mirror of
https://github.com/complexcaresolutions/cms.c2sgmbh.git
synced 2026-03-17 22:04:10 +00:00
Martin Porwoll
63b97c14f2
- CSRF: Require CSRF_SECRET in production, throw error on missing secret - IP Allowlist: TRUST_PROXY must be explicitly set to 'true' for proxy headers - Rate Limiter: Add proper proxy trust handling for client IP detection - Login: Add browser form redirect support with safe URL validation - Add custom admin login page with styled form - Update CLAUDE.md with TRUST_PROXY documentation - Update tests for new security behavior BREAKING: Server will not start in production without CSRF_SECRET or PAYLOAD_SECRET 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
45 lines
1.3 KiB
TypeScript
45 lines
1.3 KiB
TypeScript
import type { CollectionConfig } from 'payload'
|
|
import { auditUserAfterChange, auditUserAfterDelete } from '../hooks/auditUserChanges'
|
|
import {
|
|
auditAfterLogin,
|
|
auditAfterLogout,
|
|
auditAfterForgotPassword,
|
|
} from '../hooks/auditAuthEvents'
|
|
|
|
export const Users: CollectionConfig = {
|
|
slug: 'users',
|
|
admin: {
|
|
useAsTitle: 'email',
|
|
},
|
|
auth: {
|
|
// Cookie-Konfiguration für Production hinter Reverse-Proxy (Cloudflare/Caddy)
|
|
cookies: {
|
|
sameSite: 'Lax',
|
|
secure: process.env.NODE_ENV === 'production',
|
|
domain: undefined, // Automatisch vom Browser gesetzt
|
|
},
|
|
// Sicherheitseinstellungen
|
|
lockTime: 10 * 60 * 1000, // 10 Minuten Lock nach max. Fehlversuchen
|
|
maxLoginAttempts: 5,
|
|
tokenExpiration: 7200, // 2 Stunden
|
|
},
|
|
hooks: {
|
|
afterChange: [auditUserAfterChange],
|
|
afterDelete: [auditUserAfterDelete],
|
|
afterLogin: [auditAfterLogin],
|
|
afterLogout: [auditAfterLogout],
|
|
afterForgotPassword: [auditAfterForgotPassword],
|
|
},
|
|
fields: [
|
|
{
|
|
name: 'isSuperAdmin',
|
|
type: 'checkbox',
|
|
label: 'Super Admin',
|
|
defaultValue: false,
|
|
admin: {
|
|
description: 'Super Admins haben Zugriff auf alle Tenants und können neue Tenants erstellen.',
|
|
position: 'sidebar',
|
|
},
|
|
},
|
|
],
|
|
}
|