mirror of
https://github.com/tiennm99/store-scraper-bot.git
synced 2026-10-13 00:15:07 +00:00
tiennm99
6ed9c2dcb0
- remove MONGODB_URI from .env.example (Atlas migration done; deleted from Vercel cloud env too) - trim .env.deploy.example to vars actually consumed by deploy scripts (Upstash creds were only needed by the now-deleted migration script) - README config table: drop ENV / SOURCE_COMMIT / SCHEDULE_CHECK_APP_TIME (never read by code; Java-era leftovers) - check-secret-leaks: drop MONGODB_URI; add UPSTASH/KV/CRON tokens; widen scan roots to include api/ - add scripts/list-upstash-keys.js read-only ops helper
49 lines
1.3 KiB
JavaScript
49 lines
1.3 KiB
JavaScript
#!/usr/bin/env node
|
|
// Fails CI if any source file logs a secret via env.
|
|
// Pattern: console.{log,info,warn,error,debug}(... env.<SECRET> ...)
|
|
import { readdirSync, readFileSync, statSync } from 'node:fs';
|
|
import { join } from 'node:path';
|
|
|
|
const SECRETS = [
|
|
'TELEGRAM_BOT_TOKEN',
|
|
'TELEGRAM_WEBHOOK_SECRET',
|
|
'UPSTASH_REDIS_REST_TOKEN',
|
|
'KV_REST_API_TOKEN',
|
|
'CRON_SECRET',
|
|
'ADMIN_IDS',
|
|
];
|
|
const ROOTS = ['src', 'scripts', 'api'];
|
|
|
|
function* walk(dir) {
|
|
let entries;
|
|
try {
|
|
entries = readdirSync(dir);
|
|
} catch {
|
|
return;
|
|
}
|
|
for (const entry of entries) {
|
|
const p = join(dir, entry);
|
|
const s = statSync(p);
|
|
if (s.isDirectory()) yield* walk(p);
|
|
else if (/\.(js|mjs|ts)$/.test(p)) yield p;
|
|
}
|
|
}
|
|
|
|
const violations = [];
|
|
for (const root of ROOTS) {
|
|
for (const file of walk(root)) {
|
|
const text = readFileSync(file, 'utf8');
|
|
for (const secret of SECRETS) {
|
|
const re = new RegExp(`console\\.(log|info|warn|error|debug)\\([^)]*\\benv\\.${secret}\\b`);
|
|
if (re.test(text)) violations.push({ file, secret });
|
|
}
|
|
}
|
|
}
|
|
|
|
if (violations.length > 0) {
|
|
console.error('Secret-leak violations:');
|
|
for (const v of violations) console.error(` ${v.file}: env.${v.secret} in console.*`);
|
|
process.exit(1);
|
|
}
|
|
console.log('check-secret-leaks: clean');
|