JavaScript 56.7%
TypeScript 42.6%
1import { SessionOptions } from "iron-session";23/** Code de connexion par courriel en attente (stocké chiffré dans le cookie — aucune table nécessaire). */4export interface PendingOtp {5 email: string; // adresse normalisée (minuscules)6 userId: string;7 hash: string; // SHA-256(sel:code)8 salt: string;9 expiresAt: number; // epoch ms10 attempts: number;11 sentAt: number; // epoch ms — anti-spam de renvoi12}1314export interface SessionData {15 isLoggedIn: boolean;16 userId?: string;17 userRole?: string;18 csrfToken?: string;19 pendingTwoFactor?: boolean;20 pendingUserId?: string;21 sessionToken?: string; // ties the cookie to a LoginSession record22 otp?: PendingOtp;23}2425export const sessionOptions: SessionOptions = {26 password: process.env.SESSION_SECRET || "spb-cloud-secret-key-change-in-production-min-32-chars",27 cookieName: "spb-cloud-session",28 cookieOptions: {29 secure: process.env.NODE_ENV === "production",30 httpOnly: true,31 sameSite: "lax" as const,32 maxAge: 60 * 60 * 24,33 },34};3536export const defaultSession: SessionData = {37 isLoggedIn: false,38};39