Leon SerfatyandClaude Fable 5
97e1d4c60b
Storage - Migrate document/media storage from local disk to DigitalOcean Spaces (S3); lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required. - Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time). Security hardening (all report findings) - DB pool fails closed in production when the CA cert is missing (no more silent unverified TLS); warns in dev. - trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits. - Login lockout keyed by (email, ip) so an attacker can't lock out a victim. - Superadmin auto-grant now requires a verified email. - CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt. - Upload content-sniffing (magic bytes) rejects spoofed MIME types. - create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED. Production-blocker fixes - SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache. - Invoice numbering is transaction-safe (per-firm advisory lock + max sequence), eliminating concurrent collisions and delete-reuse — no schema change. - Checkout guards against double-billing a firm already on a paid plan. - Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps). Honesty / trust - Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA, and the login-panel stats; replace with non-fabricated copy. - Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.) Quality - Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
63 lines
3.5 KiB
Bash
63 lines
3.5 KiB
Bash
# ─────────────────────────────────────────────
|
|
# Server
|
|
# ─────────────────────────────────────────────
|
|
NODE_ENV=development
|
|
PORT=8080
|
|
PUBLIC_URL=http://localhost:8080
|
|
COOKIE_DOMAIN=
|
|
|
|
# 32+ random bytes, hex. Generate: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
SESSION_SECRET=replace-me-with-32-byte-hex
|
|
CSRF_SECRET=replace-me-with-32-byte-hex
|
|
|
|
# Comma-separated emails. Any user with one of these emails is auto-promoted to superadmin
|
|
# on login/signup and gains access to /admin.
|
|
SUPERADMIN_EMAILS=
|
|
|
|
# ─────────────────────────────────────────────
|
|
# DigitalOcean Managed Postgres
|
|
# ─────────────────────────────────────────────
|
|
# Format: postgresql://user:pass@host:25060/dbname?sslmode=require
|
|
DATABASE_URL=postgresql://doadmin:password@db-postgresql-nyc1-xxxxx.b.db.ondigitalocean.com:25060/defaultdb?sslmode=require
|
|
DATABASE_CA_CERT_PATH=./certs/do-ca.crt
|
|
|
|
# ─────────────────────────────────────────────
|
|
# Object storage — DigitalOcean Spaces (S3-compatible). Sole storage backend (required).
|
|
# Create a Space + access keys in the DO console. Endpoint is the REGION endpoint
|
|
# (no bucket prefix); the SDK adds the bucket as a virtual host.
|
|
# ─────────────────────────────────────────────
|
|
SPACES_ENDPOINT=https://nyc3.digitaloceanspaces.com
|
|
SPACES_REGION=nyc3
|
|
SPACES_BUCKET=elegalsoftware
|
|
SPACES_KEY=
|
|
SPACES_SECRET=
|
|
# Optional CDN/base URL for public objects; leave blank to serve everything through the API.
|
|
SPACES_PUBLIC_BASE=
|
|
|
|
# Legacy local path — only read by scripts/migrate-storage-to-spaces.ts during a one-time migration.
|
|
STORAGE_PATH=./storage
|
|
|
|
# ─────────────────────────────────────────────
|
|
# Email (SMTP2GO) — sends all platform email via the HTTP API.
|
|
# Create an API key in the SMTP2GO dashboard (Settings → API Keys).
|
|
# EMAIL_FROM's domain must be a verified sender domain in SMTP2GO.
|
|
# Leave the key blank in dev to log emails instead of sending.
|
|
# ─────────────────────────────────────────────
|
|
SMTP2GO_API_KEY=
|
|
EMAIL_FROM="eLegal Software <noreply@yourdomain.com>"
|
|
|
|
# ─────────────────────────────────────────────
|
|
# Stripe
|
|
# ─────────────────────────────────────────────
|
|
STRIPE_SECRET_KEY=
|
|
STRIPE_WEBHOOK_SECRET=
|
|
STRIPE_PRICE_PRO=
|
|
STRIPE_PRICE_LIFETIME=
|
|
|
|
# ─────────────────────────────────────────────
|
|
# Sentry (optional — leave blank to disable error reporting)
|
|
# ─────────────────────────────────────────────
|
|
SENTRY_DSN_API=
|
|
# Web DSN must be exposed to the browser bundle, so prefix with VITE_
|
|
VITE_SENTRY_DSN=
|