Skip to content

feat(auth): configure PostgreSQL-backed sessions - #23

Merged
rd-code-23 merged 1 commit into
mainfrom
feature/auth
Aug 18, 2026
Merged

rd-code-23 merged 1 commit into
mainfrom
feature/auth

Conversation

@rd-code-23

Copy link
Copy Markdown
Owner

Summary

  • configure express-session with the approved fixed cookie policy
  • persist sessions through connect-pg-simple using the existing PostgreSQL pool
  • keep runtime table creation disabled and prune expired sessions daily
  • enable exact-origin credentialed CORS and narrowly configurable proxy trust
  • add typed session state and safe middleware-error handling
  • test anonymous, valid, unknown, and expired session behavior

Why

The API needs a production-safe server-side session boundary before Google OIDC routes can create authenticated sessions.

Validation

  • pnpm --filter @goforlift/api test — 18 tests passed
  • pnpm --filter @goforlift/api typecheck
  • pnpm --filter @goforlift/api lint
  • targeted Prettier checks
  • git diff --check

Closes #7

@rd-code-23
rd-code-23 marked this pull request as ready for review August 18, 2026 21:12
@rd-code-23
rd-code-23 merged commit 9090e11 into main Aug 18, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Auth][Phase 2] Configure PostgreSQL-backed session middleware

1 participant