mirror of
https://github.com/profullstack/logicsrc.git
synced 2026-08-13 22:37:29 +00:00
Anthony Ettinger
9ba044577f
Adds apps/pwa: an Express + libSQL/Turso app that is now the home of team credential sharing, with the moshcode-style auth stack ported and reskinned to match logicsrc.com (light theme, Inter, green accent). apps/pwa - auth: email/password (scrypt), passkeys (WebAuthn), CoinPay OAuth, cookie sessions, and lsk_ API keys for the CLI via a loopback OAuth-PKCE flow (/cli/authorize + /cli/token). Ported from the moshcode PWA. - credshare API (/api/credshare/*): teams, members, invites, vaults, sealed grants, ciphertext secrets, audit — authed by session OR Bearer lsk_ key. Zero-knowledge: only ciphertext + sealed vault keys + public keys stored. - teams dashboard, accept-invite, and settings (API keys) pages, server-rendered in the LogicSRC brand (lib/html.mjs). - migrations (libSQL) 001_auth + 002_credshare, migrate-on-boot; Turso via TURSO_DATABASE_URL / TURSO_AUTH_TOKEN, or a local file db for dev. - trimmed moshcode-specific approvals/credits/push/deliver. CLI - `logicsrc login` now does browser loopback OAuth-PKCE against the app and stores an lsk_ token (email-OTP removed); --token for CI. Client repointed. Distribution - install.sh (served at logicsrc.com/install.sh) installs the CLI from the GitHub repo: tarball -> npm install -> `npm run build:cli` -> logicsrc wrapper. - root build:cli builds only the CLI's workspace chain (skips web/api/next). Cleanup - removed the commandboard-api credshare backend (superseded by the PWA) and its Supabase/Turso stores + libsql dep; commandboard-api tests green (40). - removed the Next.js /teams page (the PWA is the web UI now). Verified end-to-end: two accounts register on the PWA, mint lsk_ keys, CLI login uploads identity keys, owner pushes an encrypted .env, teammate invited -> accepted -> granted -> pulls the exact file. Server stores ciphertext only. Full workspace build + tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
64 lines
2.5 KiB
JavaScript
64 lines
2.5 KiB
JavaScript
// Central config. Reads .env (if present) with zero deps, then process.env wins.
|
|
import fs from "node:fs";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
|
|
|
|
// Tiny .env loader — does not override anything already in the environment.
|
|
function loadEnv() {
|
|
const file = path.join(ROOT, ".env");
|
|
if (!fs.existsSync(file)) return;
|
|
for (const line of fs.readFileSync(file, "utf8").split("\n")) {
|
|
const m = /^\s*([A-Z0-9_]+)\s*=\s*(.*)\s*$/i.exec(line);
|
|
if (!m) continue;
|
|
const key = m[1];
|
|
if (process.env[key] !== undefined) continue;
|
|
let val = m[2];
|
|
if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
|
|
val = val.slice(1, -1);
|
|
}
|
|
process.env[key] = val;
|
|
}
|
|
}
|
|
loadEnv();
|
|
|
|
const origin = (process.env.PUBLIC_ORIGIN || `http://localhost:${process.env.PORT || 8080}`).replace(/\/+$/, "");
|
|
const rpID = new URL(origin).hostname;
|
|
|
|
export const config = {
|
|
root: ROOT,
|
|
env: process.env.NODE_ENV || "development",
|
|
port: Number(process.env.PORT || 8080),
|
|
origin,
|
|
// WebAuthn relying party = this host.
|
|
rpID,
|
|
rpName: "LogicSRC",
|
|
sessionSecret: process.env.SESSION_SECRET || "dev-insecure-secret-change-me",
|
|
db: {
|
|
// Turso (libSQL) in prod; a local file for dev. TURSO_* takes precedence.
|
|
url: process.env.TURSO_DATABASE_URL || process.env.DATABASE_URL || "file:./data/local.db",
|
|
authToken: process.env.TURSO_AUTH_TOKEN || process.env.DATABASE_AUTH_TOKEN || undefined,
|
|
},
|
|
resend: {
|
|
apiKey: process.env.RESEND_API_KEY || "",
|
|
from: process.env.CREDSHARE_EMAIL_FROM || process.env.RESEND_FROM || "LogicSRC <noreply@logicsrc.com>",
|
|
},
|
|
coinpay: {
|
|
apiBase: (process.env.COINPAY_API_BASE || "https://coinpayportal.com").replace(/\/+$/, ""),
|
|
businessId: process.env.COINPAY_BUSINESS_ID || "",
|
|
webhookSecret: process.env.COINPAY_WEBHOOK_SECRET || "",
|
|
oauth: {
|
|
authorizeUrl: process.env.COINPAY_OAUTH_AUTHORIZE_URL || "",
|
|
tokenUrl: process.env.COINPAY_OAUTH_TOKEN_URL || "",
|
|
userinfoUrl: process.env.COINPAY_OAUTH_USERINFO_URL || "",
|
|
clientId: process.env.COINPAY_OAUTH_CLIENT_ID || "",
|
|
redirectUri: `${origin}/auth/coinpay/callback`,
|
|
scope: process.env.COINPAY_OAUTH_SCOPE || "openid profile",
|
|
},
|
|
},
|
|
get coinpayLoginEnabled() {
|
|
return Boolean(this.coinpay.oauth.authorizeUrl && this.coinpay.oauth.clientId);
|
|
},
|
|
secure: (process.env.NODE_ENV || "development") === "production",
|
|
};
|