feat: harden security configuration

- explicit auth config (token expiry, login attempt lockout, secure cookies)
- CORS/CSRF whitelist + serverURL scoped to NEXT_PUBLIC_BASE_URL
- disable unused GraphQL API and remove its routes
- restrict Media uploads to images, cap file size at 5 MB

Author: kriss145

.changeset/security-hardening-config.md

@@ -0,0 +1,10 @@
+---
+'training-app': minor
+---
+
+Harden security configuration (no DB migration required):
+
+- Explicit `auth` config on `users` and `clients` (2h token expiration, 5 max login attempts, 10 min lockout, `secure` cookies in production, `sameSite: Lax`)
+- Add `serverURL`, CORS and CSRF whitelists scoped to `NEXT_PUBLIC_BASE_URL`
+- Disable the unused GraphQL API and remove its routes to shrink the public API surface
+- Restrict Media uploads to images and cap file size at 5 MB

src/app/(payload)/api/graphql-playground/route.ts

@@ -3,7 +3,15 @@ import { isAdmin, adminOrSelf, isAdminField } from '../../access'
 
 export const Clients: CollectionConfig = {
   slug: 'clients',
-  auth: true,
+  auth: {
+    tokenExpiration: 60 * 60 * 2, // 2h session
+    maxLoginAttempts: 5,
+    lockTime: 1000 * 60 * 10, // 10 min lockout after too many attempts
+    cookies: {
+      secure: process.env.NODE_ENV === 'production', // HTTPS-only cookie in prod
+      sameSite: 'Lax',
+    },
+  },
   admin: {
     useAsTitle: 'email',
     defaultColumns: ['name', 'email'],

src/app/(payload)/api/graphql/route.ts

@@ -11,5 +11,7 @@ export const Media: CollectionConfig = {
       type: 'text',
     },
   ],
-  upload: true,
+  upload: {
+    mimeTypes: ['image/*'], // only allow image uploads
+  },
 }

src/collections/clients/index.ts

@@ -5,7 +5,15 @@ export const Users: CollectionConfig = {
   admin: {
     useAsTitle: 'email',
   },
-  auth: true,
+  auth: {
+    tokenExpiration: 60 * 60 * 2, // 2h session
+    maxLoginAttempts: 5,
+    lockTime: 1000 * 60 * 10, // 10 min lockout after too many attempts
+    cookies: {
+      secure: process.env.NODE_ENV === 'production', // HTTPS-only cookie in prod
+      sameSite: 'Lax',
+    },
+  },
   fields: [],
   versions: false,
 }

src/collections/media/index.ts

@@ -24,7 +24,24 @@ import {
 const filename = fileURLToPath(import.meta.url)
 const dirname = path.dirname(filename)
 
+const serverURL = process.env.NEXT_PUBLIC_BASE_URL || 'http://localhost:3000'
+
 export default buildConfig({
+  serverURL,
+  // Restrict cross-origin requests and CSRF-trusted origins to our own domain.
+  cors: [serverURL],
+  csrf: [serverURL],
+  // GraphQL is not used by the app; disable it to shrink the public API surface.
+  graphQL: {
+    disable: true,
+  },
+  // Cap upload size at the multipart parser to reject oversized files early.
+  upload: {
+    limits: {
+      fileSize: 5_000_000, // 5 MB
+    },
+    abortOnLimit: true,
+  },
   admin: {
     user: Users.slug,
     importMap: {