Hamza/saqel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: Remove all hardcoded secret keys from codebase and enforce strict getenv environment loading

Browse Source
This commit is contained in:
Hamza-Ayed
2026-08-28 02:34:13 +03:00
parent 7b778a1879
commit 7ddaff6b14
2 changed files with 33 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/.env.example
+24 -35
View File
@@ -1,47 +1,36 @@
# ============================================================================== # ==========================================
# SAQEL PLATFORM — STRICT ENVIRONMENT CONFIGURATION (.env) # SAQEL ENVIRONMENT CONFIGURATION TEMPLATE
# Rule: NO fallback defaults. Every variable below is strictly required. # ==========================================
# ==============================================================================
# 1. Application & Staging Settings # Application Environment
APP_NAME=Saqel
APP_ENV=production APP_ENV=production
APP_DEBUG=false APP_DEBUG=false
APP_URL=https://saqel.intaleqapp.com APP_URL=https://saqel.intaleqapp.com
ALLOWED_ORIGIN=https://saqel.intaleqapp.com
# 2. Database Configuration (MySQL 8.4) # Database Connection
DB_HOST=127.0.0.1 DB_HOST=127.0.0.1
DB_PORT=3306 DB_PORT=3306
DB_DATABASE=saqel DB_DATABASE=saqel_db
DB_USERNAME=saqel_user DB_USERNAME=saqel_user
DB_PASSWORD=YOUR_STRONG_DB_PASSWORD DB_PASSWORD=your_secure_db_password
# 3. Redis Configuration (Sessions, OTP, Nabeh Token Cache, Rate Limiting) # Authentication & Security
REDIS_HOST=127.0.0.1 JWT_SECRET=your_super_secret_jwt_key_here
REDIS_PORT=6379
REDIS_PASSWORD=
# 4. Cryptographic & Security Keys (OWASP AES-256-GCM + Blind Indexing + JWT) # Gemini AI API Configuration
# Must be at least 32 characters long GEMINI_API_KEY=your_gemini_api_key_here
ENCRYPTION_KEY=YOUR_RANDOM_32_CHAR_ENCRYPTION_KEY_HERE GEMINI_MODEL=gemini-2.0-flash
HMAC_SALT=YOUR_RANDOM_32_CHAR_HMAC_SALT_HERE
JWT_SECRET=YOUR_RANDOM_64_CHAR_JWT_SECRET_HERE
# 5. Nabeh Gateway API (منصة نبيه — WhatsApp OTP Gateway) # Cloudflare R2 Object Storage & CDN
NABEH_AUTH_URL=https://nabeh.intaleqapp.com/api/auth/login CLOUDFLARE_R2_ACCOUNT_ID=
NABEH_SEND_URL=https://nabeh.intaleqapp.com/api/otp/send CLOUDFLARE_R2_ACCESS_KEY=
NABEH_EMAIL=YOUR_NABEH_ACCOUNT_EMAIL CLOUDFLARE_R2_SECRET_KEY=
NABEH_PASSWORD=YOUR_NABEH_ACCOUNT_PASSWORD CLOUDFLARE_R2_ENDPOINT=https://<account_id>.r2.cloudflarestorage.com
NABEH_APP_NAME="منصة صَقِل التعليمية" CLOUDFLARE_R2_BUCKET=saqel-media
CLOUDFLARE_R2_PUBLIC_URL=https://pub-<hash>.r2.dev
# 6. Bunny Stream Video CDN & DRM # Bunny.net Stream CDN (Optional Alternative)
BUNNY_API_KEY=YOUR_BUNNY_STREAM_API_KEY BUNNY_STREAM_LIBRARY_ID=
BUNNY_LIBRARY_ID=YOUR_BUNNY_LIBRARY_ID BUNNY_STREAM_API_KEY=
BUNNY_TOKEN_AUTH_KEY=YOUR_BUNNY_SECURITY_TOKEN_KEY BUNNY_STREAM_TOKEN_KEY=
BUNNY_CDN_HOSTNAME=video.saqel.com BUNNY_STREAM_HOST=
# 7. AI & Speech Layer
GEMINI_API_KEY=YOUR_GOOGLE_GEMINI_API_KEY
GEMINI_MODEL=gemini-2.5-flash
GROQ_API_KEY=YOUR_GROQ_WHISPER_API_KEY
backend/app/Services/VideoService.php
+9 -9
View File
@@ -351,10 +351,10 @@ class VideoService
private static function getBunnyConfig(): array private static function getBunnyConfig(): array
{ {
return [ return [
'library_id' => getenv('BUNNY_STREAM_LIBRARY_ID') ?: '285491', 'library_id' => getenv('BUNNY_STREAM_LIBRARY_ID') ?: '',
'api_key' => getenv('BUNNY_STREAM_API_KEY') ?: '', 'api_key' => getenv('BUNNY_STREAM_API_KEY') ?: '',
'token_key' => getenv('BUNNY_STREAM_TOKEN_KEY') ?: getenv('JWT_SECRET') ?: 'SaqelSecureBunnyToken2026', 'token_key' => getenv('BUNNY_STREAM_TOKEN_KEY') ?: getenv('JWT_SECRET') ?: '',
'pull_zone_host' => getenv('BUNNY_STREAM_HOST') ?: 'vz-saqel.b-cdn.net', 'pull_zone_host' => getenv('BUNNY_STREAM_HOST') ?: '',
'embed_host' => 'iframe.mediadelivery.net' 'embed_host' => 'iframe.mediadelivery.net'
]; ];
} }
@@ -483,12 +483,12 @@ class VideoService
public static function getR2Config(): array public static function getR2Config(): array
{ {
return [ return [
'account_id' => getenv('CLOUDFLARE_R2_ACCOUNT_ID') ?: 'fd6e6388f69f6b2d7c073861f9bef4ee', 'account_id' => getenv('CLOUDFLARE_R2_ACCOUNT_ID') ?: '',
'access_key' => getenv('CLOUDFLARE_R2_ACCESS_KEY') ?: 'ba4df2726c7e717f2c4b7fff7db0e1ea', 'access_key' => getenv('CLOUDFLARE_R2_ACCESS_KEY') ?: '',
'secret_key' => getenv('CLOUDFLARE_R2_SECRET_KEY') ?: 'ce5dfeef2b89e4bb2760c2e856006cc201e6218018a5d2bf25188a2ced61687b', 'secret_key' => getenv('CLOUDFLARE_R2_SECRET_KEY') ?: '',
'endpoint' => getenv('CLOUDFLARE_R2_ENDPOINT') ?: 'https://fd6e6388f69f6b2d7c073861f9bef4ee.r2.cloudflarestorage.com', 'endpoint' => getenv('CLOUDFLARE_R2_ENDPOINT') ?: '',
'bucket' => getenv('CLOUDFLARE_R2_BUCKET') ?: 'saqel-media', 'bucket' => getenv('CLOUDFLARE_R2_BUCKET') ?: '',
'public_url' => getenv('CLOUDFLARE_R2_PUBLIC_URL') ?: 'https://pub-85b40493a03d464cb6c5b4adb43749f5.r2.dev' 'public_url' => getenv('CLOUDFLARE_R2_PUBLIC_URL') ?: ''
]; ];
} }