s.esmaeiliandClaude Opus 5.5 9d3b5388ba fix(security): a production server refuses to start until its keys, allowed origins and test login are right (REL-01, REL-03, SEC-04) ...

With NODE_ENV=production (always, in the Docker image) the API lists
every problem at once and does not start while any of these holds:
- OTP_MASTER_CODE is set: the fixed test login signs in any customer. A
  test server built from the production image must say so with
  TEST_SERVER_ALLOW_MASTER_CODE=yes.
- JWT_CUSTOMER_SECRET is missing, equal to JWT_SECRET, or under 32
  characters.
- JWT_SECRET is missing, the published dev key, or under 32 characters.
- CORS_ORIGINS is empty, `*`, or not full origins. It no longer falls
  back to allow-all.

Checked live: a misconfigured start lists all four problems; a correct
one starts, answers the allowed origin, and blocks any other.
docs/SERVER-SETUP-CHECKLIST.md is the operator's list. DELIVERY.md,
docker-compose.yml and .env.example are updated to match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-08 17:00:17 +03:30

.cursor/rules

Feat add iam auth

2026-09-25 19:04:48 +03:30

.idea

fix add new version of user in app

2026-09-18 17:16:36 +03:30

apps

fix(security): a production server refuses to start until its keys, allowed origins and test login are right (REL-01, REL-03, SEC-04)

2026-10-08 17:00:17 +03:30

docs

fix(security): a production server refuses to start until its keys, allowed origins and test login are right (REL-01, REL-03, SEC-04)

2026-10-08 17:00:17 +03:30

henza_admin @ 1b67448143

md app

2026-10-04 20:11:09 +03:30

henza_pwa @ b171ffffb5

md app

2026-10-04 20:11:09 +03:30

henza_server @ 37c7d7a92f

md app

2026-10-04 20:11:09 +03:30

iranSans

SearchView: Removed the dynamic collection-tile grid (e.g. "پرفروش‌های این هفته") and the "نتایج / N محصول" section header from the UI. Underlying data/filtering logic untouched.

2026-09-18 12:54:45 +03:30

packages/shared-types

chore(release): prepare release/delivery + fix docker env passthrough

2026-09-23 00:30:09 +03:30

scripts

md app

2026-10-04 20:11:09 +03:30

.dockerignore

Fix some for production

2026-09-10 12:17:47 +03:30

.env.example

feat: accounting integration (D27), SMS relay driver (D26), rebuild user apps

2026-10-06 16:48:36 +03:30

.gitignore

chore: keep the live henza data dump out of git

2026-10-07 19:35:01 +03:30

DELIVERY.md

fix(security): a production server refuses to start until its keys, allowed origins and test login are right (REL-01, REL-03, SEC-04)

2026-10-08 17:00:17 +03:30

docker-compose.delivery-test.yml

fix(api): treat blank env vars as unset; verify the whole flow in Docker Compose

2026-09-23 02:27:30 +03:30

docker-compose.yml

fix(security): a production server refuses to start until its keys, allowed origins and test login are right (REL-01, REL-03, SEC-04)

2026-10-08 17:00:17 +03:30

DOCKER.md

fix add new version of user in app

2026-09-18 17:16:36 +03:30

nginx-spa.conf

Fix db external port

2026-09-09 23:31:31 +03:30

oapi-struncture.sql

feat: accounting integration (D27), SMS relay driver (D26), rebuild user apps

2026-10-06 16:48:36 +03:30

package.json

fix add new version of user in app

2026-09-18 17:16:36 +03:30

pnpm-lock.yaml

chore(apps): remove unused code and packages (DEAD-01, DEAD-02, DEAD-03)

2026-10-08 16:40:10 +03:30

pnpm-workspace.yaml

feat: initial commit

2026-09-09 06:46:27 +03:30

tsconfig.base.json

feat: initial commit

2026-09-09 06:46:27 +03:30

turbo.json

feat: initial commit

2026-09-09 06:46:27 +03:30

S

Description

No description provided

123 MiB

Languages

JavaScript 73.2%

TypeScript 15%

Vue 10.9%

Less 0.4%

PLpgSQL 0.3%

Other 0.1%