preview stack, refresh token, design

backend/src/config.rs

@@ -11,6 +11,10 @@ pub struct AppConfig {
     pub jwt_issuer: String,
     pub jwt_audience: String,
     pub jwt_expiry_minutes: i64,
+    pub refresh_token_expiry_days: i64,
+    pub refresh_cookie_secure: bool,
+    pub refresh_cookie_domain: Option<String>,
+    pub cors_allowed_origin: Option<String>,
     pub aws_endpoint_url: Option<String>,
     pub aws_access_key_id: Option<String>,
     pub aws_secret_access_key: Option<String>,
@@ -34,6 +38,15 @@ impl AppConfig {
             .unwrap_or_else(|_| "60".to_string())
             .parse()
             .context("JWT_EXPIRY_MINUTES must be an integer")?;
+        let refresh_token_expiry_days = env::var("REFRESH_TOKEN_EXPIRY_DAYS")
+            .unwrap_or_else(|_| "30".to_string())
+            .parse()
+            .context("REFRESH_TOKEN_EXPIRY_DAYS must be an integer")?;
+        let refresh_cookie_secure = env::var("REFRESH_COOKIE_SECURE")
+            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+            .unwrap_or(false);
+        let refresh_cookie_domain = env::var("REFRESH_COOKIE_DOMAIN").ok();
+        let cors_allowed_origin = env::var("CORS_ALLOWED_ORIGIN").ok();
         let aws_endpoint_url = env::var("AWS_ENDPOINT_URL").ok();
         let aws_access_key_id = env::var("AWS_ACCESS_KEY_ID").ok();
         let aws_secret_access_key = env::var("AWS_SECRET_ACCESS_KEY").ok();
@@ -48,6 +61,10 @@ impl AppConfig {
             jwt_issuer,
             jwt_audience,
             jwt_expiry_minutes,
+            refresh_token_expiry_days,
+            refresh_cookie_secure,
+            refresh_cookie_domain,
+            cors_allowed_origin,
             aws_endpoint_url,
             aws_access_key_id,
             aws_secret_access_key,