s.esmaeiliandCursor c34bf80e6f fix(api): start in production with safe fallbacks instead of crash-looping (502) ...

A production API with incomplete config threw before listening, so the
container restarted forever and every /api request through nginx was a 502.
The problems are now printed as one loud warning and each gets a safe
fallback:

- JWT_SECRET / JWT_CUSTOMER_SECRET missing, weak or equal: a random key is
  generated once and kept in the Setting table (boot-secrets.ts), so tokens
  survive restarts. A strong value in the environment always wins.
  JwtModule now uses registerAsync so it reads the key after boot fills it.
- OTP_MASTER_CODE: ignored in production unless
  TEST_SERVER_ALLOW_MASTER_CODE=yes.
- CORS_ORIGINS: invalid entries dropped; empty allows every origin.

Tests: boot-secrets.spec, production-checks.spec. 118 tests pass.

سرور با تنظیمات ناقص دیگر مدام ریست نمی‌شود و ورود دوباره کار می‌کند.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-10-10 16:19:30 +03:30

.cursor/rules

fix some for iam

2026-10-07 16:45:36 +03:30

.idea

fix add new version of user in app

2026-09-18 17:16:36 +03:30

apps

fix(api): start in production with safe fallbacks instead of crash-looping (502)

2026-10-10 16:19:30 +03:30

docs

fix(api): start in production with safe fallbacks instead of crash-looping (502)

2026-10-10 16:19:30 +03:30

henza_admin @ 1b67448143

md app

2026-10-04 20:11:09 +03:30

henza_pwa @ b171ffffb5

md app

2026-10-04 20:11:09 +03:30

henza_server @ 37c7d7a92f

md app

2026-10-04 20:11:09 +03:30

iranSans

SearchView: Removed the dynamic collection-tile grid (e.g. "پرفروش‌های این هفته") and the "نتایج / N محصول" section header from the UI. Underlying data/filtering logic untouched.

2026-09-18 12:54:45 +03:30

packages/shared-types

chore(release): prepare release/delivery + fix docker env passthrough

2026-09-23 00:30:09 +03:30

scripts

feat(apps): version on every build, a «what changed» modal, and a clean update

2026-10-10 12:45:52 +03:30

.dockerignore

Fix some for production

2026-09-10 12:17:47 +03:30

.env.example

Merge release/delivery (IAM single sign-on) into the triage work

2026-10-10 09:03:53 +03:30

.gitignore

chore: keep the live henza data dump out of git

2026-10-07 19:35:01 +03:30

DELIVERY.md

fix(security): a production server refuses to start until its keys, allowed origins and test login are right (REL-01, REL-03, SEC-04)

2026-10-08 17:00:17 +03:30

docker-compose.delivery-test.yml

fix(api): treat blank env vars as unset; verify the whole flow in Docker Compose

2026-09-23 02:27:30 +03:30

docker-compose.yml

Merge release/delivery (IAM single sign-on) into the triage work

2026-10-10 09:03:53 +03:30

DOCKER.md

fix add new version of user in app

2026-09-18 17:16:36 +03:30

nginx-spa.conf

feat(apps): version on every build, a «what changed» modal, and a clean update

2026-10-10 12:45:52 +03:30

oapi-struncture.sql

feat: accounting integration (D27), SMS relay driver (D26), rebuild user apps

2026-10-06 16:48:36 +03:30

package.json

fix add new version of user in app

2026-09-18 17:16:36 +03:30

pnpm-lock.yaml

chore(apps): remove unused code and packages (DEAD-01, DEAD-02, DEAD-03)

2026-10-08 16:40:10 +03:30

pnpm-workspace.yaml

feat: initial commit

2026-09-09 06:46:27 +03:30

tsconfig.base.json

feat: initial commit

2026-09-09 06:46:27 +03:30

turbo.json

feat: initial commit

2026-09-09 06:46:27 +03:30

S

Description

No description provided

113 MiB

Languages

JavaScript 69.8%

TypeScript 15.2%

Vue 13.9%

Less 0.6%

PLpgSQL 0.3%

Other 0.1%