🐐 Several security fixes

2026-07-29 16:30:14 +02:00
parent b42abe5f5e
commit c56498239f
21 changed files with 660 additions and 204 deletions
@@ -21,4 +21,9 @@ STRIPE_WEBHOOK_SECRET  = require("STRIPE_WEBHOOK_SECRET")
 # Optional with sensible defaults for local dev
 FRONTEND_URL      = optional("FRONTEND_URL", "http://localhost:5173")
 CORS_ORIGINS      = optional("CORS_ORIGINS", "http://localhost:5173").split(",")
-WIKIRANK_USER_AGENT = optional("WIKIRANK_USER_AGENT", "WikiTCG/1.0")
+WIKIRANK_USER_AGENT = optional("WIKIRANK_USER_AGENT", "WikiTCG/1.0")
+
+# Serves /docs, /redoc and /openapi.json, i.e. the whole API surface. Opt-in on an
+# explicit "true" rather than off on a truthy value, so a typo or an unset var in
+# a new environment fails closed.
+ENABLE_DOCS = optional("ENABLE_DOCS").lower() == "true"