Authentication & Deployment

Google OAuth SSO, shared sessions between CMS and DocHub, and the production deployment pipeline

Google OAuth Login Flow

User visits https://docs.ipnoelp.com — no valid session cookie found

↓

Auth middleware redirects to /auth/login — shows "Sign in with Google" button

↓

Click triggers /auth/google — Passport redirects to Google's OAuth consent screen

↓

Google authenticates the user and returns authorization code to /auth/google/callback

↓

Domain check — Passport verifies email ends with @omelasai.com. Rejected if not.

↓

Session created in PostgreSQL via connect-pg-simple. Cookie set on .ipnoelp.com domain. Redirect to /

Dev Mode: When no GOOGLE_CLIENT_ID is set, auth is bypassed entirely. All routes are accessible without login.

Shared Session Architecture

CMS and DocHub share a single sign-on via cookie domain and PostgreSQL session store.

CMS

cms.ipnoelp.com

:3000 / :3001

←

Shared Session

PostgreSQL session table

Cookie domain: .ipnoelp.com

Same SESSION_SECRET

Same Google OAuth credentials

→

DocHub

docs.ipnoelp.com

:3002

Setting	Value	Why
COOKIE_DOMAIN	.ipnoelp.com	Leading dot makes cookie accessible to all subdomains
SESSION_SECRET	Same in both apps	Both apps must decrypt the same session cookie
Session store	connect-pg-simple	Shared PostgreSQL table means either app can read sessions
trust proxy	1	Express trusts nginx's X-Forwarded-Proto for secure cookie setting

Deployment Pipeline

From local edit to production in 4 steps.

Local

Edit .ts / .md

src/ and content/

→

Build

npx tsc

src/ → dist/

→

Transfer

rsync

SSH to droplet

→

Restart

pm2 restart

Zero-downtime

Manual Deploy

npx tsc — Compile TypeScript

rsync src/ dist/ content/ to droplet

pm2 restart dochub

Daily Auto-Deploy

Cron at 3:00 AM UTC runs daily-run.sh

Pulls from GitHub, rebuilds, restarts

Runs daily agent validation

Daily Agent Timeline

Automated cron job at 3:00 AM UTC that keeps documentation fresh and validated.