s.esmaeiliandClaude Opus 5
5ad1083aee
Ports "تکمیل پروفایل" end to end (D22). API - POST customer/me/complete-profile — three required document ids, the customer taken from the token, verification step set to the reference's LIVE value (approved outright; its `= 1` line is commented out at :83 in favour of `= 2` at :85). Both SMS messages byte-identical and non-blocking per D20. - POST customer/me/documents — the reference let the app upload through the same file/create the admin used, inside its auth:api-customer group (routes/api.php:95); the target's copy is admin-guarded, so the page could not have uploaded at all. Reuses AdminUploadsService unchanged, so both paths share one size limit, MIME whitelist and naming scheme (UPL-01). - PROFILE_ADMIN_MOBILES replaces the reference's four hardcoded personal numbers; blank means nobody is notified and the upload still succeeds. Three reference behaviours deliberately NOT ported, all in ISSUES.md: - SEC-14: `$customer->update($request->all())` mass-assigned the whole request body, letting the app write its own credit limit, making charge, gold debt, active flag or mobile. Replaced with a three-field whitelist. - SEC-15: four real personal mobiles hardcoded in the source. - APP-03: refresh()'s unterminated setInterval page reload. Apps (both, template+script byte-identical, per-app styling only) - CompleteProfileView + SingleImageUploader - route /complete_profile, redirecting home once the documents are in, as the reference's guard did (router/index.ts:266) - the entry point on the profile screen, shown only while they are missing (profile.vue:96-102) Also (D23): JWT_CUSTOMER_SECRET now warns loudly at boot when unset. It falls back to JWT_SECRET, which signs app and admin tokens with the same key and leaves the `typ` check as the only barrier — and an expert's app token carries their AdminUser id in `sub`. Warn rather than refuse to boot (D19, lowest risk); DELIVERY.md lists it as the first pre-release step (REL-03). Verified: build 5/5 · jest 45/45 · complete-profile 38/38 (new) · expert login 36/36 · apps smoke 43/43 · admin smoke 43/43 · B2B scan 34 ok/0 broken · typecheck clean on all four apps. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
80 lines
3.6 KiB
Bash
80 lines
3.6 KiB
Bash
# Database configuration
|
|
POSTGRES_USER=postgres
|
|
POSTGRES_PASSWORD=postgres
|
|
POSTGRES_DB=goldbank
|
|
|
|
# Host port exposed for PostgreSQL (used by docker-compose db service)
|
|
EXTERNAL_DB_PORT=5432
|
|
|
|
# Prisma connection string (inside Docker network use hostname "db")
|
|
DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Dev server ports — SINGLE SOURCE OF TRUTH for this monorepo.
|
|
# Every app's dev script/config reads its port from here. Do not hardcode a
|
|
# port anywhere else. strictPort is enabled everywhere: if a port below is
|
|
# already taken, the dev server fails with a clear error instead of silently
|
|
# picking another port.
|
|
# ---------------------------------------------------------------------------
|
|
API_PORT=3000
|
|
ADMIN_PANEL_PORT=5180
|
|
USER_APP_PORT=5181
|
|
USER_APP_V2_PORT=5182
|
|
|
|
# API Configuration (kept for any tooling that still reads bare PORT)
|
|
PORT=3000
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Authentication
|
|
# ---------------------------------------------------------------------------
|
|
# Admin JWT signing secret. REQUIRED in any real deployment — without it the
|
|
# API falls back to a well-known development string.
|
|
JWT_SECRET=
|
|
# Admin token lifetime (default 12h).
|
|
JWT_EXPIRES_IN=
|
|
# Customer JWT signing secret. Deliberately SEPARATE from JWT_SECRET so an
|
|
# admin token can never validate as a customer token (T1).
|
|
JWT_CUSTOMER_SECRET=
|
|
# Customer token lifetime (default 30d).
|
|
JWT_CUSTOMER_EXPIRES_IN=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# ⚠ DELIVERY ONLY — REMOVE BEFORE THE REAL RELEASE (D20 / ISSUES REL-01)
|
|
# ---------------------------------------------------------------------------
|
|
# A fixed OTP that signs in ANY active customer, alongside the real code.
|
|
# MUST BE EXACTLY 4 DIGITS: the apps' login box has four single-character
|
|
# inputs and only submits at four (LoginView.vue:43). A longer code still works
|
|
# over the API but cannot be typed into either app.
|
|
# Leave it EMPTY or unset to disable it completely — that is the correct state
|
|
# for production. While it is set, the API prints a warning banner at boot.
|
|
OTP_MASTER_CODE=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# SMS gateway (Trez). Leave blank to disable sending: the server still boots,
|
|
# messages are logged instead of sent, and customers cannot receive a login
|
|
# code (D20). Never commit real values.
|
|
# ---------------------------------------------------------------------------
|
|
# "trez" (default) or "none" to disable explicitly.
|
|
SMS_PROVIDER=
|
|
# Override only for staging; defaults to the provider's live endpoint.
|
|
SMS_TREZ_URL=
|
|
SMS_TREZ_USERNAME=
|
|
SMS_TREZ_PASSWORD=
|
|
SMS_TREZ_SENDER_LINE=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Uploads
|
|
# ---------------------------------------------------------------------------
|
|
# Absolute path for uploaded files; defaults to <api>/storage/uploads.
|
|
UPLOAD_DIR=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Profile completion ("تکمیل پروفایل")
|
|
# ---------------------------------------------------------------------------
|
|
# Comma-separated admin mobiles told when a customer uploads their documents.
|
|
# The reference hardcoded four numbers in its source
|
|
# (henza_server Major/CustomerController::sendSmsToAdmin); they live here
|
|
# instead so no personal number is committed. Blank means nobody is notified —
|
|
# the upload and the customer's own SMS still go through (D20).
|
|
PROFILE_ADMIN_MOBILES=
|