9f912aed24
Added comprehensive authentication and authorization system: Authentication System: - Better Auth integration with session management - Login/logout pages and API routes - Middleware for route protection - Auth utilities and client libraries User Management: - User list, detail, and invite pages - User API endpoints (CRUD operations) - Session management for users - Profile settings page Role-Based Access Control: - Role management pages (list, create, edit) - Permission system with granular controls - Role assignment to users - Role API endpoints Admin Features: - Audit log page for tracking system events - Admin settings page - Audit service for logging user actions Additional Features: - Quotes management pages and components - SalesBldr API integration - Email service for notifications Configuration & Documentation: - Updated docker-compose.yml - MCP server configuration (mcp.json) - CVE-2025-55182 security review documentation - Standards guide and PRD documents - Re-enabling authentication documentation Database Migrations: - 012: Auth tables (users, sessions, accounts, verifications) - 013: Role tables (roles, permissions, role_permissions, user_roles) - 014: Admin settings table UI Updates: - Updated dashboard layout - Enhanced app layout with auth integration
92 lines
2.2 KiB
TypeScript
92 lines
2.2 KiB
TypeScript
import { betterAuth } from "better-auth";
|
|
import { magicLink, twoFactor, admin } from "better-auth/plugins";
|
|
import { nextCookies } from "better-auth/next-js";
|
|
import { Pool } from "pg";
|
|
import { sendMagicLinkEmail } from "./services/email";
|
|
import { ac, adminRole, userRole, superAdminRole } from "./permissions";
|
|
|
|
// Create a PostgreSQL pool for Better Auth
|
|
const pool = new Pool({
|
|
connectionString: process.env.DATABASE_URL,
|
|
});
|
|
|
|
export const auth = betterAuth({
|
|
database: pool,
|
|
appName: "Pulse",
|
|
baseURL: process.env.BETTER_AUTH_URL,
|
|
secret: process.env.BETTER_AUTH_SECRET,
|
|
trustedOrigins: [
|
|
"http://localhost:3100",
|
|
"https://pulse.wulfconsulting.cloud"
|
|
],
|
|
|
|
// Email & Password disabled - using magic link and Microsoft OAuth only
|
|
emailAndPassword: {
|
|
enabled: false,
|
|
},
|
|
|
|
// Session configuration
|
|
session: {
|
|
expiresIn: parseInt(process.env.SESSION_TIMEOUT_SECONDS || "86400"),
|
|
updateAge: 60 * 60, // Update session every hour
|
|
cookieCache: {
|
|
enabled: true,
|
|
maxAge: 5 * 60, // 5 minutes
|
|
},
|
|
},
|
|
|
|
// Social providers
|
|
socialProviders: {
|
|
microsoft: {
|
|
clientId: process.env.MICROSOFT_CLIENT_ID || "",
|
|
clientSecret: process.env.MICROSOFT_CLIENT_SECRET || "",
|
|
tenantId: process.env.MICROSOFT_TENANT_ID || "common",
|
|
},
|
|
},
|
|
|
|
// Plugins
|
|
plugins: [
|
|
// Magic link authentication
|
|
magicLink({
|
|
sendMagicLink: async ({ email, url, token }) => {
|
|
await sendMagicLinkEmail({ email, url, token });
|
|
},
|
|
expiresIn: 300, // 5 minutes
|
|
}),
|
|
|
|
// Two-factor authentication
|
|
twoFactor({
|
|
issuer: "Pulse",
|
|
}),
|
|
|
|
// Admin plugin with RBAC
|
|
admin({
|
|
ac,
|
|
roles: {
|
|
"super-admin": superAdminRole,
|
|
admin: adminRole,
|
|
user: userRole,
|
|
},
|
|
}),
|
|
|
|
// Next.js cookie handling - must be last
|
|
nextCookies(),
|
|
],
|
|
|
|
// User configuration
|
|
user: {
|
|
additionalFields: {
|
|
role: {
|
|
type: "string",
|
|
defaultValue: "user",
|
|
},
|
|
requires_setup: {
|
|
type: "boolean",
|
|
defaultValue: false,
|
|
},
|
|
},
|
|
},
|
|
});
|
|
|
|
export type Session = typeof auth.$Infer.Session;
|
|
export type User = typeof auth.$Infer.Session.user;
|