yeuimu
be0b90e68f
- Add User.role (enum Role/ADMIN) and User.tokenVersion with migration - Login now issues short-lived access token (30m default) + 7d refresh token, both embedding tokenVersion and a typ discriminator - Tokens delivered via HttpOnly SameSite cookies (ir_at, ir_rt scoped to /auth); refresh token never leaves the cookie - New endpoints: POST /auth/refresh (rotation), GET /auth/me, POST /auth/logout (bumps tokenVersion, revoking all tokens) - JWT strategy accepts bearer or cookie, rejects refresh tokens, and verifies tokenVersion + user existence on every request - Global RolesGuard: authenticated routes require ADMIN unless widened via @Roles(...) - Admin SPA: session fully cookie-based, no token in localStorage; router guard restores session via /auth/me; axios auto-refreshes once on 401; stale localStorage keys cleaned up
21 lines
677 B
Bash
21 lines
677 B
Bash
# Prisma connection string (PostgreSQL)
|
|
DATABASE_URL=postgresql://postgres:CHANGE_ME@localhost:5432/inkreach-official-website
|
|
|
|
# JWT signing secret: generate with `node -e "console.log(require('crypto').randomBytes(48).toString('hex'))"`
|
|
# Must be at least 32 characters.
|
|
JWT_SECRET=CHANGE_ME_TO_A_STRONG_RANDOM_SECRET
|
|
|
|
# Access token lifetime (e.g. 30m, 12h); short-lived, rotated via /auth/refresh
|
|
TOKEN_EXPIRES_IN=30m
|
|
|
|
# Refresh token lifetime (HttpOnly cookie)
|
|
REFRESH_TOKEN_EXPIRES_IN=7d
|
|
|
|
# Comma-separated list of allowed CORS origins (leave empty to disable CORS)
|
|
CORS_ORIGINS=http://localhost:5173
|
|
|
|
# Global rate limit per minute (per IP)
|
|
THROTTLE_LIMIT=120
|
|
|
|
PORT=3001
|