2 Commits

Author	SHA1	Message	Date
simone	a478462aa4	security: full hardening pass — auth guards, rate limiting, headers, internal secret ... - Add requireAdmin() to all unprotected admin server actions (clients/new, clients/[id], timer-actions — 17 functions total) - Protect /api/internal/* endpoints with X-Internal-Secret header (proxy.ts sends it; routes reject requests without it) - Randomize auto-generated client slugs with 4-char suffix to prevent enumeration via predictable name-based slugs - Add in-memory rate limiting to /api/client/approve (20/min) and /api/client/comment (10/min) per IP - Add security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-DNS-Prefetch-Control - Reduce JWT session from 30 days to 7 days with daily rotation - Remove hardcoded NEXTAUTH_URL from Dockerfile (pass via Coolify env) - Genericize client API error messages to not leak data structure - Update .env.example with all required variables including INTERNAL_SECRET Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-22 14:36:16 +02:00
Simone Cavalli	5d363a633d	feat(02-01): install next-auth@4, configure CredentialsProvider auth ... - Add next-auth@4 dependency (stable v4, not beta v5) - Create src/lib/auth.ts with CredentialsProvider validating ADMIN_EMAIL/ADMIN_PASSWORD env vars - Create src/app/api/auth/[...nextauth]/route.ts catch-all handler (GET + POST) - JWT session strategy — stateless, no DB users table - Custom sign-in page set to /admin/login - Add NEXTAUTH_URL, NEXTAUTH_SECRET, ADMIN_EMAIL, ADMIN_PASSWORD to .env.local	2026-05-15 10:40:30 +02:00