mirror of
https://github.com/vernu/textbee.git
synced 2026-08-04 11:23:41 -04:00
fdc1609946
The tokeninfo response was trusted without checking who the token was issued for, so a token minted for any other Google OAuth client was accepted. The audience is now matched against GOOGLE_CLIENT_ID and the verified-email flag is required. The audience check is skipped with a logged warning when the variable is unset, so an unconfigured environment does not lose Google sign-in. Password reset requests now return the same response whether or not the address is registered, an unknown address on reset reports the same error as a bad code, a non-string email no longer reaches the query, and the code is drawn from crypto.randomInt. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
47 lines
1.4 KiB
Plaintext
47 lines
1.4 KiB
Plaintext
PORT=3001
|
||
MONGO_URI=mongodb://adminUser:adminPassword@textbee-db:27017/textbee?authSource=admin
|
||
|
||
# to setup initial password
|
||
MONGO_ROOT_USER=adminUser
|
||
MONGO_ROOT_PASS=adminPassword
|
||
|
||
JWT_SECRET=secret # change this to a secure random string
|
||
JWT_EXPIRATION=60d
|
||
|
||
FRONTEND_URL=http://localhost:3000
|
||
|
||
#Update from Firebase service account json file
|
||
FIREBASE_PROJECT_ID=
|
||
FIREBASE_PRIVATE_KEY_ID=
|
||
FIREBASE_PRIVATE_KEY=
|
||
FIREBASE_CLIENT_EMAIL=
|
||
FIREBASE_CLIENT_ID=
|
||
FIREBASE_CLIENT_C509_CERT_URL=
|
||
|
||
MAIL_HOST=
|
||
MAIL_PORT=
|
||
MAIL_USER=
|
||
MAIL_PASS=
|
||
MAIL_FROM=
|
||
MAIL_REPLY_TO=
|
||
ADMIN_EMAIL=
|
||
|
||
# Webhook delivery HTTP timeout in milliseconds (default 30000, min 10000, max 60000)
|
||
WEBHOOK_DELIVERY_TIMEOUT_MS=30000
|
||
|
||
# Auto-disable webhook subscriptions with high failure rate (cron runs daily)
|
||
WEBHOOK_AUTO_DISABLE_FAILURE_THRESHOLD=50
|
||
WEBHOOK_AUTO_DISABLE_LOOKBACK_DAYS=30
|
||
# Min failure rate 0–1 to disable (e.g. 0.50 = 50%; only disable when failures/total >= this)
|
||
WEBHOOK_AUTO_DISABLE_MIN_FAILURE_RATE=0.50
|
||
|
||
# SMS Queue Configuration
|
||
USE_SMS_QUEUE=false
|
||
REDIS_URL=redis://localhost:6379 # if queue is enabled, redis url is required
|
||
|
||
CLOUDFLARE_TURNSTILE_SECRET_KEY=1x0000000000000000000000000000000AA
|
||
|
||
# OAuth client id(s) that Google sign-in tokens must be issued for. Must match
|
||
# the web app's NEXT_PUBLIC_GOOGLE_CLIENT_ID. Comma-separate for several clients.
|
||
# When unset, the audience is not checked and a warning is logged.
|
||
GOOGLE_CLIENT_ID= |