Paddy
7aac07a013
Introduces src/models/admin/, a dedicated identity and permissions module on its own nachklang_admin database, and the shared authenticator that feedback and tickets will move onto in the cutover step. Nothing swaps over yet: feedback.auth.ts and tickets.auth.ts still authenticate against the legacy calendar sessions, so production behaviour is unchanged. - better-auth 1.7 mounted at /admin/auth/*, sessions as httpOnly cookies scoped to .nachklang.art so one sign-in covers every *.nachklang.art app. - Accounts are invite-only: public sign-up is disabled, and the invitations plugin is the only code that creates users. Tokens are stored as SHA-256 hashes and travel in the request body, never in a URL. - Per-app permissions in user_app_permissions; requireAppAccess(app) queries the database on every request (no cookie cache) so disabling a user or revoking a session takes effect immediately. - ADMIN_BOOTSTRAP_EMAIL guarantees a way in on an empty database, idempotently and without crashing the API if the database is unreachable at boot. - Guards prevent an admin from removing their own admin permission, disabling themselves, or stripping the last active admin. The admin pool uses the callback-style mysql2, not mysql2/promise: Kysely's MysqlDialect drives the pool with callbacks, and the promise wrapper ignores them, so every query hangs silently. Only the integration tests caught this. Schema in sql/admin/001_init.sql, derived from getAuthTables() on the installed better-auth rather than the published CLI, which lags the library and omits account.issuer. app.ts is split into src/app.factory.ts so the integration tests drive the real middleware order rather than a copy of it. Tests: 131 unit, plus 41 integration tests against a throwaway MariaDB started by test/integration/setup.ts (docker or podman). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
45 lines
1.1 KiB
Bash
45 lines
1.1 KiB
Bash
# Values containing #, ", \ or surrounding spaces must be single-quoted
|
|
# (dotenv 16 treats an unquoted # as a comment): DB_PASSWORD='abc#def'
|
|
PORT=3000
|
|
|
|
DB_HOST=
|
|
DB_USER=
|
|
DB_PASSWORD=
|
|
|
|
EMAIL_HOST=
|
|
EMAIL_USERNAME=
|
|
EMAIL_PASSWORD=
|
|
|
|
CALENDAR_DB=
|
|
|
|
FEEDBACK_DB=
|
|
FEEDBACK_IP_SALT=
|
|
FEEDBACK_RATE_LIMIT_MAX=5
|
|
FEEDBACK_RATE_LIMIT_WINDOW_MIN=10
|
|
SALESFORCE_ENABLED=false
|
|
SALESFORCE_API_URL=
|
|
SALESFORCE_CLIENT_ID=
|
|
SALESFORCE_CLIENT_SECRET=
|
|
|
|
TICKETS_DB=
|
|
TICKETS_RATE_LIMIT_MAX=10
|
|
TICKETS_RATE_LIMIT_WINDOW_MIN=10
|
|
|
|
ADMIN_DB=
|
|
# 32+ random bytes, e.g. `openssl rand -base64 48`. Rotating it signs everyone
|
|
# out and invalidates outstanding password-reset links.
|
|
BETTER_AUTH_SECRET=
|
|
API_BASE_URL=http://localhost:3000
|
|
ADMIN_APP_URL=http://localhost:3002
|
|
# Comma-separated origins of the apps that may call /admin/* with credentials.
|
|
APP_ORIGINS=http://localhost:3001
|
|
# nachklang.art in production; passkeys are bound to this value.
|
|
PASSKEY_RP_ID=localhost
|
|
# On start-up, makes sure this address can get in (invite, or grant admin if the
|
|
# user already exists). Idempotent, safe to leave set.
|
|
ADMIN_BOOTSTRAP_EMAIL=
|
|
|
|
MEMBER_CREDENTIAL=123
|
|
CHOIR_CREDENTIAL=123
|
|
MANAGEMENT_CREDENTIAL=123
|