mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 07:41:23 +00:00
Tomas DvorakandDevin
c6166de886
Self-hosted instances are now email/password only — OAuth providers (GitHub/Google/Discord/Microsoft) activate solely when PRIMORA_MANAGED=true, reserved for the future hosted tier. Sign-up lifecycle: the first public sign-up becomes the instance admin; after bootstrap, sign-up closes by default. A better-auth databaseHook gates only /sign-up/email, so admin-created users and OAuth flows bypass it. The login page reads GET /instance/public to hide the sign-up tab, show the bootstrap notice, and render only the providers the instance offers. Instance settings live in core.settings (migration 00010) and resolve in-app > env > built-in default, cached 15s. Platform admins (better-auth user.role) manage sign-up, mail transport, and rate limits via GET/PUT/DELETE /instance/settings or the new Settings → Instance tab. Secret values are AES-256-GCM encrypted at rest with PRIMORA_ENCRYPTION_KEY, never returned by the API, and decrypted by the auth service at send time. Auth service reads the same settings table for the sign-up gate and mail config, so in-app changes take effect without a restart. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
61 lines
2.3 KiB
TypeScript
61 lines
2.3 KiB
TypeScript
import { z } from "zod";
|
|
|
|
const envSchema = z.object({
|
|
NODE_ENV: z.string().default("development"),
|
|
AUTH_PORT: z.string().default("3001"),
|
|
DATABASE_URL: z.string().min(1),
|
|
DRAGONFLY_URL: z.string().default("redis://localhost:6379/0"),
|
|
BETTER_AUTH_SECRET: z.string().min(16),
|
|
BETTER_AUTH_URL: z.string().url(),
|
|
AUTH_BASE_URL: z.string().url().optional(),
|
|
VITE_APP_URL: z.string().url(),
|
|
JWT_ISSUER: z.string().min(1),
|
|
JWT_AUDIENCE: z.string().min(1),
|
|
JWT_TTL_SECONDS: z.string().default("900"),
|
|
MAIL_FROM: z.string().min(1),
|
|
RESEND_API_KEY: z.string().optional(),
|
|
SMTP_HOST: z.string().optional(),
|
|
SMTP_PORT: z.string().default("1025"),
|
|
SMTP_USER: z.string().optional(),
|
|
SMTP_PASSWORD: z.string().optional(),
|
|
// Managed tier flag — OAuth providers only activate when this is "true".
|
|
// Self-hosted instances are email/password only.
|
|
PRIMORA_MANAGED: z.string().optional(),
|
|
// Bootstrap override for public sign-up. Without it (or an in-app setting),
|
|
// sign-up is closed once the first user exists.
|
|
SIGNUP_ENABLED: z.string().optional(),
|
|
// Decrypts secret instance settings written by the backend (mail keys etc.).
|
|
PRIMORA_ENCRYPTION_KEY: z.string().optional(),
|
|
SMTP_SECURE: z.string().optional(),
|
|
GITHUB_CLIENT_ID: z.string().optional(),
|
|
GITHUB_CLIENT_SECRET: z.string().optional(),
|
|
GOOGLE_CLIENT_ID: z.string().optional(),
|
|
GOOGLE_CLIENT_SECRET: z.string().optional(),
|
|
DISCORD_CLIENT_ID: z.string().optional(),
|
|
DISCORD_CLIENT_SECRET: z.string().optional(),
|
|
MICROSOFT_CLIENT_ID: z.string().optional(),
|
|
MICROSOFT_CLIENT_SECRET: z.string().optional(),
|
|
MICROSOFT_TENANT_ID: z.string().optional(),
|
|
AUTH_ADMIN_EMAILS: z.string().optional(),
|
|
});
|
|
|
|
const parsed = envSchema.safeParse(process.env);
|
|
|
|
if (!parsed.success) {
|
|
throw new Error(
|
|
"Invalid auth environment:\n" + JSON.stringify(parsed.error.flatten().fieldErrors, null, 2),
|
|
);
|
|
}
|
|
|
|
export const env = {
|
|
...parsed.data,
|
|
AUTH_PORT: Number(parsed.data.AUTH_PORT),
|
|
JWT_TTL_SECONDS: Number(parsed.data.JWT_TTL_SECONDS),
|
|
SMTP_PORT: Number(parsed.data.SMTP_PORT),
|
|
AUTH_BASE_URL: parsed.data.AUTH_BASE_URL ?? parsed.data.BETTER_AUTH_URL,
|
|
PRIMORA_MANAGED: parsed.data.PRIMORA_MANAGED === "true",
|
|
SIGNUP_ENABLED: parsed.data.SIGNUP_ENABLED === "true",
|
|
SMTP_SECURE: parsed.data.SMTP_SECURE === "true",
|
|
};
|
|
|