mirror of
https://github.com/jcreek/LivingDexTracker.git
synced 2026-09-14 17:42:17 +00:00
Josh Creek
92d6460765
The endpoint overrides are read through `$env/dynamic/private`, so they are evaluated per request in production, not baked in at build time. That made a single injected environment variable enough to redirect the authorization-code and refresh-token POSTs - which carry the OAuth client secret and the user's refresh token - to an arbitrary host, and to redirect the user's authorize hop to an arbitrary URL. Overrides are now ignored unless ALLOW_PROVIDER_ENDPOINT_OVERRIDES is exactly "true" and the value is a loopback URL. `npm run test:bdd` sets the flag; nothing else should. resolveProviderEndpoints is pure so the refusals are unit tested, including near-miss hosts such as http://127.0.0.1.example. Also drops the unused `pokedex` parameter from buildCsv rather than silencing it with `void`, and the dead hasGigantamaxed field from its fallback record.
23 lines
968 B
Bash
23 lines
968 B
Bash
PUBLIC_SUPABASE_URL="your-supabase-project-url"
|
|
PUBLIC_SUPABASE_ANON_KEY="your-supabase-anon-key"
|
|
SUPABASE_SERVICE_ROLE_KEY="your-supabase-service-role-key"
|
|
PUBLIC_USE_LOCAL_POKEMON_SPRITE_FOLDER="false"
|
|
|
|
GOOGLE_OAUTH_CLIENT_ID="your-google-client-id"
|
|
GOOGLE_OAUTH_CLIENT_SECRET="your-google-client-secret"
|
|
DROPBOX_OAUTH_CLIENT_ID="your-dropbox-client-id"
|
|
DROPBOX_OAUTH_CLIENT_SECRET="your-dropbox-client-secret"
|
|
|
|
# Endpoint overrides for deterministic local provider tests. They are ignored unless
|
|
# ALLOW_PROVIDER_ENDPOINT_OVERRIDES is exactly "true", and only loopback URLs are accepted -
|
|
# these endpoints receive the OAuth client secret and refresh token, so never set this in a
|
|
# deployed environment. `npm run test:bdd` sets it for you.
|
|
ALLOW_PROVIDER_ENDPOINT_OVERRIDES=""
|
|
GOOGLE_OAUTH_AUTHORIZE_URL=""
|
|
GOOGLE_OAUTH_TOKEN_URL=""
|
|
GOOGLE_DRIVE_API_URL=""
|
|
GOOGLE_DRIVE_UPLOAD_URL=""
|
|
DROPBOX_OAUTH_AUTHORIZE_URL=""
|
|
DROPBOX_OAUTH_TOKEN_URL=""
|
|
DROPBOX_UPLOAD_URL=""
|