Add mobile dashboard, allow longer auth sessions

inventory-server/auth/routes.js

@@ -12,13 +12,20 @@ export function createAuthRoutes({ pool }) {
   // shared/auth/middleware.js and is used by downstream services. Auth-server's surface is
   // small enough that a local copy is fine; the security boundary is the JWT verify step.
   async function authenticate(req, res, next) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+    const token = authHeader.split(' ')[1];
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET);
+    } catch (error) {
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    // DB failures are 500, not 401 — the frontend ends the session on 401,
+    // and a transient outage must not log users out.
     try {
-      const authHeader = req.headers.authorization;
-      if (!authHeader || !authHeader.startsWith('Bearer ')) {
-        return res.status(401).json({ error: 'Authentication required' });
-      }
-      const token = authHeader.split(' ')[1];
-      const decoded = jwt.verify(token, process.env.JWT_SECRET);
       const result = await pool.query(
         'SELECT id, username, email, is_admin, rocket_chat_user_id FROM users WHERE id = $1',
         [decoded.userId]
@@ -29,7 +36,8 @@ export function createAuthRoutes({ pool }) {
       req.user = result.rows[0];
       next();
     } catch (error) {
-      res.status(401).json({ error: 'Invalid token' });
+      console.error('Auth DB error:', error);
+      res.status(500).json({ error: 'Server error' });
     }
   }
 
@@ -58,7 +66,7 @@ export function createAuthRoutes({ pool }) {
       const token = jwt.sign(
         { userId: user.id, username: user.username },
         process.env.JWT_SECRET,
-        { expiresIn: '8h' }
+        { expiresIn: '7d' }
       );
       const permissions = await getUserPermissions(user.id);
       res.json({

inventory-server/auth/server.js

@@ -39,6 +39,11 @@ logger.info({
 const app = express();
 const port = Number(process.env.AUTH_PORT) || 3011;
 
+// Behind Caddy on localhost: without this, req.ip is ::1 for every request and
+// the rate limiters put ALL users in one shared bucket (10 logins/15min for
+// the whole office). Same setting as inventory-server's server.js.
+app.set('trust proxy', 'loopback');
+
 const pool = new Pool({
   host: process.env.DB_HOST,
   user: process.env.DB_USER,