Feature/msg signing on refactor

.env.example

@@ -0,0 +1,53 @@
+# -----------------------------------------------------------------------------
+# Approov Node.js Quickstart - Environment Configuration
+#
+# This file is a template for local development. Copy it to `.env` and replace
+# the placeholder values with real secrets or environment-specific settings.
+# The server loads `.env` on startup and uses these variables to configure:
+#   - which address/port to bind
+#   - how to verify Approov tokens
+#   - optional message signing validation
+#   - optional verbose HTTP logging for debugging
+# -----------------------------------------------------------------------------
+
+# HTTP port the backend listens on (internal server port)
+HTTP_PORT=8111
+
+# Approov shared secret (base64url). Required to verify Approov JWTs.
+# Obtain with: `approov secret -get base64url`
+APPROOV_BASE64URL_SECRET=approov_base64url_secret_here
+
+# Optional: account-level message signing secret.
+# Use ONE of the formats below. If you set more than one, the first non-empty
+# value (in the order shown) is used.
+APPROOV_ACCOUNT_MESSAGE_SIGNING_SECRET_BASE64URL=
+APPROOV_ACCOUNT_MESSAGE_SIGNING_SECRET_BASE64=
+APPROOV_ACCOUNT_MESSAGE_SIGNING_SECRET_RAW=
+
+# Optional: expected account key id for message signing (mskid claim).
+# If set, incoming requests must match this key id when using account signatures.
+APPROOV_ACCOUNT_MESSAGE_SIGNING_KEY_ID=
+
+# Signature mode toggle:
+# - false (default): install signature only
+# - true: account signature only (install signature disabled)
+APPROOV_ENABLE_ACCOUNT_SIGNATURE=false
+
+# Optional: allowed clock skew (seconds) when validating message signature
+# created/expires parameters. Increase slightly if clients' clocks drift.
+APPROOV_MESSAGE_SIGNING_TOLERANCE_SECONDS=60
+
+# Verbose logging for Approov + message signing flow (true/false).
+# Use `true` when debugging token/signature issues.
+APPROOV_VERBOSE_LOGGING=true
+
+# Log full HTTP request/response payloads (true/false).
+# Use with caution: this can log sensitive data.
+APPROOV_HTTP_LOGGING=false
+
+# Address/hostname to bind the HTTP server to.
+# Use 0.0.0.0 when running in Docker so the port is reachable externally.
+SERVER_HOSTNAME=0.0.0.0
+
+# Command that starts your server inside the container (Docker).
+APP_START_CMD=npm start

.gitignore

@@ -1,2 +1,7 @@
 .env
 node_modules/
+!vendor/http-message-signatures/node_modules/
+!vendor/http-message-signatures/node_modules/structured-headers/
+!vendor/http-message-signatures/node_modules/structured-headers/**
+.config/
+.DS_Store