Lucas Berger
8bd44b33c7
- Create apps/api/src/auth/devBypass.ts: devAuthBypass() middleware with NODE_ENV=production hard guard as first conditional (T-02-01 mitigation) - Exports DEV_USER const (id:1, color:COLOR_PALETTE[0]) for test reference - Mount devAuthBypass() before oidcAuthMiddleware on /api/* in index.ts - Add devBypass.test.ts: all three behavioral cases pass (production guard, unset-flag passthrough, active-injection) - Add DEV_AUTH_BYPASS to .env.example with production warning comment - Extend docs/deployment.md with dev-auth bypass section and production prohibition
23 lines
659 B
Bash
23 lines
659 B
Bash
# Database
|
|
DB_HOST=mariadb
|
|
DB_PORT=3306
|
|
DB_USER=familysync
|
|
DB_PASSWORD=
|
|
DB_NAME=familysync
|
|
DB_ROOT_PASSWORD=
|
|
|
|
# OIDC (Authelia) — fill in after registering the client
|
|
OIDC_AUTH_SECRET=
|
|
OIDC_ISSUER=
|
|
OIDC_CLIENT_ID=familysync
|
|
OIDC_CLIENT_SECRET=
|
|
OIDC_REDIRECT_URI=https://familysync.yourdomain.com/callback
|
|
OIDC_AUTH_EXTERNAL_URL=https://familysync.yourdomain.com
|
|
|
|
# CalDAV broker encryption key — generate with:
|
|
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
APP_PASSWORD_ENCRYPTION_KEY=
|
|
|
|
# DEV ONLY — injects a fixed dev user, skips Authelia. Hard-disabled when NODE_ENV=production. NEVER set in prod.
|
|
# DEV_AUTH_BYPASS=true
|