04c7230046
Implement system-wide configuration management with encrypted storage for sensitive data:
Database:
- Migration 006: system_settings table with encryption support
- Migration 007: is_system_admin flag for users table
Services:
- settings.service.js: Configuration management with AES-256-GCM encryption
- getSetting, setSetting, deleteSetting
- Category-based organization
- Auto-encrypt/decrypt sensitive values
- Email configuration testing
Routes:
- settings.routes.js: 8 admin-only endpoints (CRUD settings, categories, test email)
Middleware:
- requireSystemAdmin: Verify system admin privileges (via SYSTEM_ADMIN_EMAILS env var or is_system_admin flag)
Default Settings:
- Email: SMTP configuration (host, port, credentials)
- Security: Email verification, password rules, lockout settings
- General: App name, support email, file size limits
Encryption:
- AES-256-GCM authenticated encryption
- Prevents tampering
- Per-setting encryption flag
- Secure key management via SETTINGS_ENCRYPTION_KEY env var
Environment:
- .env.example: Template for all required configuration
- Added SETTINGS_ENCRYPTION_KEY and SYSTEM_ADMIN_EMAILS
Production-ready admin configuration panel.
🤖 Generated with Claude Code
46 lines
1 KiB
Text
46 lines
1 KiB
Text
# Server Configuration
|
|
PORT=8001
|
|
NODE_ENV=development
|
|
|
|
# Database
|
|
DATABASE_PATH=./db/navidocs.db
|
|
|
|
# Meilisearch
|
|
MEILISEARCH_HOST=http://127.0.0.1:7700
|
|
MEILISEARCH_MASTER_KEY=your-meilisearch-key-here
|
|
MEILISEARCH_INDEX_NAME=navidocs-pages
|
|
MEILISEARCH_SEARCH_KEY=your-search-key-here
|
|
|
|
# Redis (for BullMQ)
|
|
REDIS_HOST=127.0.0.1
|
|
REDIS_PORT=6379
|
|
|
|
# Authentication
|
|
# Generate with: openssl rand -hex 32
|
|
JWT_SECRET=your-jwt-secret-here-change-in-production
|
|
JWT_EXPIRES_IN=15m
|
|
|
|
# System Settings Encryption
|
|
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
SETTINGS_ENCRYPTION_KEY=your-settings-encryption-key-here
|
|
|
|
# System Administrators (comma-separated emails)
|
|
SYSTEM_ADMIN_EMAILS=admin@example.com
|
|
|
|
# File Upload
|
|
MAX_FILE_SIZE=50000000
|
|
UPLOAD_DIR=./uploads
|
|
ALLOWED_MIME_TYPES=application/pdf
|
|
|
|
# OCR
|
|
OCR_LANGUAGE=eng
|
|
OCR_CONFIDENCE_THRESHOLD=0.7
|
|
|
|
# Remote OCR Worker
|
|
USE_REMOTE_OCR=true
|
|
OCR_WORKER_URL=https://your-ocr-worker-url-here
|
|
OCR_WORKER_TIMEOUT=300000
|
|
|
|
# Rate Limiting
|
|
RATE_LIMIT_WINDOW_MS=900000
|
|
RATE_LIMIT_MAX_REQUESTS=100
|