Paddy
dbcd5b56f6
Six defects found by an independent review of 7aac07a.
Environment handling now fails safe. NODE_ENV=production was gating the
signing key, the cookie domain, the CORS origin list and invitation-token
logging all at once, and it was documented nowhere - an unset value, which is
what a fresh Plesk vhost gives you, silently degraded all four. Only
'development' and 'test' relax anything now; everything else, unset included,
is strict. The hardcoded fallback secret is gone (dev gets a random
per-process one, so no committed value can ever sign a production cookie),
and invitation-link logging is an explicit ADMIN_LOG_INVITE_LINKS opt-in that
is refused in strict mode.
Rate limiting no longer collapses into a single global bucket. Without
trustedProxies, better-auth rejects a multi-value x-forwarded-for, resolves no
client IP, and keys every request to "no-trusted-ip" - where /sign-in/*
allows 3 requests per 10 seconds, so one noisy client could lock the whole
organisation out. CLIENT_IP_HEADERS and TRUSTED_PROXY_IPS make this explicit,
the unspecified x-forwarded-for fallback is gone, and strict mode warns at
boot when no trusted proxy is configured.
Invite acceptance is transactional. The user and its credential account go in
one runWithTransaction, as better-auth's own sign-up route does. A transaction
cannot span the permission and invitation writes - those use this module's own
pool - so a failure there is compensated: the user row is deleted and the
invitation un-marked, so the link works again instead of leaving the invitee
with a burnt token and an account no route can repair.
The last-admin guards were check-then-act. Two admins each removing the
other's admin permission could both pass the check and both commit, leaving
nobody able to administer anything. The count now runs inside the write
transaction under SELECT ... FOR UPDATE.
Also: lastSignInAt filtered expired sessions in the detail endpoint but not
the list, so the two disagreed; and the integration suite never reset
rateLimit, leaving it one added sign-in away from 429s that look like auth
bugs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
66 lines
2.2 KiB
Bash
66 lines
2.2 KiB
Bash
# Values containing #, ", \ or surrounding spaces must be single-quoted
|
|
# (dotenv 16 treats an unquoted # as a comment): DB_PASSWORD='abc#def'
|
|
# REQUIRED. The admin module treats anything other than "development" or "test"
|
|
# as production: strict secrets, cross-subdomain cookies, no relaxed CORS.
|
|
# Leaving it unset is therefore safe-by-default but will refuse to boot without
|
|
# the admin secrets below. Set it to development for local work.
|
|
NODE_ENV=development
|
|
|
|
PORT=3000
|
|
|
|
DB_HOST=
|
|
DB_USER=
|
|
DB_PASSWORD=
|
|
|
|
EMAIL_HOST=
|
|
EMAIL_USERNAME=
|
|
EMAIL_PASSWORD=
|
|
|
|
CALENDAR_DB=
|
|
|
|
FEEDBACK_DB=
|
|
FEEDBACK_IP_SALT=
|
|
FEEDBACK_RATE_LIMIT_MAX=5
|
|
FEEDBACK_RATE_LIMIT_WINDOW_MIN=10
|
|
SALESFORCE_ENABLED=false
|
|
SALESFORCE_API_URL=
|
|
SALESFORCE_CLIENT_ID=
|
|
SALESFORCE_CLIENT_SECRET=
|
|
|
|
TICKETS_DB=
|
|
TICKETS_RATE_LIMIT_MAX=10
|
|
TICKETS_RATE_LIMIT_WINDOW_MIN=10
|
|
|
|
ADMIN_DB=
|
|
# 32+ random bytes, e.g. `openssl rand -base64 48`. Mandatory outside
|
|
# development/test - there is deliberately no fallback, since a hardcoded one
|
|
# would be a published signing key. Rotating it signs everyone out and
|
|
# invalidates outstanding password-reset links.
|
|
BETTER_AUTH_SECRET=
|
|
API_BASE_URL=http://localhost:3000
|
|
ADMIN_APP_URL=http://localhost:3002
|
|
# Comma-separated origins of the apps that may call /admin/* with credentials.
|
|
APP_ORIGINS=http://localhost:3001
|
|
# nachklang.art in production; passkeys are bound to this value.
|
|
PASSKEY_RP_ID=localhost
|
|
# On start-up, makes sure this address can get in (invite, or grant admin if the
|
|
# user already exists). Idempotent, safe to leave set.
|
|
ADMIN_BOOTSTRAP_EMAIL=
|
|
|
|
# The header the reverse proxy puts the real client IP in, and the proxy hops to
|
|
# trust. Get these right or better-auth cannot resolve a client IP and every
|
|
# request shares ONE rate-limit bucket (/sign-in/* allows 3 per 10 seconds, so
|
|
# one noisy client locks everyone out). Check with:
|
|
# SELECT `key` FROM rateLimit; -- a "no-trusted-ip" row means it is happening.
|
|
CLIENT_IP_HEADERS=x-real-ip
|
|
TRUSTED_PROXY_IPS=
|
|
|
|
# Writes invitation links to the log. That link is a live account-creation
|
|
# credential, so this is refused outside development. Needed locally, where the
|
|
# mail relay is off and only the token's hash is stored.
|
|
ADMIN_LOG_INVITE_LINKS=true
|
|
|
|
MEMBER_CREDENTIAL=123
|
|
CHOIR_CREDENTIAL=123
|
|
MANAGEMENT_CREDENTIAL=123
|