julian
64d5e45f11
Replace the dev-only token shim with real authentication. Backend: - @fastify/cookie; JWT carried in an HttpOnly + SameSite=Strict cookie (parking_token), read from the cookie not the Authorization header. - Double-submit CSRF: readable parking_csrf cookie + X-CSRF-Token header, both cross-checked against a csrf claim baked into the JWT; enforced on mutations. - Routes: POST /api/auth/login (bcrypt, constant-time-ish), POST logout, GET me. requireRole now verifies the cookie + CSRF + role. - seed-admin script (pnpm --filter @parking/server seed-admin) for the first admin; no bootstrap endpoint. - Removed SETUP_AUTH_BYPASS and catalog.authBypass entirely; setup endpoints use the cookie admin guard like everything else. Frontend: - apiFetch wrapper: credentials:'include' + X-CSRF-Token on mutations. - Login form; App gates on /api/auth/me and only shows setup to admins; logout. - Wizard token field removed (auth is the session cookie). Deploy: - deploy/nginx.conf: prod reverse proxy, SPA + /api same-origin, TLS, so the Secure cookies work. Dev stays same-origin via the Vite proxy. Verified (curl + browser): wrong pass -> 401; login sets cookies; me -> admin; assign without CSRF -> 403, with -> 201; no cookie -> 401; session persists across reload. wiki/local-jwt-auth updated.
33 lines
903 B
JSON
33 lines
903 B
JSON
{
|
|
"name": "@parking/server",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"build": "tsc -b",
|
|
"dev": "node --env-file-if-exists=.env --watch --experimental-strip-types src/index.ts",
|
|
"start": "node --env-file-if-exists=.env dist/index.js",
|
|
"seed-admin": "node --env-file-if-exists=.env scripts/seed-admin.mjs",
|
|
"typecheck": "tsc --noEmit",
|
|
"lint": "tsc --noEmit"
|
|
},
|
|
"dependencies": {
|
|
"@fastify/cookie": "^11.0.2",
|
|
"@fastify/cors": "11.2.0",
|
|
"@fastify/jwt": "10.1.0",
|
|
"@fastify/static": "9.1.3",
|
|
"@parking/db": "workspace:*",
|
|
"@parking/devices": "workspace:*",
|
|
"@parking/shared": "workspace:*",
|
|
"bcrypt": "6.0.0",
|
|
"fastify": "5.8.5",
|
|
"fastify-plugin": "6.0.0",
|
|
"uhppoted": "0.9.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/bcrypt": "6.0.0",
|
|
"@types/node": "25.9.3",
|
|
"typescript": "6.0.3"
|
|
}
|
|
}
|