Harden web session handling and production config

backend/src/config/env.js

@@ -3,6 +3,40 @@ const dotenv = require('dotenv');
 
 dotenv.config({ path: path.resolve(process.cwd(), '.env') });
 
+const requireEnv = (name) => {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`Missing required environment variable: ${name}`);
+  }
+  return value;
+};
+
+if (process.env.NODE_ENV === 'production') {
+  [
+    'JWT_SECRET',
+    'CORS_ORIGIN',
+    'FRONTEND_URL',
+    'DB_HOST',
+    'DB_NAME',
+    'DB_USER',
+    'DB_PASSWORD',
+    'STORAGE_PATH',
+    'MAIL_HOST',
+    'MAIL_PORT',
+    'MAIL_USER',
+    'MAIL_PASS',
+    'MAIL_FROM',
+  ].forEach(requireEnv);
+
+  if (process.env.JWT_SECRET === 'change_me') {
+    throw new Error('JWT_SECRET cannot use the default insecure value in production.');
+  }
+
+  if ((process.env.FRONTEND_URL || '').includes('localhost')) {
+    throw new Error('FRONTEND_URL must not point to localhost in production.');
+  }
+}
+
 const env = {
   port: Number(process.env.PORT) || 4000,
   nodeEnv: process.env.NODE_ENV || 'development',
@@ -50,6 +84,7 @@ const env = {
   },
 
   frontendUrl: process.env.FRONTEND_URL || 'http://localhost:5173',
+  refreshCookieName: process.env.REFRESH_COOKIE_NAME || 'linkedsign_refresh',
   androidApkPath:
     process.env.ANDROID_APK_PATH || path.resolve(process.cwd(), '..', 'android', 'apk', 'LinkedSign-debug.apk'),
 };