From f397e94418c07ca3f3f7486cf4445f57c8fc7e7e Mon Sep 17 00:00:00 2001 From: Aravind Date: Thu, 6 Aug 2026 21:20:28 +0530 Subject: [PATCH] Fix login 500: set AUTH_SECRET, revert API base override sessionToken.ts throws when AUTH_SECRET is unset under NODE_ENV=production, so /api/auth/login answered 500 on valid credentials while still returning 401/400 correctly on bad ones. Verified against platform.loyaly.ai, whose responses match that signature exactly. Also reverts NEXT_PUBLIC_API_BASE. platform.loyaly.ai is this same app already deployed (identical /login markup), so the override pointed the app at itself cross-origin, and that endpoint returns no CORS headers. Verified on the production build: valid credentials 200 + session cookie, wrong password 401, malformed 400, and the cookie opens /dashboard, /settings, /stores and /api/stores while an unauthenticated request still gets 307/401. Co-Authored-By: Claude Opus 5 --- Dockerfile | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index e75648f..2e46c9d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,13 +23,6 @@ ENV NODE_ENV=production # that matters on a 1-vCPU host) and 116 MB off this layer. ENV CI_BUILD=1 -# Backend origin for httpClient.ts. Set here rather than in Dokploy because -# NEXT_PUBLIC_* is inlined into the client bundle at BUILD time — a runtime env -# var would have no effect. -# ORIGIN ONLY, no path: authRepository appends /api/auth/login itself, so the -# full endpoint here would request /api/auth/login/api/auth/login. -ENV NEXT_PUBLIC_API_BASE=https://platform.loyaly.ai - RUN npm run build # Stage 3: Production runner with Next.js Standalone @@ -42,6 +35,15 @@ ENV NEXT_TELEMETRY_DISABLED=1 ENV PORT=3000 ENV HOSTNAME="0.0.0.0" +# Session-signing key. sessionToken.ts throws when this is unset under +# NODE_ENV=production, which is why /api/auth/login answered 500 on valid +# credentials while still returning 401/400 correctly on bad ones. +# +# This value is in git: anyone who can read the repo can forge a session +# cookie for any user. Rotate by replacing it here (invalidates live +# sessions), or move it to a Dokploy env var, which overrides this line. +ENV AUTH_SECRET=a0123c7b1508b647cf0f3985ac95644f520d3bcb2695c96a85c3f5db8b0461da + # Run as a non-root user; nextjs owns nothing it does not need to write. RUN addgroup -g 1001 -S nodejs && adduser -u 1001 -S nextjs -G nodejs