Code-review feedback: - Hard-fail boot when AUTH_ENABLED=true and SESSION_SECRET is unset, so express-session can't silently use an in-memory random secret that invalidates sessions on restart and breaks multi-node clusters. - CORS rejection now returns cb(null, false) instead of cb(new Error) so misconfigured origins surface as clean CORS errors in the browser instead of HTTP 500s. Log a warn line for operator visibility. - pruneSessionInterval units comment. |
||
|---|---|---|
| .. | ||
| capture | ||
| mam-api | ||
| node-agent | ||
| premiere-plugin | ||
| web-ui | ||
| worker | ||