indifferentketchup/broccolini-bot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

settings site changes

Browse Source
This commit is contained in:
indifferentketchup
2026-04-21 15:30:40 +00:00
parent 74d7f49c8d
commit 298cf13d5c
16 changed files with 1908 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
routes/internalApi.js
View File

@@ -16,7 +16,9 @@ const {
const router = express.Router();
// Intentionally no trust-proxy: loopback-only; global rate-limit bucket.
// Intentionally no trust-proxy: reachable only from peers on broccoli-net
// (not publicly exposed). Rate limit keys off the raw connection IP, which
// inside the docker bridge is the peer container's address.
const internalLimiter = rateLimit({
windowMs: 60 * 1000,
max: 10,
@@ -40,7 +42,7 @@ router.use((req, res, next) => {
router.get('/config', (req, res) => {
const map = readAllConfig();
const obj = {};
const REDACTED = ['DISCORD_TOKEN', 'REFRESH_TOKEN', 'GOOGLE_CLIENT_SECRET', 'MONGODB_URI', 'INTERNAL_API_SECRET', 'SETTINGS_ADMIN_PASSWORD'];
const REDACTED = ['DISCORD_TOKEN', 'REFRESH_TOKEN', 'GOOGLE_CLIENT_SECRET', 'MONGODB_URI', 'INTERNAL_API_SECRET', 'SETTINGS_ADMIN_PASSWORD', 'SETTINGS_ADMIN_PASSWORD_2'];
for (const [k, v] of map) {
obj[k] = REDACTED.includes(k) ? '••••••••' : v;
}