angel
ccc00d5c89
- dev auth flow (side-step OAuth) - db event processing integration tests - dev scripts (eg Makefile) - db / test db migration setup scripts.
25 lines
2.1 KiB
Markdown
25 lines
2.1 KiB
Markdown
# Work Summary — 2026-08-03 20:09
|
|
|
|
## Task
|
|
Move hardcoded secrets (Auth0 client secret, Etsy API credentials, Postgres DSN) out of source and into environment configuration, as the first step toward a faster local dev/test loop.
|
|
|
|
## Context
|
|
Audited the repo for iteration/testing friction. Found no `.env`/config layer at all — Auth0 client secret, Etsy API keystring/shared secret, and the Postgres connection string (including its password) were literal constants in `domains/authentication/auth.go`, `main.go`, and `database.go`, committed to git. This also blocked adding a dev-only auth bypass cleanly, since `authentication.New` had no way to accept alternate config.
|
|
|
|
## Changes
|
|
- Added `config/config.go`: loads `.env` via `github.com/joho/godotenv`, reads required env vars, fails fast with a clear error naming any that are missing.
|
|
- Added `.env` (gitignored, holds real local values so nothing broke) and `.env.example` (committed template).
|
|
- `.gitignore`: added `.env`.
|
|
- `database.go`: `newPool` now takes `databaseURL` as a parameter instead of a hardcoded DSN.
|
|
- `domains/authentication/auth.go`: removed the `AUTH0_*` constants; `authentication.New` now takes `domain, clientID, clientSecret, callbackURL` as parameters; `Authenticator` gained a `domain` field used by `GetLogoutURL`.
|
|
- `main.go`: calls `config.Load()` up front and threads values into `newPool`, `authentication.New`, and the Etsy `NewPlatform` call (replacing the hardcoded `etsyAPIKeystring`/`etsyAPISharedSecret` consts).
|
|
- `go.mod`/`go.sum`: added `github.com/joho/godotenv`; `go mod tidy` also dropped a few unrelated stale indirect deps.
|
|
|
|
## Verification
|
|
- `go build ./...` — clean.
|
|
- `go run .` — boots against `.env`, registers all routes identically to before the change.
|
|
|
|
## Follow-ups / not done here
|
|
- Secrets are still present in old git history (pre-existing commits) — not rotated or scrubbed. Worth rotating the Auth0 client secret and Etsy credentials at some point since repo history still exposes them.
|
|
- Next planned step: add an env-gated dev-only auth bypass (mint a local session without going through real Auth0), now that config is externalized enough to support it cleanly.
|