75293f39bc
- Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos - Migration 002_identity: identity_users + identity_sessions (token hash only) - Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL - Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax - LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown - Anti-enumeration: identical generic 401 + dummy-hash timing equalization - buildApp gains optional pool/cookieSecure; foundation-only app preserved - 47 unit + 14 integration tests; live smoke covers all acceptance criteria
14 lines
680 B
Plaintext
14 lines
680 B
Plaintext
# Copy to .env for local development. Real .env is gitignored.
|
|
# Matches docker-compose.yml dev credentials (dev-only, never reuse elsewhere).
|
|
DATABASE_URL=postgres://mdv:mdv_dev_only@localhost:5432/mercadodevida
|
|
TEST_DATABASE_URL=postgres://mdv:mdv_dev_only@localhost:5432/mercadodevida_test
|
|
REDIS_URL=redis://localhost:6379
|
|
|
|
# Feature flags: FLAG_<NAME>=true|false (parsed into the flag store at boot).
|
|
# Unknown flags default to OFF. Flags can be flipped at runtime via the store.
|
|
FLAG_EXAMPLE_FEATURE=false
|
|
|
|
# Session cookie Secure flag. Defaults to true (production-safe); set false only
|
|
# for local http development where browsers reject Secure cookies.
|
|
COOKIE_SECURE=false
|