Simo
e668fa85ec
Auth (hand-built on the auth core): - 2FA: User model gains two_factor_secret/recovery_codes/confirmed_at (+ idempotent MariaDB migration). authorize() requires a valid TOTP code when 2FA is confirmed (secret decrypted via Laravel APP_KEY, fail-closed). Two-step login (precheckLogin reveals the code field). /settings/2fa enable/confirm/disable flow. - Password reset: nodemailer email service; PasswordReset model + migration; /forgot (request, generic response) + /reset (token sha256 + 1h TTL, sets argon2id hash). Login links to forgot. Batch 7 (parallel agents): /admin/commandocentrum (RCON controls + emulator_errors), social write actions (friend request + guild forum new thread), /help/[category], /badges (public). env: APP_KEY, APP_URL, SMTP_*. Nav extended. Verified: tsc exit 0, vitest 48/48, next build exit 0 (64 page routes).
52 lines
2.3 KiB
TypeScript
52 lines
2.3 KiB
TypeScript
import { z } from "zod";
|
|
|
|
// Minimal validated env for the foundation. When the Next.js app is added this
|
|
// will move to @t3-oss/env-nextjs (the habbo-next pattern), but the data layer
|
|
// only needs the DB connection + a couple of values today.
|
|
const schema = z.object({
|
|
NODE_ENV: z.enum(["development", "test", "production"]).default("development"),
|
|
DATABASE_URL: z.string().url(),
|
|
DATABASE_POOL_SIZE: z.coerce.number().int().positive().default(40),
|
|
DATABASE_IDLE_TIMEOUT_MS: z.coerce.number().int().positive().default(300_000),
|
|
DATABASE_CONNECT_TIMEOUT_MS: z.coerce.number().int().positive().default(10_000),
|
|
HOTEL_NAME: z.string().default("Atom"),
|
|
APP_URL: z.string().url().default("http://localhost:3000"),
|
|
// SMTP (password reset / notifications). Email features no-op if unset.
|
|
SMTP_HOST: z.string().optional(),
|
|
SMTP_PORT: z.coerce.number().int().positive().optional(),
|
|
SMTP_SECURE: z
|
|
.string()
|
|
.optional()
|
|
.transform((v) => v === "true" || v === "1"),
|
|
SMTP_USER: z.string().optional(),
|
|
SMTP_PASSWORD: z.string().optional(),
|
|
SMTP_FROM: z.string().optional(),
|
|
// RCON link to the Arcturus emulator (raw-JSON TCP protocol).
|
|
RCON_HOST: z.string().default("127.0.0.1"),
|
|
RCON_PORT: z.coerce.number().int().positive().default(3001),
|
|
RCON_TIMEOUT_MS: z.coerce.number().int().positive().default(10_000),
|
|
RCON_MAX_RETRIES: z.coerce.number().int().positive().default(3),
|
|
// NextAuth v5 reads AUTH_SECRET itself; declared here for documentation/typing.
|
|
AUTH_SECRET: z.string().min(1).optional(),
|
|
// Laravel APP_KEY (base64:...) — needed to read existing 2FA secrets.
|
|
APP_KEY: z.string().optional(),
|
|
// Optional OAuth providers (enabled only when both id+secret are set).
|
|
DISCORD_CLIENT_ID: z.string().optional(),
|
|
DISCORD_CLIENT_SECRET: z.string().optional(),
|
|
GOOGLE_CLIENT_ID: z.string().optional(),
|
|
GOOGLE_CLIENT_SECRET: z.string().optional(),
|
|
// Mirrors Laravel config('habbo.site.convert_passwords') — enables md5->argon2id.
|
|
CONVERT_PASSWORDS: z
|
|
.string()
|
|
.optional()
|
|
.transform((v) => v === "true" || v === "1"),
|
|
});
|
|
|
|
type Env = z.infer<typeof schema>;
|
|
|
|
// SKIP_ENV_VALIDATION lets tooling (typecheck, tests that don't touch the DB)
|
|
// import modules transitively without a populated .env.
|
|
export const env: Env = process.env.SKIP_ENV_VALIDATION
|
|
? (process.env as unknown as Env)
|
|
: schema.parse(process.env);
|