From 7e053569271e90964891c2e31d62fc95628c3fa3 Mon Sep 17 00:00:00 2001
From: Quorafind <bonopengate@gmail.com>
Date: Wed, 17 Dec 2025 15:43:59 +0800
Subject: [PATCH] chore(security): extract OAuth client secret to environment
 variable

- Add .env.example with GOOGLE_CLIENT_SECRET_B64 placeholder
- Update esbuild config to inject env vars via define at build time
- Add env.d.ts for TypeScript process.env type declarations
- Use base64 encoding for basic obfuscation of injected secrets

This prevents OAuth client secrets from being committed directly to
the repository. Developers need to create .env with their own secrets.
---
 .env.example       |  7 +++++++
 esbuild.config.mjs | 10 ++++++++++
 src/types/env.d.ts | 10 ++++++++++
 3 files changed, 27 insertions(+)
 create mode 100644 .env.example
 create mode 100644 src/types/env.d.ts

diff --git a/.env.example b/.env.example
new file mode 100644
index 00000000..576c5e5d
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,7 @@
+# Google OAuth Client Secret (base64 encoded)
+# For development, use your own Google Cloud Console credentials
+# See: https://developers.google.com/identity/protocols/oauth2/native-app
+GOOGLE_CLIENT_SECRET_B64=
+
+# GitHub token for releases (optional, for release-it)
+GITHUB_TOKEN=
diff --git a/esbuild.config.mjs b/esbuild.config.mjs
index 3bd7575b..4371693d 100644
--- a/esbuild.config.mjs
+++ b/esbuild.config.mjs
@@ -3,10 +3,14 @@ import process from "process";
 import builtins from "builtin-modules";
 import fs from "fs";
 import path from "path";
+import dotenv from "dotenv";
 
 import inlineWorkerPlugin from "esbuild-plugin-inline-worker";
 import { sassPlugin } from "esbuild-sass-plugin";
 
+// Load environment variables from .env file
+dotenv.config();
+
 // Respect release-it dry-run: skip writing build artifacts entirely
 const __D_RY__ =
 	process.env.RELEASE_IT_DRY_RUN === "1" || process.env.RELEASE_IT === "1";
@@ -94,6 +98,12 @@ const buildOptions = {
 	banner: {
 		js: banner,
 	},
+	define: {
+		// Inject base64-encoded secrets at build time (decoded at runtime)
+		"process.env.GOOGLE_CLIENT_SECRET_B64": JSON.stringify(
+			process.env.GOOGLE_CLIENT_SECRET_B64 || "",
+		),
+	},
 	minify: prod ? true : false,
 	entryPoints: ["src/index.ts"],
 	plugins: [
diff --git a/src/types/env.d.ts b/src/types/env.d.ts
new file mode 100644
index 00000000..28569fa4
--- /dev/null
+++ b/src/types/env.d.ts
@@ -0,0 +1,10 @@
+/**
+ * Environment variable type declarations
+ * These values are injected at build time via esbuild's define option
+ */
+declare namespace NodeJS {
+	interface ProcessEnv {
+		/** Base64-encoded Google OAuth client secret */
+		GOOGLE_CLIENT_SECRET_B64?: string;
+	}
+}