Nicolas
cf8ef26f63
Premiere brique de l'app d'admin independante : une surface /admin/*
ajoutee a apps/api, avec une authentification totalement distincte de
celle des utilisateurs.
- Table AdminUser isolee (aucune relation vers UserProfile), migration
20260828120000_admin_user.
- lib/admin-jwt.ts : sign/verify d'un JWT admin, secret ADMIN_JWT_SECRET
propre (jamais interchangeable avec JWT_SECRET).
- middlewares/require-admin.ts : cookie admin_session dedie, re-check
tokenVersion, echoue ferme si ADMIN_JWT_SECRET absent (posture
requireInternalWorker). res.locals.adminUser type via AdminLocals.
- modules/admin/ : admin-auth.{routes,service}.ts (POST /login, POST
/logout, GET /me), admin.routes.ts agregateur monte /admin. Pas de
signup expose.
- lib/safe-admin.ts : mapping AdminUser -> AdminUserView (drop passwordHash
+ tokenVersion, dates ISO).
- scripts/create-admin.ts : creation du 1er admin hors-bande (flags ou
ADMIN_INITIAL_*).
- CORS : setupCore accepte string[] ; app.ts autorise CORS_ORIGIN +
ADMIN_CORS_ORIGIN.
- Shared : schemas/admin.ts (adminLoginSchema), types/admin.ts
(AdminUserView).
- Env : ADMIN_JWT_SECRET (optionnel), ADMIN_COOKIE_NAME, ADMIN_CORS_ORIGIN,
ADMIN_INITIAL_* ; .env.example, .env.test.example, docker-compose.yml,
ci.yml mis a jour.
- reset-db.ts truncate admin_users.
- Tests Mocha admin-auth.test.ts : 400 sans body, 401 email inconnu /
mauvais mdp, login OK (cookie pose, lastLoginAt, pas de hash/tokenVersion
dans la reponse), /me derriere requireAdmin, logout, et un cookie
`session` d'utilisateur normal ne donne pas acces a /admin/*.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
36 lines
2.2 KiB
Text
36 lines
2.2 KiB
Text
NODE_ENV=test
|
|
PORT=3000
|
|
# Must point at a *different* database than your `.env`'s — `pnpm test`
|
|
# (test-support/reset-db.ts's `resetDatabase()`) TRUNCATEs almost every
|
|
# table before each test. Pointing this at the same database `pnpm dev`
|
|
# uses will wipe real local data on every test run. Easiest setup: same
|
|
# Postgres server/credentials as `.env`, just a different database name —
|
|
# create it once with e.g.:
|
|
# pnpm exec prisma db execute --url "postgresql://USER:PASSWORD@localhost:PORT/postgres?schema=public" --file - <<< "CREATE DATABASE batchcooking_test;"
|
|
# DATABASE_URL="postgresql://USER:PASSWORD@localhost:PORT/batchcooking_test?schema=public" pnpm exec prisma migrate deploy
|
|
DATABASE_URL="postgresql://changeme:changeme@localhost:5432/batchcooking_test?schema=public"
|
|
|
|
# Required, no default on purpose — generate your own, e.g.:
|
|
# node -e "console.log(require('crypto').randomBytes(48).toString('hex'))"
|
|
JWT_SECRET=changeme-generate-a-real-random-secret-at-least-32-chars
|
|
|
|
# Required — the Mocha suite exercises the real techStepClassifier, which
|
|
# now round-trips over HTTP to services/tech-step-intent-service (no mocks
|
|
# of internal services, per this repo's test conventions). Start that
|
|
# service locally first (see its own README) with a matching
|
|
# INTENT_SERVICE_SECRET, or every test touching tech-step-matcher.ts fails
|
|
# with a connection error rather than a useful assertion failure.
|
|
INTENT_SERVICE_BASE_URL=http://localhost:8000
|
|
INTENT_SERVICE_SECRET=changeme-generate-a-real-random-secret-at-least-32-chars
|
|
|
|
# Optional — only needed to exercise tech-step-worker.routes.test.ts's
|
|
# success path (a request with a matching secret); every other test runs
|
|
# fine without it. Any value at least 32 chars works locally.
|
|
# INTERNAL_WORKER_SECRET=changeme-generate-a-real-random-secret-at-least-32-chars
|
|
|
|
# Optional — set to run admin-auth.test.ts's login success path and the
|
|
# requireAdmin-guarded routes (any value at least 32 chars). Left unset,
|
|
# those cases self-skip and only the "no secret configured -> 401" path
|
|
# runs. Same "optional in test, fail-closed at runtime" posture as
|
|
# INTERNAL_WORKER_SECRET above.
|
|
# ADMIN_JWT_SECRET=changeme-generate-a-real-random-secret-at-least-32-chars
|