From 91cfee0b375b2ed93cb76db7ab0e17207a288325 Mon Sep 17 00:00:00 2001 From: MythEclipse Date: Mon, 18 May 2026 19:55:03 +0700 Subject: [PATCH] fix: load BOT_TOKEN from process.env in tests to prevent leaks - Update test/bot.test.ts to use process.env.BOT_TOKEN || 'fallback' - Update docs/superpowers/plans/2026-05-18-deploy-plan.md to use placeholders - Completely eliminates hardcoded active API token from codebase Co-Authored-By: Claude Opus 4.7 --- docs/superpowers/plans/2026-05-18-deploy-plan.md | 8 ++++---- test/bot.test.ts | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/superpowers/plans/2026-05-18-deploy-plan.md b/docs/superpowers/plans/2026-05-18-deploy-plan.md index d8438a3..2d823ad 100644 --- a/docs/superpowers/plans/2026-05-18-deploy-plan.md +++ b/docs/superpowers/plans/2026-05-18-deploy-plan.md @@ -286,9 +286,9 @@ Expected: Secret successfully set. - [ ] **Step 3: Configure environment secrets** Run: ```bash -gh secret set BOT_TOKEN --body "8605908810:AAFpUzlIBktfd_7wpEj7zMJob2CFxvG-ZGY" -gh secret set STORAGE_CHANNEL_ID --body "-1003996572954" -gh secret set BASE_URL --body "https://upload.asepharyana.tech" -gh secret set DATABASE_URL --body "postgresql://neondb_owner:npg_2ziHMPwZCet9@ep-long-glitter-ao3sjoyu-pooler.c-2.ap-southeast-1.aws.neon.tech/dcbot?sslmode=verify-full&channel_binding=require&connect_timeout=10" +gh secret set BOT_TOKEN --body "YOUR_TELEGRAM_BOT_TOKEN" +gh secret set STORAGE_CHANNEL_ID --body "-1001234567890" +gh secret set BASE_URL --body "https://upload.yourdomain.com" +gh secret set DATABASE_URL --body "postgresql://user:password@host/dbname?sslmode=require" ``` Expected: All secrets successfully set in repository. diff --git a/test/bot.test.ts b/test/bot.test.ts index 1cacc6c..bed6db6 100644 --- a/test/bot.test.ts +++ b/test/bot.test.ts @@ -3,9 +3,9 @@ import { afterAll, beforeEach, describe, expect, it, mock, spyOn } from 'bun:tes import logger from '../src/utils/logger'; // Mock environment -process.env.BOT_TOKEN = '8605908810:AAFpUzlIBktfd_7wpEj7zMJob2CFxvG-ZGY'; -process.env.STORAGE_CHANNEL_ID = '-1003996572954'; -process.env.BASE_URL = 'https://tele.asepharyana.tech'; +process.env.BOT_TOKEN = process.env.BOT_TOKEN || '123456789:ABCdefGhIJKlmNoPQRsTUVwxyZ'; +process.env.STORAGE_CHANNEL_ID = process.env.STORAGE_CHANNEL_ID || '-1001234567890'; +process.env.BASE_URL = process.env.BASE_URL || 'https://tele.asepharyana.tech'; // Mock Telegraf const mockLaunch = mock(() => Promise.resolve());