Merge pull request #764 from CodingCatDev/fix/guest-portal-security-hardening

sec(site,sanity): harden guest portal secret, scrub private emails & tokens

Author: codercatdev

.github/workflows/deploy-workers.yml

@@ -60,13 +60,21 @@ jobs:
           if [ -n "$OPENROUTER_API_KEY" ]; then
             echo "$OPENROUTER_API_KEY" | pnpm --filter @codingcatdev/site exec wrangler secret put OPENROUTER_API_KEY --env=""
           fi
+          if [ -n "$SANITY_API_WRITE_TOKEN" ]; then
+            echo "$SANITY_API_WRITE_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put SANITY_API_WRITE_TOKEN --env=""
+          fi
+          if [ -n "$GUEST_PORTAL_SECRET" ]; then
+            echo "$GUEST_PORTAL_SECRET" | pnpm --filter @codingcatdev/site exec wrangler secret put GUEST_PORTAL_SECRET --env=""
+          fi
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           SANITY_API_READ_TOKEN: ${{ secrets.SANITY_API_READ_TOKEN }}
+          SANITY_API_WRITE_TOKEN: ${{ secrets.SANITY_API_WRITE_TOKEN }}
           SANITY_AUTH_TOKEN: ${{ secrets.SANITY_AUTH_TOKEN }}
           SANITY_CONTEXT_TOKEN: ${{ secrets.SANITY_CONTEXT_TOKEN }}
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          GUEST_PORTAL_SECRET: ${{ secrets.GUEST_PORTAL_SECRET }}
 
   deploy-production:
     if: github.ref == 'refs/heads/main'
@@ -114,10 +122,18 @@ jobs:
           if [ -n "$OPENROUTER_API_KEY" ]; then
             echo "$OPENROUTER_API_KEY" | pnpm --filter @codingcatdev/site exec wrangler secret put OPENROUTER_API_KEY --env production
           fi
+          if [ -n "$SANITY_API_WRITE_TOKEN" ]; then
+            echo "$SANITY_API_WRITE_TOKEN" | pnpm --filter @codingcatdev/site exec wrangler secret put SANITY_API_WRITE_TOKEN --env production
+          fi
+          if [ -n "$GUEST_PORTAL_SECRET" ]; then
+            echo "$GUEST_PORTAL_SECRET" | pnpm --filter @codingcatdev/site exec wrangler secret put GUEST_PORTAL_SECRET --env production
+          fi
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           SANITY_API_READ_TOKEN: ${{ secrets.SANITY_API_READ_TOKEN }}
+          SANITY_API_WRITE_TOKEN: ${{ secrets.SANITY_API_WRITE_TOKEN }}
           SANITY_AUTH_TOKEN: ${{ secrets.SANITY_AUTH_TOKEN }}
           SANITY_CONTEXT_TOKEN: ${{ secrets.SANITY_CONTEXT_TOKEN }}
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          GUEST_PORTAL_SECRET: ${{ secrets.GUEST_PORTAL_SECRET }}

apps/ops/sanity.cli.ts

@@ -17,7 +17,7 @@ export default defineCliConfig({
 	deployment: {
 		appId:
 			process.env.SANITY_OPS_APP_ID ||
-			(isDev ? "yiugiba2sjnhpehqmky6nulc" : undefined),
+			(isDev ? "yiugiba2sjnhpehqmky6nulc" : "bv37w3mpgxoi5p12dg9kmp9r"),
 	},
 });