Skip to content

Env template and ignore files cleanup #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JoshD94 wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Env template and ignore files cleanup #64

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2c689a8
Env template and ignore files cleanup
JoshD94 Feb 26, 2026
e0eca1b
Merge branch 'master' into josh-cleanup
claiireyu Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
# Git
.git/
.gitignore
.github/

# Python
__pycache__/
*.py[cod]
*.pyo
*.pyd

# Virtual environments
venv/
.venv/
env/

# Secrets & credentials (inject at runtime via env vars or secrets)
.env
.envrc
firebase-service-account-key.json
ca-certificate.crt

# Docker
docker-compose.yml
.dockerignore

# Logs
*.log

# macOS
.DS_Store

# IDEs
.idea/
.vscode/

# Docs
README.md
3 changes: 2 additions & 1 deletion .env_template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,5 @@ YOUTUBE_API_KEY=
MONGO_URI=
MONGO_DB=
STAGE=
DAILY_SUN_URL=
DAILY_SUN_URL=
JWT_SECRET_KEY=

@coderabbitai coderabbitai Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -e
printf '%s\n' '--- tracked files ---'
git ls-files | sed -n '1,160p'
printf '%s\n' '--- relevant symbols and configuration ---'
rg -n -S --hidden --glob '!node_modules' --glob '!dist' --glob '!build' \
  'JWT_SECRET_KEY|JWT_SECRET|Flask-JWT|JWTManager|SECRET_KEY|dotenv|\.env_template' .
printf '%s\n' '--- candidate file sizes ---'
for f in .env_template src/utils/constants.py app.py; do
  if [ -f "$f" ]; then wc -l "$f"; fi
done

Repository: cuappdev/score-backend

Length of output: 2597

🏁 Script executed:

#!/bin/bash
set -e
printf '%s\n' '--- .env_template ---'
cat -n .env_template
printf '%s\n' '--- constants.py imports and environment reads ---'
sed -n '1,35p' src/utils/constants.py
printf '%s\n' '--- app startup and JWT setup ---'
sed -n '1,50p' app.py
printf '%s\n' '--- deployment and environment loading ---'
for f in .github/workflows/deploy-dev.yml .github/workflows/deploy-prod.yml Dockerfile docker-compose.yml README.md; do
  printf '\n--- %s ---\n' "$f"
  rg -n -C 4 -S 'env|environment|dotenv|JWT_SECRET_KEY|docker|secret|deploy|run' "$f" || true
done

Repository: cuappdev/score-backend

Length of output: 7234

🌐 Web query:

Flask-JWT-Extended 4.7.1 empty JWT_SECRET_KEY behavior config validation

💡 Result:

In Flask-JWT-Extended (including version 4.7.1), the library validates the secret key configuration at runtime during the token encoding or decoding process, rather than during the initial Flask application startup [1][2]. If you are using a symmetric signing algorithm (the default), the library checks for the secret key using the following logic [1]: 1. It first checks if JWT_SECRET_KEY is defined in the Flask application configuration (app.config). 2. If JWT_SECRET_KEY is not set (is None or empty), it automatically falls back to using the application's Flask SECRET_KEY [1][3][4]. 3. If neither JWT_SECRET_KEY nor the Flask SECRET_KEY is set, the library will raise a RuntimeError when an attempt is made to encode or decode a token [1][2]. The library does not perform an eager validation of these keys when the JWTManager is initialized; therefore, an empty configuration will not prevent the application from starting [1][2]. Instead, the runtime error occurs only when the application attempts to perform a cryptographic operation requiring the key [1][2]. For asymmetric algorithms (e.g., RS256), the library mandates the explicit configuration of JWT_PRIVATE_KEY and/or JWT_PUBLIC_KEY, and it will raise a RuntimeError if these specific keys are missing [1][2].

Citations:

🏁 Script executed:

#!/bin/bash
set -e
printf '%s\n' '--- complete compose configuration ---'
cat -n docker-compose.yml
printf '%s\n' '--- environment documentation and ignore rules ---'
cat -n README.md | sed -n '1,100p'
cat -n .gitignore
printf '%s\n' '--- references to the template and environment files ---'
rg -n -S --hidden --glob '!node_modules' --glob '!dist' --glob '!build' \
  '\.env_template|cp .*\.env|env_file:|JWT_SECRET_KEY|load_dotenv' .
printf '%s\n' '--- Flask-JWT-Extended source for the pinned version ---'
python3 - <<'PY'
from urllib.request import urlopen
url = "https://raw.githubusercontent.com/vimalloc/flask-jwt-extended/4.7.1/flask_jwt_extended/config.py"
try:
    text = urlopen(url, timeout=10).read().decode()
except Exception as exc:
    print(f"fetch failed: {exc}")
else:
    for i, line in enumerate(text.splitlines(), 1):
        if "secret" in line.lower() or "JWT_SECRET_KEY" in line:
            start = max(1, i - 4)
            end = min(len(text.splitlines()), i + 8)
            print(f"--- lines {start}-{end} ---")
            print("\n".join(f"{n}: {text.splitlines()[n-1]}" for n in range(start, end + 1)))
PY

Repository: cuappdev/score-backend

Length of output: 3305

🏁 Script executed:

#!/bin/bash
set -e
python3 - <<'PY'
from urllib.request import Request, urlopen
import ssl

url = "https://raw.githubusercontent.com/vimalloc/flask-jwt-extended/4.7.1/flask_jwt_extended/config.py"
ctx = ssl._create_unverified_context()
text = urlopen(Request(url, headers={"User-Agent": "review-check"}), context=ctx, timeout=10).read().decode()
lines = text.splitlines()
for i, line in enumerate(lines, 1):
    if "secret" in line.lower():
        start = max(1, i - 5)
        end = min(len(lines), i + 10)
        print("\n".join(f"{n}: {lines[n-1]}" for n in range(start, end + 1)))
        print("---")
PY

Repository: cuappdev/score-backend

Length of output: 3946

Fail fast when JWT_SECRET_KEY is blank.

docker-compose.yml loads .env; the deployment workflows do not load .env_template. If .env contains a blank value, the application accepts it, and Flask-JWT-Extended raises a RuntimeError during token operations because no fallback secret is configured. Reject blank values at startup and document that deployments must provide a high-entropy secret.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.env_template at line 6, Update the startup configuration validation
associated with JWT_SECRET_KEY to reject blank or whitespace-only values before
the application serves requests, and ensure the failure is immediate and clear.
Add concise guidance in the environment template that deployments must supply a
high-entropy JWT secret; do not rely on a fallback value.

37 changes: 34 additions & 3 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,39 @@
venv/
.venv
# Python
__pycache__/
*.py[cod]
*.pyd
*.pyo
.Python

# Virtual environments
venv/
.venv/
env/
ENV/

# Distribution / packaging
build/
dist/
*.egg-info/
*.egg

# Testing & coverage
.pytest_cache/
.coverage
htmlcov/
.tox/

# Logs
*.log
pip-log.txt

# Secrets & credentials
.env
.envrc
firebase-service-account-key.json
ca-certificate.crt

# macOS
.DS_Store
ca-certificate.crt
firebase-service-account-key.json
firebase-service-account-key.json
6 changes: 0 additions & 6 deletions package-lock.json
View file
Open in desktop

This file was deleted.

Loading