Kevin L'Hereec
991173aa05
- Add session-based authentication for web-UI (Login.vue, AuthController) - Add AuthSessionMiddleware: redirects unauthenticated users to /login - Add ApiKeyMiddleware: validates X-Api-Key header on all /api/v1 routes - Add BasicAuthMiddleware: registered for future M2M use - Use timingSafeEqual for all credential comparisons (timing attack prevention) - Regenerate session ID on login (session fixation prevention) - Validate redirect target after login (open redirect prevention) - Require WEBUI_USERNAME, WEBUI_PASSWORD, API_KEY as mandatory env vars - Share auth.username/authenticated via Inertia shared props - Add user dropdown in navbar (avatar icon + username + logout) - Add login i18n keys in fr.json and en.json - Remove orphan SQL migrations (users, auth_access_tokens) and @adonisjs/lucid
67 lines
2.4 KiB
TypeScript
67 lines
2.4 KiB
TypeScript
/*
|
|
|--------------------------------------------------------------------------
|
|
| Environment variables service
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| The `Env.create` method creates an instance of the Env service. The
|
|
| service validates the environment variables and also cast values
|
|
| to JavaScript data types.
|
|
|
|
|
*/
|
|
|
|
import { Env } from '@adonisjs/core/env'
|
|
|
|
export default await Env.create(new URL('../', import.meta.url), {
|
|
// Node
|
|
NODE_ENV: Env.schema.enum(['development', 'production', 'test'] as const),
|
|
PORT: Env.schema.number(),
|
|
HOST: Env.schema.string({ format: 'host' }),
|
|
LOG_LEVEL: Env.schema.string(),
|
|
|
|
// App
|
|
APP_KEY: Env.schema.secret(),
|
|
APP_URL: Env.schema.string({ format: 'url', tld: false }),
|
|
|
|
// Session
|
|
SESSION_DRIVER: Env.schema.enum(['cookie', 'memory'] as const),
|
|
|
|
// MongoDB
|
|
MONGODB_URI: Env.schema.string(),
|
|
MONGODB_DB_NAME: Env.schema.string.optional(),
|
|
|
|
// Observability
|
|
OTEL_EXPORTER_URI: Env.schema.string.optional(),
|
|
OTEL_SAMPLER_MODE: Env.schema.string.optional(),
|
|
OTEL_SAMPLER_RATIO: Env.schema.string.optional(),
|
|
OTEL_SERVICE_NAME: Env.schema.string.optional(),
|
|
|
|
// Remote logging
|
|
LOG_HOST: Env.schema.string.optional(),
|
|
LOG_PORT: Env.schema.number.optional(),
|
|
LOG_PROTOCOL: Env.schema.string.optional(),
|
|
|
|
// Security
|
|
HASH_KEY: Env.schema.string.optional(),
|
|
|
|
// Web UI credentials (required — no hardcoded fallback)
|
|
WEBUI_USERNAME: Env.schema.string(),
|
|
WEBUI_PASSWORD: Env.schema.string(),
|
|
|
|
// REST API Key (required — must be set before boot)
|
|
API_KEY: Env.schema.string(),
|
|
|
|
// Exchange Store
|
|
EXCHANGE_STORE_MAX_MESSAGES: Env.schema.number.optional(),
|
|
EXCHANGE_STORE_TTL_SECONDS: Env.schema.number.optional(),
|
|
EXCHANGE_STORE_SSE_INACTIVITY_TIMEOUT_MS: Env.schema.number.optional(),
|
|
EXCHANGE_STORE_SSE_ABSOLUTE_TIMEOUT_MS: Env.schema.number.optional(),
|
|
EXCHANGE_STORE_SSE_MAX_CONNECTIONS_PER_DEVICE: Env.schema.number.optional(),
|
|
EXCHANGE_STORE_SSE_RETRY_INTERVAL_MS: Env.schema.number.optional(),
|
|
EXCHANGE_STORE_RETRY_MAX_ATTEMPTS: Env.schema.number.optional(),
|
|
EXCHANGE_STORE_RETRY_BASE_DELAY_MS: Env.schema.number.optional(),
|
|
EXCHANGE_STORE_READ_TIMEOUT_MS: Env.schema.number.optional(),
|
|
FEATURE_EXCHANGE_PERSISTENCE: Env.schema.boolean.optional(),
|
|
FEATURE_SSE_ENABLED: Env.schema.boolean.optional(),
|
|
FEATURE_EXCHANGE_API_SOURCE: Env.schema.enum.optional(['mongodb', 'file'] as const),
|
|
})
|