Important: When you begin this ticket, create a new branch from feat/admin-auth and not main. When you open a PR, open it into feat/admin-auth and not main.
Description
Improve admin authentication so broken, expired, or fake session data is rejected safely. Also replace the example authentication secret with an obvious placeholder.
This can be done by checking the token’s admin ID and role before accepting it, and updating AUTH_SECRET in .env.example.
Notes
- Review
src/domain/admin/validation.ts and src/lib/auth/session.ts for potential issues (e.g. role as Role cast in verifySessionToken has no runtime validation)
- Fix the
AUTH_SECRET placeholder in .env.example — current value looks like a real key, replace with "replace-me-run-openssl-rand-base64-32" or similar
Acceptance Criteria
- Only valid admin roles are accepted.
- Invalid or expired tokens are rejected.
- Replace the example AUTH_SECRET with a placeholder.
- Type checking and linting pass.
Important: When you begin this ticket, create a new branch from feat/admin-auth and not main. When you open a PR, open it into feat/admin-auth and not main.
Description
Improve admin authentication so broken, expired, or fake session data is rejected safely. Also replace the example authentication secret with an obvious placeholder.
This can be done by checking the token’s admin ID and role before accepting it, and updating AUTH_SECRET in .env.example.
Notes
src/domain/admin/validation.tsandsrc/lib/auth/session.tsfor potential issues (e.g.role as Rolecast inverifySessionTokenhas no runtime validation)AUTH_SECRETplaceholder in.env.example— current value looks like a real key, replace with"replace-me-run-openssl-rand-base64-32"or similarAcceptance Criteria