3268cf2100
Review follow-ups: the ?save=1 archive route required orders.export while the save that triggers it only needs orders.edit, so an editor's fire-and-forget archive 403'd silently. Use requireAnyPermission(orders.view, orders.export) to match invoices-pdf (invoices.view). Also refresh .env.example for the split vars. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
64 lines
3.7 KiB
Plaintext
64 lines
3.7 KiB
Plaintext
# ─────────────────────────────────────────────────────────────────────────
|
|
# boha-app-ts environment template. Copy to `.env` (dev) / `.env.test` (tests).
|
|
# Required vars throw at boot if missing; optional vars show their defaults.
|
|
# ─────────────────────────────────────────────────────────────────────────
|
|
|
|
# ── Required ──────────────────────────────────────────────────────────────
|
|
DATABASE_URL=mysql://user:password@localhost:3306/app
|
|
# Auth — MUST regenerate for production: openssl rand -hex 32
|
|
JWT_SECRET=REPLACE_WITH_64_CHAR_HEX_STRING_RUN_openssl_rand_hex_32
|
|
# TOTP — MUST regenerate for production: openssl rand -hex 32
|
|
TOTP_ENCRYPTION_KEY=REPLACE_WITH_64_CHAR_HEX_STRING_RUN_openssl_rand_hex_32
|
|
|
|
# ── Server ────────────────────────────────────────────────────────────────
|
|
PORT=3001 # production port (dev is hardcoded to 3050)
|
|
HOST=127.0.0.1
|
|
APP_ENV=local # local | production — controls CSP/CORS/HSTS
|
|
APP_URL= # base URL used in email links
|
|
# TRUST_PROXY=127.0.0.1,::1 # comma-separated trusted proxy IPs
|
|
|
|
# ── Tokens (seconds) ──────────────────────────────────────────────────────
|
|
ACCESS_TOKEN_EXPIRY=900
|
|
REFRESH_TOKEN_SESSION_EXPIRY=3600
|
|
REFRESH_TOKEN_REMEMBER_EXPIRY=2592000
|
|
|
|
# ── TOTP / 2FA (optional, sensible defaults) ──────────────────────────────
|
|
# TOTP_ALGORITHM=SHA1
|
|
# TOTP_DIGITS=6
|
|
# TOTP_PERIOD=30
|
|
# LOGIN_TOKEN_EXPIRY_MINUTES=5
|
|
|
|
# ── Rate limiting (optional) ──────────────────────────────────────────────
|
|
# RATE_LIMIT_MAX=300
|
|
# RATE_LIMIT_WINDOW=1 minute
|
|
# RATE_LIMIT_LOGIN=20
|
|
# RATE_LIMIT_TOTP=5
|
|
# RATE_LIMIT_REFRESH=10
|
|
|
|
# ── File storage (NAS network shares) ─────────────────────────────────────
|
|
NAS_PATH=Z:/02_PROJEKTY
|
|
# NAS_INVOICES= # invoice PDFs — {base}/Vydané|Přijaté/YYYY/MM/ (falls back to NAS_FINANCIALS_PATH if unset)
|
|
# NAS_ORDERS= # issued-order PDF archival — {base}/Vydané/YYYY/MM/ (off until set)
|
|
# NAS_OFFERS_PATH=
|
|
MAX_UPLOAD_SIZE=52428800 # 50 MB
|
|
|
|
# ── Email ─────────────────────────────────────────────────────────────────
|
|
CONTACT_EMAIL_TO=
|
|
CONTACT_EMAIL_FROM=
|
|
SMTP_FROM=
|
|
# SMTP_FROM_NAME=
|
|
LEAVE_NOTIFY_EMAIL=
|
|
# INVOICE_ALERT_EMAIL= # set to enable the daily 08:00 invoice-alert cron
|
|
# Optional SMTP transport (defaults to local sendmail when SMTP_HOST is unset):
|
|
# SMTP_HOST=
|
|
# SMTP_PORT=587
|
|
# SMTP_SECURE=false
|
|
# SMTP_USER=
|
|
# SMTP_PASS=
|
|
|
|
# ── CORS (production only, comma-separated) ───────────────────────────────
|
|
CORS_ORIGINS=
|
|
|
|
# ── AI assistant "Odin" (optional; feature self-hides when unset) ─────────
|
|
# ANTHROPIC_API_KEY=
|