Danila KhodjaefandCursor
bc8369e373
Paintings get editable curator notes with brass plates in the 3D hall, and visit order now uses the far/end wall between left and right. Co-authored-by: Cursor <cursoragent@cursor.com>
46 lines
1.2 KiB
JavaScript
46 lines
1.2 KiB
JavaScript
const session = require('express-session');
|
|
const pgSession = require('connect-pg-simple')(session);
|
|
const pool = require('../db');
|
|
|
|
const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
|
|
|
|
function resolveCookieSecure() {
|
|
const flag = process.env.SESSION_COOKIE_SECURE;
|
|
if (flag === '1' || flag === 'true') return true;
|
|
if (flag === '0' || flag === 'false') return false;
|
|
// Behind Keenetic/HTTPS termination: match the browser scheme via X-Forwarded-Proto.
|
|
if (process.env.TRUST_PROXY === '1' || process.env.TRUST_PROXY === 'true') {
|
|
return 'auto';
|
|
}
|
|
return false;
|
|
}
|
|
|
|
function createSessionMiddleware() {
|
|
const secret = process.env.SESSION_SECRET;
|
|
if (!secret) {
|
|
console.warn(
|
|
'SESSION_SECRET is not set — using insecure default (set SESSION_SECRET in production)'
|
|
);
|
|
}
|
|
|
|
return session({
|
|
store: new pgSession({
|
|
pool,
|
|
tableName: 'session',
|
|
createTableIfMissing: false,
|
|
}),
|
|
name: 'gallery.sid',
|
|
secret: secret || 'gallery-dev-insecure-session-secret',
|
|
resave: false,
|
|
saveUninitialized: false,
|
|
cookie: {
|
|
httpOnly: true,
|
|
secure: resolveCookieSecure(),
|
|
sameSite: 'lax',
|
|
maxAge: SEVEN_DAYS_MS,
|
|
},
|
|
});
|
|
}
|
|
|
|
module.exports = { createSessionMiddleware };
|