mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Phase 3: Backend Hardening #414

New Issue
Closed
opened 2026-02-16 16:56:52 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-02-16 16:56:52 +00:00
Owner
Copy Link

Parent Epic: #411

Stories

  • 3.1 Extract trustedOrigins to getTrustedOrigins() with env vars
  • 3.2 Align CORS config in main.ts to use same origin list
  • 3.3 Update session config: 7d absolute, 2h idle timeout, explicit cookie attributes
  • 3.4 Add TRUSTED_ORIGINS, COOKIE_DOMAIN to .env.example

Acceptance Criteria

  • trustedOrigins from env vars (NEXT_PUBLIC_APP_URL, NEXT_PUBLIC_API_URL, TRUSTED_ORIGINS)
  • CORS and trustedOrigins use same origin list
  • Session: expiresIn=7d, updateAge=2h, httpOnly, secure, sameSite=lax
  • .env.example documents new variables
  • All new code has tests (85%+ coverage)
  • pnpm lint && pnpm typecheck && pnpm test pass

Files

  • apps/api/src/auth/auth.config.ts
  • apps/api/src/main.ts
  • .env.example
## Parent Epic: #411 ## Stories - **3.1** Extract trustedOrigins to getTrustedOrigins() with env vars - **3.2** Align CORS config in main.ts to use same origin list - **3.3** Update session config: 7d absolute, 2h idle timeout, explicit cookie attributes - **3.4** Add TRUSTED_ORIGINS, COOKIE_DOMAIN to .env.example ## Acceptance Criteria - [ ] trustedOrigins from env vars (NEXT_PUBLIC_APP_URL, NEXT_PUBLIC_API_URL, TRUSTED_ORIGINS) - [ ] CORS and trustedOrigins use same origin list - [ ] Session: expiresIn=7d, updateAge=2h, httpOnly, secure, sameSite=lax - [ ] .env.example documents new variables - [ ] All new code has tests (85%+ coverage) - [ ] pnpm lint && pnpm typecheck && pnpm test pass ## Files - apps/api/src/auth/auth.config.ts - apps/api/src/main.ts - .env.example
jason.woltje added this to the Auth-Frontend-Remediation (0.0.14) milestone 2026-02-16 16:56:52 +00:00
jason.woltje added the securityauthapiapi labels 2026-02-16 16:56:52 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label api api auth security
Milestone
No items
No Milestone Auth-Frontend-Remediation (0.0.14)
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#414
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?