officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fail closed when PUBLIC_BUILD_ENV is unset

Browse Source 
Origin validation, every rate limiter and the password-strength check each
treated an unset PUBLIC_BUILD_ENV as "relaxed", so a deployment that forgot the
variable silently ran with CORS reflecting any origin, no brute-force limit on
the sole account, and no password rules. setup.sh writes it, but .env.example
never mentioned it.

The three now share IS_DEV_BUILD, which is true only when PUBLIC_BUILD_ENV is
explicitly "dev" or "development". Anything else, including unset, is hardened.
Documented in .env.example.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
brunorezio
2026-07-25 23:30:20 +01:00
co-authored by Claude Opus 5
parent 85596da086
commit 8163f04420
5 changed files with 22 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/servers/api/auth/change-password.ts
+2 -4
View File
@@ -4,13 +4,11 @@ import argon2 from 'argon2';
import { sign } from '@@/jwt';
import * as errors from '@@/custom-errors';
import { validatePassword } from './validate-password';
const { PUBLIC_BUILD_ENV } = process.env;
const isProduction = PUBLIC_BUILD_ENV === 'production' || PUBLIC_BUILD_ENV === 'staging';
import { IS_DEV_BUILD } from '@@/build-env';
export const changePasswordHandler: Handler = async function (ctx) {
const { password, newPassword } = ctx.get('body');
if (isProduction) validatePassword(newPassword);
if (!IS_DEV_BUILD) validatePassword(newPassword);
const reqUser = ctx.get('user');
const dbUser = await getUserById(reqUser.id);