Problem : Currently to start the development in the repo we have to setup the Google OAuth setup in frontend env's which is irrelevent, also readme is not updated about the required GoogleOAuth env's .
Proposed solution
Add an optional development-only login that authenticates contributors as a fixed, non-admin local user.
The flow would be:
- A contributor selects “Continue as development user.”
- The backend finds or creates a fixed development user.
- The backend issues the same JWT and authentication cookie used by normal login.
- Protected requests continue through the existing authentication middleware.
- This preserves testing of JWT verification, cookies, token expiration, user lookup, and protected routes.
Security requirements
Require both:
NODE_ENV=development
ENABLE_DEV_LOGIN=true
Refuse to start if ENABLE_DEV_LOGIN=true outside development.
Use one fixed, non-admin development identity.
Do not accept an email, user ID, permissions, or role from the request.
Return 404 when the development login is disabled.
Keep all enforcement on the backend.
Reuse the normal JWT creation and cookie configuration.
Clearly indicate in the UI when development login is enabled.
Add tests proving the endpoint is unavailable in production.
Problem : Currently to start the development in the repo we have to setup the Google OAuth setup in frontend env's which is irrelevent, also readme is not updated about the required GoogleOAuth env's .
Proposed solution
Add an optional development-only login that authenticates contributors as a fixed, non-admin local user.
The flow would be:
Security requirements
Require both:
NODE_ENV=development
ENABLE_DEV_LOGIN=true
Refuse to start if ENABLE_DEV_LOGIN=true outside development.
Use one fixed, non-admin development identity.
Do not accept an email, user ID, permissions, or role from the request.
Return 404 when the development login is disabled.
Keep all enforcement on the backend.
Reuse the normal JWT creation and cookie configuration.
Clearly indicate in the UI when development login is enabled.
Add tests proving the endpoint is unavailable in production.