s.esmaeiliandClaude Opus 5
676ec3ed72
Two live scripts against a running API, covering both halves of the master-OTP
contract:
* with OTP_MASTER_CODE set (8/8): signs in, the JWT works on customer/me,
Persian digits accepted, and the RULE E1 negatives — near-miss code,
unknown mobile, inactive customer — all still rejected.
* without it (6/6): the same code returns 401, no boot banner, a real code
still logs in, and replaying it fails.
Also confirmed from the boot log that with no SMS credentials the server starts
normally and declines to send instead of erroring (D20).
.env.example gained the auth, SMS and upload variables, names only, no values,
with OTP_MASTER_CODE marked delivery-only.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
67 lines
2.8 KiB
Bash
67 lines
2.8 KiB
Bash
# Database configuration
|
|
POSTGRES_USER=postgres
|
|
POSTGRES_PASSWORD=postgres
|
|
POSTGRES_DB=goldbank
|
|
|
|
# Host port exposed for PostgreSQL (used by docker-compose db service)
|
|
EXTERNAL_DB_PORT=5432
|
|
|
|
# Prisma connection string (inside Docker network use hostname "db")
|
|
DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Dev server ports — SINGLE SOURCE OF TRUTH for this monorepo.
|
|
# Every app's dev script/config reads its port from here. Do not hardcode a
|
|
# port anywhere else. strictPort is enabled everywhere: if a port below is
|
|
# already taken, the dev server fails with a clear error instead of silently
|
|
# picking another port.
|
|
# ---------------------------------------------------------------------------
|
|
API_PORT=3000
|
|
ADMIN_PANEL_PORT=5180
|
|
USER_APP_PORT=5181
|
|
USER_APP_V2_PORT=5182
|
|
|
|
# API Configuration (kept for any tooling that still reads bare PORT)
|
|
PORT=3000
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Authentication
|
|
# ---------------------------------------------------------------------------
|
|
# Admin JWT signing secret. REQUIRED in any real deployment — without it the
|
|
# API falls back to a well-known development string.
|
|
JWT_SECRET=
|
|
# Admin token lifetime (default 12h).
|
|
JWT_EXPIRES_IN=
|
|
# Customer JWT signing secret. Deliberately SEPARATE from JWT_SECRET so an
|
|
# admin token can never validate as a customer token (T1).
|
|
JWT_CUSTOMER_SECRET=
|
|
# Customer token lifetime (default 30d).
|
|
JWT_CUSTOMER_EXPIRES_IN=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# ⚠ DELIVERY ONLY — REMOVE BEFORE THE REAL RELEASE (D20 / ISSUES REL-01)
|
|
# ---------------------------------------------------------------------------
|
|
# A fixed OTP that signs in ANY active customer, alongside the real code.
|
|
# Leave it EMPTY or unset to disable it completely — that is the correct state
|
|
# for production. While it is set, the API prints a warning banner at boot.
|
|
OTP_MASTER_CODE=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# SMS gateway (Trez). Leave blank to disable sending: the server still boots,
|
|
# messages are logged instead of sent, and customers cannot receive a login
|
|
# code (D20). Never commit real values.
|
|
# ---------------------------------------------------------------------------
|
|
# "trez" (default) or "none" to disable explicitly.
|
|
SMS_PROVIDER=
|
|
# Override only for staging; defaults to the provider's live endpoint.
|
|
SMS_TREZ_URL=
|
|
SMS_TREZ_USERNAME=
|
|
SMS_TREZ_PASSWORD=
|
|
SMS_TREZ_SENDER_LINE=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Uploads
|
|
# ---------------------------------------------------------------------------
|
|
# Absolute path for uploaded files; defaults to <api>/storage/uploads.
|
|
UPLOAD_DIR=
|