feat(server): proxy — SEICHE_TRUST_PROXY + SEICHE_COOKIE_SECURE (+4 tests, 30/30)

server/src/app.ts

@@ -22,6 +22,7 @@ export async function buildApp(deps: AppDeps): Promise<FastifyInstance> {
   const { config, db } = deps;
 
   const app = Fastify({
+    trustProxy: config.trustProxy,
     logger: {
       level: process.env.SEICHE_LOG_LEVEL ?? "info",
       transport:

server/src/config.ts

@@ -12,6 +12,8 @@ export interface Config {
   sessionTtlMs: number;
   sessionAbsoluteTtlMs: number;
   maxLoginAttemptsPerMinute: number;
+  cookieSecure: boolean;
+  trustProxy: boolean;
   publicDir: string | null;
   external: {
     adapter: "example" | "http";
@@ -40,6 +42,12 @@ function envInt(name: string, fallback: number): number {
   return value;
 }
 
+function envBool(name: string, fallback: boolean): boolean {
+  const raw = process.env[name];
+  if (raw === undefined || raw === "") return fallback;
+  return raw === "1" || raw.toLowerCase() === "true";
+}
+
 export function loadConfig(): Config {
   const dataDir = path.resolve(process.cwd(), envStr("SEICHE_DATA_DIR", "./data"));
   return {
@@ -49,6 +57,8 @@ export function loadConfig(): Config {
     sessionTtlMs: envInt("SEICHE_SESSION_TTL_MS", 8 * 60 * 60 * 1000),
     sessionAbsoluteTtlMs: envInt("SEICHE_SESSION_ABSOLUTE_TTL_MS", 7 * 24 * 60 * 60 * 1000),
     maxLoginAttemptsPerMinute: envInt("SEICHE_MAX_LOGIN_ATTEMPTS_PER_MINUTE", 5),
+    cookieSecure: envBool("SEICHE_COOKIE_SECURE", false),
+    trustProxy: envBool("SEICHE_TRUST_PROXY", false),
     publicDir: process.env.SEICHE_PUBLIC_DIR ?? null,
     external: {
       adapter: (process.env.SEICHE_EXTERNAL_ADAPTER ?? "example") as "example" | "http",

server/src/routes/auth.ts

@@ -52,13 +52,13 @@ export function buildAuthRoutes(app: FastifyInstance, deps: AuthDeps): void {
       httpOnly: true,
       sameSite: "lax" as const,
       path: "/",
-      secure: false, // TLS géré par Caddy/proxy devant (voir README)
+      secure: config.cookieSecure, // activer SEICHE_COOKIE_SECURE=1 derrière un proxy TLS
     };
     reply.setCookie(SESSION_COOKIE, token, cookieOptions).setCookie(CSRF_COOKIE, csrfToken, {
       httpOnly: false,
       sameSite: "lax",
       path: "/",
-      secure: false,
+      secure: config.cookieSecure,
     });
     return reply.send({
       user: { username: user.username },
@@ -74,7 +74,7 @@ export function buildAuthRoutes(app: FastifyInstance, deps: AuthDeps): void {
     async (request, reply) => {
       const token = request.cookies[SESSION_COOKIE];
       await app.sessionManager.destroy(token);
-      const clearOptions = { path: "/", sameSite: "lax" as const, secure: false };
+      const clearOptions = { path: "/", sameSite: "lax" as const, secure: config.cookieSecure };
       reply
         .setCookie(SESSION_COOKIE, "", { ...clearOptions, httpOnly: true, maxAge: 0 })
         .setCookie(CSRF_COOKIE, "", { ...clearOptions, httpOnly: false, maxAge: 0 });