parking_solution

Files

T

julian 7629d5d7b1 fix(auth): make the Secure cookie flag fail-safe (default on)

secureCookies() keyed off NODE_ENV === "production", so an appliance deployed
without that var silently sent the auth + CSRF cookies WITHOUT the Secure flag —
the review's one Medium finding.

Now Secure is the DEFAULT and you only ever opt OUT: a misconfigured/forgotten env
can only make cookies more restrictive, never drop the flag. Dropped only on a
deliberate COOKIE_SECURE=0/false/no/off (or an explicit NODE_ENV=development as a
dev fallback). The LAN appliance that serves the SPA over plain http sets
COOKIE_SECURE=0 on purpose (a Secure cookie would never be sent over its http origin
and would lock operators out); a TLS deploy leaves it unset and gets Secure.

- auth.test.ts (5): pins the matrix — default Secure, production Secure, dev opt-out,
  COOKIE_SECURE falsey opts out, any other value opts in.
- .env.example documents COOKIE_SECURE (replaces the stale NODE_ENV cookie note).
- dev .env sets COOKIE_SECURE=0 (local http://localhost login keeps working).

server 80/80; build+lint green.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

2026-06-21 23:50:40 +02:00

scripts

feat(auth): dynamic RBAC — composable roles + resource×CRUD permissions

2026-06-19 01:19:28 +02:00

src

fix(auth): make the Secure cookie flag fail-safe (default on)

2026-06-21 23:50:40 +02:00

.env.example

fix(auth): make the Secure cookie flag fail-safe (default on)

2026-06-21 23:50:40 +02:00

package.json

test(server): add fresh-SQLite test harness + anti-fraud core suites