@selvajs/cli 2.0.8 → 2.0.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/cli",
-  "version": "2.0.8",
+  "version": "2.0.10",
   "description": "Scaffold and operate a Selva white-label deployment. `npx @selvajs/cli <dir>` to bootstrap, `selva <cmd>` to manage.",
   "license": "MIT",
   "publishConfig": {

package/src/prompts.js

@@ -123,6 +123,7 @@ export function collectConfigFromEnv(env = process.env) {
 		'ALLOW_ORG_CREATION',
 		'ALLOW_CROSS_ORG_PUBLIC',
 		'ALLOW_ORG_COMPUTE_OVERRIDE',
+		'ENABLE_PLATFORM_PROJECTS',
 		'ENABLE_SHARING'
 	];
 	for (const f of flagNames) {
@@ -474,6 +475,23 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 		});
 		cancelOn(value);
 		origin = String(value);
+
+		// Plain HTTP + NODE_ENV=production drops the session cookie (Secure
+		// flag on, browser refuses to send over http://). Login appears to
+		// succeed but the next request is anonymous. Warn loudly here — the
+		// fix is either TLS or ALLOW_INSECURE_COOKIES=true in .env.
+		if (origin.startsWith('http://')) {
+			p.note(
+				'Sessions use Secure cookies in production; browsers will silently\n' +
+					'drop them over http://, so login will appear to succeed but the\n' +
+					'next request will be anonymous.\n\n' +
+					'Fix one of:\n' +
+					'  • put TLS in front (recommended) — e.g. a domain + Caddy auto-cert\n' +
+					'  • set ALLOW_INSECURE_COOKIES=true in .env (testing only — password\n' +
+					'    auth over plain HTTP sends credentials in cleartext)',
+				pc.yellow('⚠ Plain HTTP origin')
+			);
+		}
 	}
 
 	// ── Platform flags ─────────────────────────────────────────────────
@@ -493,6 +511,11 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 			label: 'Orgs can configure their own Rhino.Compute server',
 			hint: 'BYO compute'
 		},
+		{
+			value: 'ENABLE_PLATFORM_PROJECTS',
+			label: 'Platform projects (admin-owned, granted to orgs/users)',
+			hint: 'cross-org sharing without membership'
+		},
 		{
 			value: 'ENABLE_SHARING',
 			label: 'Per-definition share links (anonymous external access)',