officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fail closed when PUBLIC_BUILD_ENV is unset

Browse Source 
Origin validation, every rate limiter and the password-strength check each
treated an unset PUBLIC_BUILD_ENV as "relaxed", so a deployment that forgot the
variable silently ran with CORS reflecting any origin, no brute-force limit on
the sole account, and no password rules. setup.sh writes it, but .env.example
never mentioned it.

The three now share IS_DEV_BUILD, which is true only when PUBLIC_BUILD_ENV is
explicitly "dev" or "development". Anything else, including unset, is hardened.
Documented in .env.example.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
brunorezio
2026-07-25 23:30:20 +01:00
co-authored by Claude Opus 5
parent 85596da086
commit 8163f04420
5 changed files with 22 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/servers/_middlewares/origin-validation.ts
+6 -11
View File
@@ -1,7 +1,8 @@
import type { MiddlewareHandler } from 'hono';
import * as errors from '../custom-errors';
import { IS_DEV_BUILD } from '../build-env';
const { PUBLIC_BUILD_ENV, PUBLIC_URL, EXPO_PUBLIC_CLIENT_ORIGIN } = process.env;
const { PUBLIC_URL, EXPO_PUBLIC_CLIENT_ORIGIN } = process.env;
// The allowed production web origin comes from PUBLIC_URL in .env (e.g. https://officer.pastilhas.dev),
// not a hardcoded domain.
@@ -13,9 +14,7 @@ const PUBLIC_ORIGIN = (() => {
}
})();
const WEB_ORIGINS: Record<string, string[]> = {
production: PUBLIC_ORIGIN ? [PUBLIC_ORIGIN] : [],
};
const WEB_ORIGINS: string[] = PUBLIC_ORIGIN ? [PUBLIC_ORIGIN] : [];
const CHROME_EXTENSIONS: string[] = [
// 'chrome-extension://<id>'
@@ -27,9 +26,7 @@ const APP_ORIGINS: string[] = [
].filter((o): o is string => Boolean(o));
export function isOriginAllowed(origin: string | undefined, host?: string): boolean {
if (!PUBLIC_BUILD_ENV || PUBLIC_BUILD_ENV === 'dev' || PUBLIC_BUILD_ENV === 'development') {
return true;
}
if (IS_DEV_BUILD) return true;
if (origin) {
if (origin.startsWith('chrome-extension://')) {
@@ -40,13 +37,11 @@ export function isOriginAllowed(origin: string | undefined, host?: string): bool
return true;
}
const allowed = WEB_ORIGINS[PUBLIC_BUILD_ENV];
return !!allowed?.includes(origin);
return WEB_ORIGINS.includes(origin);
}
if (host) {
const allowed = WEB_ORIGINS[PUBLIC_BUILD_ENV];
return !!allowed?.some((o) => o.endsWith(host));
return WEB_ORIGINS.some((o) => o.endsWith(host));
}
return false;