Files

T

angel 9c9b33e34f Claude-assisted improvements (untested)

- dev auth flow (side-step OAuth)
- db event processing integration tests
- dev scripts (eg Makefile)
- db / test db migration setup scripts.

2026-08-20 00:24:04 -06:00

2.1 KiB

Raw Blame History

Work Summary — 2026-08-03 20:09

Task

Move hardcoded secrets (Auth0 client secret, Etsy API credentials, Postgres DSN) out of source and into environment configuration, as the first step toward a faster local dev/test loop.

Context

Audited the repo for iteration/testing friction. Found no .env/config layer at all — Auth0 client secret, Etsy API keystring/shared secret, and the Postgres connection string (including its password) were literal constants in domains/authentication/auth.go, main.go, and database.go, committed to git. This also blocked adding a dev-only auth bypass cleanly, since authentication.New had no way to accept alternate config.

Changes

Added config/config.go: loads .env via github.com/joho/godotenv, reads required env vars, fails fast with a clear error naming any that are missing.
Added .env (gitignored, holds real local values so nothing broke) and .env.example (committed template).
.gitignore: added .env.
database.go: newPool now takes databaseURL as a parameter instead of a hardcoded DSN.
domains/authentication/auth.go: removed the AUTH0_* constants; authentication.New now takes domain, clientID, clientSecret, callbackURL as parameters; Authenticator gained a domain field used by GetLogoutURL.
main.go: calls config.Load() up front and threads values into newPool, authentication.New, and the Etsy NewPlatform call (replacing the hardcoded etsyAPIKeystring/etsyAPISharedSecret consts).
go.mod/go.sum: added github.com/joho/godotenv; go mod tidy also dropped a few unrelated stale indirect deps.

Verification

go build ./... — clean.
go run . — boots against .env, registers all routes identically to before the change.

Follow-ups / not done here

Secrets are still present in old git history (pre-existing commits) — not rotated or scrubbed. Worth rotating the Auth0 client secret and Etsy credentials at some point since repo history still exposes them.
Next planned step: add an env-gated dev-only auth bypass (mint a local session without going through real Auth0), now that config is externalized enough to support it cleanly.

2.1 KiB Raw Blame History