From c209098a444ace9c7e0c92c52ab332348a74bf88 Mon Sep 17 00:00:00 2001 From: louispaulb Date: Fri, 3 Jul 2026 11:36:04 -0400 Subject: [PATCH] fix(security): stop baking dev-user email into the prod bundle MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit VITE_DEV_USER (.env.local = louis@targo.ca) was inlined by Vite into auth.js's localhost fallback, shipping personal PII in every prod build. Gate that branch behind import.meta.env.DEV so esbuild dead-code-eliminates it (and the inlined string) from production builds — permanent, no reliance on a build flag. Also neutralize the two hardcoded louis@targo.ca in the campaign TemplateEditor (merge-tag sample → exemple@gigafibre.ca; test-send default → empty, send button already guards on non-empty). Leak-check clean. Co-Authored-By: Claude Opus 4.8 --- apps/ops/src/api/auth.js | 5 +++-- apps/ops/src/modules/campaigns/pages/TemplateEditorPage.vue | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/apps/ops/src/api/auth.js b/apps/ops/src/api/auth.js index cb62f23..cf43779 100644 --- a/apps/ops/src/api/auth.js +++ b/apps/ops/src/api/auth.js @@ -53,8 +53,9 @@ export async function authFetch (url, opts = {}) { } export async function getLoggedUser () { - // ⚠️ APERÇU LOCAL UNIQUEMENT : identité forcée via VITE_DEV_USER (gardé localhost + env). Inerte en prod. À RETIRER avec le harnais. - if ((window.location.hostname === 'localhost' || window.location.hostname === '127.0.0.1') && import.meta.env.VITE_DEV_USER) return import.meta.env.VITE_DEV_USER + // ⚠️ APERÇU LOCAL UNIQUEMENT : identité forcée via VITE_DEV_USER (gardé localhost + env). `import.meta.env.DEV` + // vaut false en build prod → esbuild élimine toute cette branche (et la valeur inlinée) du bundle livré. + if (import.meta.env.DEV && (window.location.hostname === 'localhost' || window.location.hostname === '127.0.0.1') && import.meta.env.VITE_DEV_USER) return import.meta.env.VITE_DEV_USER // First try nginx whoami endpoint (returns Authentik email header) try { const res = await fetch(BASE_URL + '/auth/whoami') diff --git a/apps/ops/src/modules/campaigns/pages/TemplateEditorPage.vue b/apps/ops/src/modules/campaigns/pages/TemplateEditorPage.vue index aa28aad..2831907 100644 --- a/apps/ops/src/modules/campaigns/pages/TemplateEditorPage.vue +++ b/apps/ops/src/modules/campaigns/pages/TemplateEditorPage.vue @@ -278,7 +278,7 @@ const editorOptions = { mergeTags: [ { name: 'Prénom', value: '{{firstname}}', sample: 'Louis' }, { name: 'Nom de famille', value: '{{lastname}}', sample: 'Tremblay' }, - { name: 'Courriel', value: '{{email}}', sample: 'louis@targo.ca' }, + { name: 'Courriel', value: '{{email}}', sample: 'exemple@gigafibre.ca' }, { name: 'Adresse service', value: '{{description}}', sample: '123 Rue de la Rivière, Ste-Clotilde' }, ], }, @@ -562,7 +562,7 @@ const sampleExpiryDate = new Date(Date.now() + 30 * 86400 * 1000) .toLocaleDateString('fr-CA', { day: 'numeric', month: 'long', year: 'numeric' }) const testSendForm = ref({ - to: 'louis@targo.ca', + to: '', subject: '[TEST] Aperçu du courriel TARGO', via: 'gmail', vars: {