julian
64d5e45f11
Replace the dev-only token shim with real authentication. Backend: - @fastify/cookie; JWT carried in an HttpOnly + SameSite=Strict cookie (parking_token), read from the cookie not the Authorization header. - Double-submit CSRF: readable parking_csrf cookie + X-CSRF-Token header, both cross-checked against a csrf claim baked into the JWT; enforced on mutations. - Routes: POST /api/auth/login (bcrypt, constant-time-ish), POST logout, GET me. requireRole now verifies the cookie + CSRF + role. - seed-admin script (pnpm --filter @parking/server seed-admin) for the first admin; no bootstrap endpoint. - Removed SETUP_AUTH_BYPASS and catalog.authBypass entirely; setup endpoints use the cookie admin guard like everything else. Frontend: - apiFetch wrapper: credentials:'include' + X-CSRF-Token on mutations. - Login form; App gates on /api/auth/me and only shows setup to admins; logout. - Wizard token field removed (auth is the session cookie). Deploy: - deploy/nginx.conf: prod reverse proxy, SPA + /api same-origin, TLS, so the Secure cookies work. Dev stays same-origin via the Vite proxy. Verified (curl + browser): wrong pass -> 401; login sets cookies; me -> admin; assign without CSRF -> 403, with -> 201; no cookie -> 401; session persists across reload. wiki/local-jwt-auth updated.
60 lines
1.9 KiB
JavaScript
60 lines
1.9 KiB
JavaScript
// Seed the first admin user (run once at install).
|
|
//
|
|
// ADMIN_USER=admin ADMIN_PASS='strong-pass' \
|
|
// node --env-file-if-exists=.env apps/server/scripts/seed-admin.mjs
|
|
//
|
|
// Or interactively (prompts for a hidden password):
|
|
// node --env-file-if-exists=.env apps/server/scripts/seed-admin.mjs <username>
|
|
//
|
|
// Idempotent-ish: refuses to overwrite an existing user unless FORCE=1.
|
|
|
|
import { randomUUID } from "node:crypto";
|
|
import { createInterface } from "node:readline/promises";
|
|
import { stdin, stdout } from "node:process";
|
|
import { createRequire } from "node:module";
|
|
|
|
const require = createRequire(import.meta.url);
|
|
const bcrypt = require("bcrypt");
|
|
const { createDb, users, eq } = require("@parking/db");
|
|
|
|
const username = process.env.ADMIN_USER ?? process.argv[2];
|
|
let password = process.env.ADMIN_PASS;
|
|
|
|
if (!username) {
|
|
console.error("usage: ADMIN_USER=.. ADMIN_PASS=.. seed-admin.mjs (or pass a username arg)");
|
|
process.exit(1);
|
|
}
|
|
|
|
if (!password) {
|
|
const rl = createInterface({ input: stdin, output: stdout });
|
|
password = (await rl.question(`Password for "${username}": `)).trim();
|
|
rl.close();
|
|
}
|
|
if (!password || password.length < 8) {
|
|
console.error("password must be at least 8 characters");
|
|
process.exit(1);
|
|
}
|
|
|
|
const db = createDb();
|
|
const existing = await db.select().from(users).where(eq(users.username, username)).get();
|
|
if (existing && process.env.FORCE !== "1") {
|
|
console.error(`user "${username}" already exists (set FORCE=1 to reset the password)`);
|
|
process.exit(1);
|
|
}
|
|
|
|
const passwordHash = await bcrypt.hash(password, 12);
|
|
|
|
if (existing) {
|
|
await db.update(users).set({ passwordHash, role: "admin" }).where(eq(users.id, existing.id));
|
|
console.log(`reset password for admin "${username}"`);
|
|
} else {
|
|
await db.insert(users).values({
|
|
id: randomUUID(),
|
|
username,
|
|
passwordHash,
|
|
role: "admin",
|
|
});
|
|
console.log(`created admin "${username}"`);
|
|
}
|
|
process.exit(0);
|