("DATABASE_URL is required")
|
|
}
|
|
if cfg.ViewTokenSecret == "" {
|
|
return cfg, fmt.Errorf("PHOTO_VIEW_SECRET is required (or legacy JWT_SECRET as fallback)")
|
|
}
|
|
return cfg, nil
|
|
}
|
|
|
|
func env(key, def string) string {
|
|
if v := os.Getenv(key); v != "" {
|
|
return v
|
|
}
|
|
return def
|
|
}
|
|
|
|
func envInt(key string, def int) int {
|
|
if v := os.Getenv(key); v != "" {
|
|
if n, err := strconv.Atoi(v); err == nil {
|
|
return n
|
|
}
|
|
}
|
|
return def
|
|
}
|
|
|
|
func envBool(key string, def bool) bool {
|
|
if v := os.Getenv(key); v != "" {
|
|
if b, err := strconv.ParseBool(v); err == nil {
|
|
return b
|
|
}
|
|
}
|
|
return def
|
|
}
|
|
|
|
// loadDotenv is a minimal KEY=VALUE loader (comments and blank lines
|
|
// ignored, optional surrounding quotes stripped, existing env wins).
|
|
func loadDotenv(path string) {
|
|
f, err := os.Open(path)
|
|
if err != nil {
|
|
return
|
|
}
|
|
defer f.Close()
|
|
|
|
sc := bufio.NewScanner(f)
|
|
for sc.Scan() {
|
|
line := strings.TrimSpace(sc.Text())
|
|
if line == "" || strings.HasPrefix(line, "#") {
|
|
continue
|
|
}
|
|
key, val, ok := strings.Cut(line, "=")
|
|
if !ok {
|
|
continue
|
|
}
|
|
key = strings.TrimSpace(key)
|
|
val = strings.TrimSpace(val)
|
|
if len(val) >= 2 && (val[0] == '"' || val[0] == '\'') && val[len(val)-1] == val[0] {
|
|
val = val[1 : len(val)-1]
|
|
}
|
|
if _, exists := os.LookupEnv(key); !exists {
|
|
os.Setenv(key, val)
|
|
}
|
|
}
|
|
}
|