Jennie Robinson Faber
26c300c357
Auth: Add requireAuth/requireAdmin guards with JWT cookie verification, member status checks (suspended/cancelled = 403), and admin role enforcement. Apply to all admin, upload, and payment endpoints. Add role field to Member model. CSRF: Double-submit cookie middleware with client plugin. Exempt webhook and magic-link verify routes. Headers: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy on all responses. HSTS and CSP (Helcim/Cloudinary/Plausible sources) in production only. Rate limiting: Auth 5/5min, payment 10/min, upload 10/min, general 100/min via rate-limiter-flexible, keyed by client IP. XSS: DOMPurify sanitization on marked() output with tag/attr allowlists. escapeHtml() utility for email template interpolation. Anti-enumeration: Login returns identical response for existing and non-existing emails. Remove 404 handling from login UI components. Mass assignment: Remove helcimCustomerId from profile allowedFields. Session: 7-day token expiry, refresh endpoint, httpOnly+secure cookies. Environment: Validate required secrets on startup via server plugin. Remove JWT_SECRET hardcoded fallback.
34 lines
1.3 KiB
TypeScript
34 lines
1.3 KiB
TypeScript
// https://nuxt.com/docs/api/configuration/nuxt-config
|
|
export default defineNuxtConfig({
|
|
compatibilityDate: "2025-07-15",
|
|
devtools: { enabled: process.env.NODE_ENV !== 'production' },
|
|
modules: ["@nuxt/eslint", "@nuxt/ui", "@nuxtjs/plausible"],
|
|
build: {
|
|
transpile: ["vue-cal"],
|
|
},
|
|
plausible: {
|
|
domain: "ghostguild.org",
|
|
},
|
|
css: ["~/assets/css/main.css"],
|
|
runtimeConfig: {
|
|
// Private keys (server-side only)
|
|
mongodbUri:
|
|
process.env.MONGODB_URI || "mongodb://localhost:27017/ghostguild",
|
|
jwtSecret: process.env.JWT_SECRET || "",
|
|
resendApiKey: process.env.RESEND_API_KEY || "",
|
|
helcimApiToken: process.env.HELCIM_API_TOKEN || "",
|
|
slackBotToken: process.env.SLACK_BOT_TOKEN || "",
|
|
slackSigningSecret: process.env.SLACK_SIGNING_SECRET || "",
|
|
slackVettingChannelId: process.env.SLACK_VETTING_CHANNEL_ID || "",
|
|
|
|
// Public keys (available on client-side)
|
|
public: {
|
|
helcimToken: process.env.NUXT_PUBLIC_HELCIM_TOKEN || "",
|
|
helcimAccountId: process.env.NUXT_PUBLIC_HELCIM_ACCOUNT_ID || "",
|
|
cloudinaryCloudName:
|
|
process.env.NUXT_PUBLIC_CLOUDINARY_CLOUD_NAME || "divzuumlr",
|
|
appUrl: process.env.NUXT_PUBLIC_APP_URL || "http://localhost:3000",
|
|
comingSoon: process.env.NUXT_PUBLIC_COMING_SOON || "false",
|
|
},
|
|
},
|
|
});
|