josh
23bd0f0c6a
Every cookie was flagged Secure whenever NODE_ENV=production. Over plain HTTP (single-host compose deploy without TLS) browsers silently discard Secure cookies, so the access token, refresh token, and CSRF cookie all vanished after login — producing 401 Unauthorized on every GET and 403 "CSRF token missing or invalid" on every mutation. Add COOKIE_SECURE to ApiEnv: optional boolean, falls back to NODE_ENV === 'production' when unset. Controllers and middleware now read env.COOKIE_SECURE instead of the NODE_ENV shortcut. The compose file sets it to false by default with a comment to flip once TLS is in front; HTTPS deployments can override via .env or drop the override to pick up the secure default.
18 lines
467 B
TypeScript
18 lines
467 B
TypeScript
import 'dotenv/config';
|
|
import { ApiEnv } from '@vector/shared';
|
|
|
|
const parsed = ApiEnv.safeParse(process.env);
|
|
|
|
if (!parsed.success) {
|
|
console.error('Invalid environment configuration:');
|
|
for (const issue of parsed.error.issues) {
|
|
console.error(` ${issue.path.join('.') || '(root)'}: ${issue.message}`);
|
|
}
|
|
process.exit(1);
|
|
}
|
|
|
|
export const env = {
|
|
...parsed.data,
|
|
COOKIE_SECURE: parsed.data.COOKIE_SECURE ?? parsed.data.NODE_ENV === 'production',
|
|
};
|