b3eaeb7287
middleware.ts previously 404'd every external request, which meant the app was unusable once hosted. There are no per-user accounts, so this adds a single-password gate: - /login page + POST /api/auth/login, POST /api/auth/logout - lib/auth.ts: HMAC-SHA256 signed session cookie (lib/auth), Web Crypto only so the same code runs in Edge middleware and Node handlers - middleware now admits: the signing flow (unchanged, still public), /login + /api/auth/*, local requests, and valid sessions. Everything else redirects to /login (pages) or returns 401 JSON (API calls). - password compared with a constant-time compare, wrong attempts delayed 600ms to slow online guessing - cookie is HttpOnly + SameSite=Lax, 12h, Secure when x-forwarded-proto says https (Coolify serves the proxy on http today) APP_PASSWORD / AUTH_SECRET added to .env.example, with a warning: an unquoted # in an env value starts a comment, which silently truncated the first generated password and made login fail. Verified against a real built server: anon->307 /login, anon API->401, wrong password->401, correct password->200+cookie, signed-in request reaches PocketBase, /resign/ still 200 without a cookie, forged cookie->401.
47 lines
No EOL
1.9 KiB
Text
47 lines
No EOL
1.9 KiB
Text
# Workflow app — environment template
|
|
#
|
|
# Copy to .env.local in this folder and fill in the real values.
|
|
# .env.local is git-ignored and must never be committed.
|
|
|
|
# --- PocketBase -------------------------------------------------------------
|
|
PB_URL=https://pb.agent.apphub.co.za
|
|
NEXT_PUBLIC_PB_URL=https://pb.agent.apphub.co.za
|
|
# Superuser/admin token. Lives for ~24h — re-grab from the PB admin UI.
|
|
PB_TOKEN=
|
|
PB_ADMIN_EMAIL=
|
|
PB_ADMIN_PASSWORD=
|
|
|
|
# --- App URLs ---------------------------------------------------------------
|
|
APP_URL=http://localhost:3000
|
|
NEXT_PUBLIC_APP_URL=http://localhost:3000
|
|
|
|
# --- Telegram notifications -------------------------------------------------
|
|
TELEGRAM_BOT_TOKEN=
|
|
TELEGRAM_CHAT_ID=
|
|
|
|
# --- App password gate ------------------------------------------------------
|
|
# The app has no per-user accounts. These two values protect everything.
|
|
# APP_PASSWORD — the password you type at /login
|
|
# AUTH_SECRET — random 32+ char secret used to sign the session cookie.
|
|
# Changing it logs everyone out. Generate with:
|
|
# node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"
|
|
#
|
|
# WARNING: keep the password alphanumeric. An unquoted `#` starts a comment in
|
|
# .env files, so APP_PASSWORD=abc#123 silently becomes "abc" and login fails
|
|
# with "Wrong password". If you must use special characters, wrap the value in
|
|
# double quotes: APP_PASSWORD="abc#123"
|
|
APP_PASSWORD=
|
|
AUTH_SECRET=
|
|
|
|
# --- CIPC BizPortal logins --------------------------------------------------
|
|
# Login 1 — primary; rotates to Login 3 when it hits the 100-search limit.
|
|
CIPC_LOGIN1_CODE=
|
|
CIPC_LOGIN1_PASSWORD=
|
|
# Login 3 — fallback.
|
|
CIPC_LOGIN3_CODE=
|
|
CIPC_LOGIN3_PASSWORD=
|
|
|
|
# --- BizPortal personal login (name reservation flow) -----------------------
|
|
# The 13-digit SA ID number used to log in at bizportal.gov.za.
|
|
BIZPORTAL_ID_NO=
|
|
BIZPORTAL_PASSWORD= |