← back to PoppyPetitions

lib/auth.ts

17 lines

import { createAuth } from '@dw/nextjs-admin-login';

// 2026-05-05 (P0-D scrub): enableBasicAuthFallback was true, which let any
// `Authorization: Basic <b64>` header authenticate against EVERY route
// app-wide. PoppyPetitions is a single-admin loopback tool — no external
// Basic-auth callers exist. The seed route's OUTBOUND Basic header to the
// AI Factory rolodex (port 9891) is a separate construct, unaffected by
// this flag. Flipping to false closes a global-credential-in-transit hole.
export const auth = createAuth({ cookieName: 'poppy-auth' });
export const { COOKIE_NAME: AUTH_COOKIE_NAME, createSession, verifyAuth,
               buildAuthCookie, buildLogoutCookie, hashPassword,
               // 2026-05-06 (tick 47): re-export v0.2.0 org-scoped helpers.
               // Backward compatible — accepts both v1 (3-part) and v2
               // (4-part) tokens. Adopt at consumer-route's discretion.
               createSessionWithOrg, verifyAuthWithOrg } = auth;
export type { AuthSession } from '@dw/nextjs-admin-login';