Loyaly/loyaly-merchant
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix login 500: set AUTH_SECRET, revert API base override

Browse Source 
sessionToken.ts throws when AUTH_SECRET is unset under NODE_ENV=production,
so /api/auth/login answered 500 on valid credentials while still returning
401/400 correctly on bad ones. Verified against platform.loyaly.ai, whose
responses match that signature exactly.

Also reverts NEXT_PUBLIC_API_BASE. platform.loyaly.ai is this same app
already deployed (identical /login markup), so the override pointed the
app at itself cross-origin, and that endpoint returns no CORS headers.

Verified on the production build: valid credentials 200 + session cookie,
wrong password 401, malformed 400, and the cookie opens /dashboard,
/settings, /stores and /api/stores while an unauthenticated request still
gets 307/401.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Aravind
2026-08-06 21:20:28 +05:30
parent 450fa0d6a0
commit f397e94418
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
Dockerfile
View File

@@ -23,13 +23,6 @@ ENV NODE_ENV=production
# that matters on a 1-vCPU host) and 116 MB off this layer.
ENV CI_BUILD=1
# Backend origin for httpClient.ts. Set here rather than in Dokploy because
# NEXT_PUBLIC_* is inlined into the client bundle at BUILD time — a runtime env
# var would have no effect.
# ORIGIN ONLY, no path: authRepository appends /api/auth/login itself, so the
# full endpoint here would request /api/auth/login/api/auth/login.
ENV NEXT_PUBLIC_API_BASE=https://platform.loyaly.ai
RUN npm run build
# Stage 3: Production runner with Next.js Standalone
@@ -42,6 +35,15 @@ ENV NEXT_TELEMETRY_DISABLED=1
ENV PORT=3000
ENV HOSTNAME="0.0.0.0"
# Session-signing key. sessionToken.ts throws when this is unset under
# NODE_ENV=production, which is why /api/auth/login answered 500 on valid
# credentials while still returning 401/400 correctly on bad ones.
#
# This value is in git: anyone who can read the repo can forge a session
# cookie for any user. Rotate by replacing it here (invalidates live
# sessions), or move it to a Dokploy env var, which overrides this line.
ENV AUTH_SECRET=a0123c7b1508b647cf0f3985ac95644f520d3bcb2695c96a85c3f5db8b0461da
# Run as a non-root user; nextjs owns nothing it does not need to write.
RUN addgroup -g 1001 -S nodejs && adduser -u 1001 -S nextjs -G nodejs