Esa Kataja
41c8a2914f
Step 2 of the build order. The admin mints an invite link, the recipient registers with it, and from then on has a session. - The invite is spent in the same transaction that creates the account, so a failed signup leaves the code usable - Sessions are idle timeouts, 24h or 30 days with remember me, read from a cookie or a bearer header, extended at most once a minute - Ban is a reversible toggle that drops the member's live sessions - No password minimum; login is rate limited instead, 10 failures per email in 15 minutes, cleared by a correct password - Invite codes render as links carrying ?code=, which the register form prefills; PUBLIC_URL makes them pasteable from the loopback admin panel Tests cover invite spending, the idle timeout, ban, and the rate limiter.
12 lines
387 B
Bash
12 lines
387 B
Bash
# Copy to .env and edit. Neither password has a default.
|
|
POSTGRES_PASSWORD=
|
|
ADMIN_USER=admin
|
|
ADMIN_PASSWORD=
|
|
|
|
# Set to false only for local development over plain HTTP.
|
|
SECURE_COOKIES=true
|
|
|
|
# Public address of the member site. Used to build pasteable invite links in the admin panel.
|
|
# Unset falls back to a relative link, which is fine locally.
|
|
PUBLIC_URL=https://levyraati.example.com
|