feat(auth): implement portal SSO and local admin authentication

Added support for portal SSO with JWT authentication and local admin login. Updated environment configuration to include AUTH_REQUIRED, AUTH_JWT_SECRET, AUTH_ISSUER, and AUTH_PORTAL_URL. Enhanced the auth plugin to handle JWT verification based on the new configuration. Introduced new routes for authentication and updated the API client to manage token handling and redirects. Improved user experience by integrating authentication checks across various routes and components.

apps/api/src/config.ts

@@ -15,13 +15,28 @@ export interface AppConfig {
   healthDownFailures: number;
   healthLatencyWarnMs: number;
   logLevel: string;
+  /** Portal SSO — when true, require portal JWT with apps includes cfdm */
+  authRequired: boolean;
+  authIssuer: string;
+  authPortalUrl: string;
+}
+
+function boolEnv(v: string | undefined, fallback: boolean): boolean {
+  if (v === undefined || v === "") return fallback;
+  return v === "1" || v.toLowerCase() === "true";
 }
 
 export function loadConfig(): AppConfig {
+  const isProd = process.env.NODE_ENV === "production";
+  const jwtSecret =
+    process.env.AUTH_JWT_SECRET ??
+    process.env.JWT_SECRET ??
+    (isProd ? "" : "dev-secret-change-me");
+
   return {
     databaseUrl: process.env.DATABASE_URL ?? "sqlite:data/app.db",
     cloudflareApiToken: (process.env.CLOUDFLARE_API_TOKEN ?? "").trim(),
-    jwtSecret: process.env.JWT_SECRET ?? "dev-secret-change-me",
+    jwtSecret: jwtSecret || "dev-secret-change-me",
     jwtTtlHours: Number(process.env.JWT_TTL_HOURS ?? "24") || 24,
     adminUsername: process.env.ADMIN_USERNAME ?? "admin",
     adminPasswordHash:
@@ -38,5 +53,13 @@ export function loadConfig(): AppConfig {
     healthLatencyWarnMs:
       Number(process.env.HEALTH_LATENCY_WARN_MS ?? "1000") || 1000,
     logLevel: process.env.LOG_LEVEL ?? "info",
+    authRequired: boolEnv(process.env.AUTH_REQUIRED, false),
+    authIssuer:
+      process.env.AUTH_ISSUER ?? process.env.ISSUER ?? "https://auth.shnt.top",
+    authPortalUrl: (
+      process.env.AUTH_PORTAL_URL ??
+      process.env.VITE_AUTH_PORTAL_URL ??
+      "http://localhost:5175"
+    ).replace(/\/$/, ""),
   };
 }