louis/gigafibre-fsm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): stop baking dev-user email into the prod bundle

Browse Source 
VITE_DEV_USER (.env.local = louis@targo.ca) was inlined by Vite into
auth.js's localhost fallback, shipping personal PII in every prod build.
Gate that branch behind import.meta.env.DEV so esbuild dead-code-eliminates
it (and the inlined string) from production builds — permanent, no reliance
on a build flag. Also neutralize the two hardcoded louis@targo.ca in the
campaign TemplateEditor (merge-tag sample → exemple@gigafibre.ca; test-send
default → empty, send button already guards on non-empty). Leak-check clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
louispaulb 2026-07-03 11:36:04 -04:00
parent 69f00840c8
commit c209098a44
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
apps/ops/src/api/auth.js
View File

@ -53,8 +53,9 @@ export async function authFetch (url, opts = {}) {
} }
export async function getLoggedUser () { export async function getLoggedUser () {
// ⚠️ APERÇU LOCAL UNIQUEMENT : identité forcée via VITE_DEV_USER (gardé localhost + env). Inerte en prod. À RETIRER avec le harnais. // ⚠️ APERÇU LOCAL UNIQUEMENT : identité forcée via VITE_DEV_USER (gardé localhost + env). `import.meta.env.DEV`
if ((window.location.hostname === 'localhost' || window.location.hostname === '127.0.0.1') && import.meta.env.VITE_DEV_USER) return import.meta.env.VITE_DEV_USER // vaut false en build prod → esbuild élimine toute cette branche (et la valeur inlinée) du bundle livré.
if (import.meta.env.DEV && (window.location.hostname === 'localhost' || window.location.hostname === '127.0.0.1') && import.meta.env.VITE_DEV_USER) return import.meta.env.VITE_DEV_USER
// First try nginx whoami endpoint (returns Authentik email header) // First try nginx whoami endpoint (returns Authentik email header)
try { try {
const res = await fetch(BASE_URL + '/auth/whoami') const res = await fetch(BASE_URL + '/auth/whoami')

4
apps/ops/src/modules/campaigns/pages/TemplateEditorPage.vue
View File

@ -278,7 +278,7 @@ const editorOptions = {
mergeTags: [ mergeTags: [
{ name: 'Prénom', value: '{{firstname}}', sample: 'Louis' }, { name: 'Prénom', value: '{{firstname}}', sample: 'Louis' },
{ name: 'Nom de famille', value: '{{lastname}}', sample: 'Tremblay' }, { name: 'Nom de famille', value: '{{lastname}}', sample: 'Tremblay' },
{ name: 'Courriel', value: '{{email}}', sample: 'louis@targo.ca' }, { name: 'Courriel', value: '{{email}}', sample: 'exemple@gigafibre.ca' },
{ name: 'Adresse service', value: '{{description}}', sample: '123 Rue de la Rivière, Ste-Clotilde' }, { name: 'Adresse service', value: '{{description}}', sample: '123 Rue de la Rivière, Ste-Clotilde' },
], ],
}, },
@ -562,7 +562,7 @@ const sampleExpiryDate = new Date(Date.now() + 30 * 86400 * 1000)
.toLocaleDateString('fr-CA', { day: 'numeric', month: 'long', year: 'numeric' }) .toLocaleDateString('fr-CA', { day: 'numeric', month: 'long', year: 'numeric' })
const testSendForm = ref({ const testSendForm = ref({
to: 'louis@targo.ca', to: '',
subject: '[TEST] Aperçu du courriel TARGO', subject: '[TEST] Aperçu du courriel TARGO',
via: 'gmail', via: 'gmail',
vars: { vars: {