valentinbvro
5a1206118a
Both guards were fully implemented but never actually wired in -- Nest doesn't enforce a guard just because its module is imported, it needs an explicit APP_GUARD registration. Registered both globally so every new controller is deny-by-default and rate-limited unless it opts out. Added a @Public() decorator (checked via Reflector in TenantGuard) for routes that legitimately have no session, applied it to /health so the global guard doesn't break it. CORS was wide open (enableCors() with no origin restriction, effectively allow-any-origin). Now reads an explicit CORS_ORIGINS allowlist from env, defaulting to localhost:3000 for local dev.
30 lines
500 B
Text
30 lines
500 B
Text
NODE_ENV=development
|
|
PORT=3001
|
|
|
|
# Comma-separated list of allowed browser origins for CORS -- never use a wildcard in production
|
|
CORS_ORIGINS=http://localhost:3000
|
|
|
|
# Supabase (CEO-OS project, Coolify)
|
|
DATABASE_URL=
|
|
SUPABASE_URL=
|
|
SUPABASE_ANON_KEY=
|
|
SUPABASE_SERVICE_ROLE_KEY=
|
|
|
|
# Redis (ceo-os-redis, Coolify)
|
|
REDIS_URL=
|
|
|
|
APP_ENCRYPTION_KEY=
|
|
JWT_SECRET=
|
|
COOKIE_SECRET=
|
|
|
|
AI_GATEWAY_URL=
|
|
AI_GATEWAY_API_KEY=
|
|
|
|
N8N_BASE_URL=
|
|
N8N_WEBHOOK_SECRET=
|
|
|
|
SMTP_HOST=
|
|
SMTP_PORT=
|
|
SMTP_USER=
|
|
SMTP_PASSWORD=
|
|
SMTP_FROM=
|