Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[refactor] implement dotenv to hide api-keys from codebase #277

Closed
wants to merge 5 commits into from

Conversation

opxdelwin
Copy link

@opxdelwin opxdelwin commented Feb 26, 2024

Description

This PR will add a .env file to securely store these credentials. The code now retrieves them from the environment variable, keeping them hidden within the development environment.

Here's what this means:

  • Improved security: Credentials are no longer directly exposed in the code.
  • Separate testing setup: Developers can easily create their own Firebase and Appwrite projects for local testing without needing real credentials.

Fixes #273

Type of change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Refactor (does not change functionality, e.g. code style improvements, linting)
  • Documentation update

How Has This Been Tested?

I haven't added unit tests as these are code refactors, moreover it doesn't look like tests have been initialized beforehand.
I'll be happy to add if required.

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published in downstream modules
  • I have checked my code and corrected any misspellings

Maintainer Checklist

  • closes #xxx
  • Tag the PR with the appropriate labels

Copy link
Member

@chandansgowda chandansgowda left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can't we just tell them to add the firebase_options.dart file instead of loading it from env file ?


- Duplicate `env/.env.sample` and rename as `.env`
- Create a Firebase project [here](https://console.firebase.google.com/)
- Set up firebase app as mentioned [here]()
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add link here

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes will do!

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've updated, along with non null checks for optional parameters on firebase_options.dart.

@opxdelwin
Copy link
Author

As of now, API keys of the production server are exposed, which might have been unintended. This could lead to exploitation of resources and incur unexpected costs. That is why we prefer .env while initialisation of any project.

Secondly, But then, later when we're to run automation to publish releases straight to the respective platform, or run checks on PR and commits, removing this file from the codebase would raise issues.

@Aarush-Acharya Aarush-Acharya added the ua unattended label May 24, 2024
@Aarush-Acharya
Copy link
Contributor

Hey @opxdelwin Thanks a lot for your contribution 🚀✨,

having a .env is always considered as on of the best practices for any repository. But currenlty we planning to have a .bat script that creates an appwrite env similar to our main env on the contibutors local machine using appwrite self hosted (docker). Thus we wont have to expose our env variables anymore rather more control would be in the contributors hands.

We really appreciate your work towards Resonate. There are a lot of issues and things to be done in the app. Lets move forward and build Resonate a beautiful app.

Thank you

@Aarush-Acharya Aarush-Acharya added enhancement New feature or request and removed ua unattended labels May 24, 2024
@opxdelwin opxdelwin deleted the dotenv-integration branch May 24, 2024 11:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

The Api Keys and Database Credentials are clearly visible
3 participants