Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-26 18:42:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(auth): deny by default with employee/customer audience guards

Browse Source 
FreightPermissionGuard now rejects non-employee user types before the key
check, making every BookingStaff route staff-only in one place. Adds
PortalCustomer and MixedAudience for the routes both audiences share, and
stops ServiceAuthGuard failing open when SERVICE_AUTH_TOKEN is unset.
This commit is contained in:
Nathnael
2026-08-07 07:31:08 +00:00
parent 828392dd04
commit 79fec14c9a
4 changed files with 110 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
apps/edr-freight-api/.env.example
View File

@@ -122,3 +122,7 @@ FAYDA_SESSION_TTL_MINUTES=10
EXPIRATION_TIME=15
ALGORITHM=RS256
EMAIL_QUEUE=email_queue
# Shared secret for service-to-service calls (payment microservice <-> freight).
# Required at boot; set ALLOW_UNAUTH_INTERNAL=true instead ONLY for local dev.
SERVICE_AUTH_TOKEN=change-me