Files

ramadhan sjamsani 4a796277b8 Phase 3.4: control_center self-managed auth cutover

Replaces Firebase Auth with the new JWT + httpOnly-cookie refresh flow.
Smoke-tested end-to-end via curl (login → /me → refresh rotation → logout).

- Remove firebase dep + firebase.js
- New token-bridge decouples api-client from AuthContext and de-dupes
  concurrent 401 refreshes
- AuthContext: in-memory access token (useRef), bootstrap via
  /internal/auth/refresh, login/logout/refresh methods
- api-client: withCredentials, Bearer attach, auto-retry once on 401
- LoginPage: handle INVALID_CREDENTIALS / ACCOUNT_LOCKED / VALIDATION_ERROR
- Layout: self-service "Ganti password" form
- UsersPage: initial password field on create + per-row admin-forced reset
- .env / .env.example: drop VITE_FIREBASE_* vars
- backend/CLAUDE.md + control_center/CLAUDE.md: describe new auth (were
  stale on Firebase)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-24 15:32:32 +08:00

1.2 KiB

Raw Blame History

Halo Bestie — Control Center

React + Vite SPA for internal platform management. Internal use only.

See root CLAUDE.md for full project context and architectural decisions.

Stack

Framework: React + Vite
Auth: Self-managed (see root CLAUDE.md — Phase 3.4). Email + bcrypt password via POST /internal/auth/login. Access token lives in memory (React AuthContext); refresh token in an httpOnly Secure cookie (cc_refresh_token). All API calls must send credentials: 'include'. Admin-only provisioning — no public signup, no password-reset flow.
API: Calls internal Fastify listener only (/internal/ routes on port 3001)
Access: Internal network / VPN only — never exposed to public internet

Security

This app and its backend routes must NEVER be accessible from the public internet
Protected at network level: Nginx allow 10.0.0.0/8; deny all;
Additional role check on every API call (role: admin)
Do not add any public-facing routes or features here

Key Responsibilities

Manage and approve mitra accounts
Configure platform settings
Monitor sessions and payments
Manage communication between mitra and client (escalation, disputes)
Manage trial period configuration

1.2 KiB Raw Blame History

Halo Bestie — Control Center

Stack

Security

Key Responsibilities

1.2 KiB

Raw Blame History