brunorezioandClaude Opus 5
8163f04420
Origin validation, every rate limiter and the password-strength check each treated an unset PUBLIC_BUILD_ENV as "relaxed", so a deployment that forgot the variable silently ran with CORS reflecting any origin, no brute-force limit on the sole account, and no password rules. setup.sh writes it, but .env.example never mentioned it. The three now share IS_DEV_BUILD, which is true only when PUBLIC_BUILD_ENV is explicitly "dev" or "development". Anything else, including unset, is hardened. Documented in .env.example. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
7 lines
428 B
TypeScript
7 lines
428 B
TypeScript
// Officer relaxes its guards (origin checks, rate limits, password rules) only when PUBLIC_BUILD_ENV
|
|
// explicitly asks for it. Anything else — including an unset variable — gets the hardened path, so a
|
|
// deployment that forgets to set it fails closed rather than silently opening up.
|
|
const { PUBLIC_BUILD_ENV } = process.env;
|
|
|
|
export const IS_DEV_BUILD = PUBLIC_BUILD_ENV === 'dev' || PUBLIC_BUILD_ENV === 'development';
|